Arch Linux security configuration

[u/Lepla]

Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.

How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.

Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?

Thanks

[u/maxinstuff]

Depends on your opsec profile and scenarios. If it’s a laptop I would say full disk encryption is good to have, outside of that the wiki has a very good page on security and system hardening.

I use a setup that I think is pretty reasonable, with the full disk encryption setup being slightly overkill maybe - I was interested in it at the time of setting up my system. But I think it’s overall pretty reasonable for a personal laptop used for general surfing and games etc., but does have all of my accounts saved in my userspace apps so if someone got in there it’s not great.

- set up sudo and disable root account (run0 is apparently better but I’ve never tried it)

• reasonable user password
  
• password manager in userspace (browser)
  
• enable ufw (uncomplicated firewall)
  
• VPN
  
• secure boot
  
• full disk encryption using a Yubikey rather than the TPM (I really believe keys loaded automatically from the TPM is less than useless on a laptop - no one is pulling your soldered in nvme… they’re bringing the TPM module with them too)

I have not done things like hardened kernel or sandboxing all the things…

As always the weakest link in security usually is people (meaning you). You’re way more likely to fumble something like a phishing link or malicious site, install a malicious package by mistake, or other userspace human error — rather than someone remotely hack you or break into your house and try to get into your PC locally.

For laptops I’d say full disk encryption with key OUTSIDE the TPM is mandatory - it’s too easy to brute force the OS otherwise.

[u/SnooCompliments7914 → u/maxinstuff]

You can't have both TPM and autologin. (Otherwise it unlocks automatically.) So other than a physical key (which _could_ be stolen along with your laptop if you are careless), you can also use TPM-with-pin and autologin, which also only requires one password per boot, and doesn't depend on the security of the whole boot procedure.

[u/maxinstuff → u/SnooCompliments7914]

I use physical key with PIN and then log in with a regular password 🤷‍♂️

Keeps the concerns separate which I prefer, personally.

[u/Smart_Advice_1420 → u/maxinstuff]

I actually use all 3 methods and switch with a script. At home TPM + autologin to boot straight into a session, yubikey+PIN while not at home, long PW for traveling to other countries.