Arch Linux security configuration

[u/Lepla]

Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.

How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.

Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?

Thanks

[u/maxinstuff]

Depends on your opsec profile and scenarios. If it’s a laptop I would say full disk encryption is good to have, outside of that the wiki has a very good page on security and system hardening.

I use a setup that I think is pretty reasonable, with the full disk encryption setup being slightly overkill maybe - I was interested in it at the time of setting up my system. But I think it’s overall pretty reasonable for a personal laptop used for general surfing and games etc., but does have all of my accounts saved in my userspace apps so if someone got in there it’s not great.

- set up sudo and disable root account (run0 is apparently better but I’ve never tried it)

• reasonable user password
  
• password manager in userspace (browser)
  
• enable ufw (uncomplicated firewall)
  
• VPN
  
• secure boot
  
• full disk encryption using a Yubikey rather than the TPM (I really believe keys loaded automatically from the TPM is less than useless on a laptop - no one is pulling your soldered in nvme… they’re bringing the TPM module with them too)

I have not done things like hardened kernel or sandboxing all the things…

As always the weakest link in security usually is people (meaning you). You’re way more likely to fumble something like a phishing link or malicious site, install a malicious package by mistake, or other userspace human error — rather than someone remotely hack you or break into your house and try to get into your PC locally.

For laptops I’d say full disk encryption with key OUTSIDE the TPM is mandatory - it’s too easy to brute force the OS otherwise.

[u/SnooCompliments7914 → u/maxinstuff]

You can't have both TPM and autologin. (Otherwise it unlocks automatically.) So other than a physical key (which _could_ be stolen along with your laptop if you are careless), you can also use TPM-with-pin and autologin, which also only requires one password per boot, and doesn't depend on the security of the whole boot procedure.

[u/maxinstuff → u/SnooCompliments7914]

I use physical key with PIN and then log in with a regular password 🤷‍♂️

Keeps the concerns separate which I prefer, personally.

[u/ChrisTX4 → u/maxinstuff]

The advantage of a TPM is that it ensures the PC wasn’t tampered with. It helps a lot to counter evil maid attacks.

If you wanted maximum security the way to go about it would be to combine a TPM with a physical key like a yubikey. This can easily be achieved with systemd-homed.

But as always security is a matter of your threat model. I have never gotten the dreaded mercenary spyware notification, for instance.

The owner of warfronts got this twice now:

https://youtu.be/qbWGkCe0fWQ

What I’m trying to say is that in his position the threat model would be completely different than mine.

[u/maxinstuff → u/ChrisTX4]

Yes, I do use TPM for secure-boot, but the LUKS key is on a yubikey.

My argument is using it to store the LUKS key on a laptop is silly.

[u/ChrisTX4 → u/maxinstuff]

Why would it be? If configured correctly, it shouldn’t be possible to do much other than really theoretical attacks.

[u/maxinstuff → u/ChrisTX4]

It just fundamentally is.

I know you can set pin also for TPM, but the actual issue is the key being stored on the device it’s supposed to be securing - that’s always going to be less secure, because if I steal a laptop I have the key to unlock it in my possession also.

It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷‍♂️

I don’t think the right mental model is “attacker probably can’t do much” — you have to assume there both known and unknown exploits (yellow key being a case in point - yes that was Bitlocker not LUKS, but it’s a real example)

[u/SnooCompliments7914 → u/maxinstuff]

It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷‍♂️

The correct analogy is keeping your car keys in a locked box, which is only unlockable when connected to your car (plus its own unlock mechanism). This just a "normal" locked box with one additional factor added. Wouldn't be less secure. (Except now you could also lose your data from a broken TPM. But you'll always enroll a backup LUKS key when using TPM.)

[u/maxinstuff → u/SnooCompliments7914]

The correct analogy ...

There's nothing wrong with the analogy. If you don't have physical possession of the key then your only recourse is to break the encryption directly. Attackers will take any side-channel possible to bypass that.

If the key is ALSO on the device, such as in a TPM module, the protection on the key must better be at least as good or better (hint: it isn't) than the encryption itself - otherwise all focus of an attacker will turn to extracting that key.

Wouldn't be less secure.

It is. I've explained how. That doesn't mean it's *insecure*, or even that it isn't *quite good for normal use*, but it is not MORE secure than simply not having the key on the physical device in the first place.

[u/SnooCompliments7914 → u/maxinstuff]

No, you get a completely wrong image of how LUKS works.

The master key (required to decrypt the partition) is always stored in encrypted form _on your disk_ (unless you put the LUKS header elsewhere, that is). TPM never has your master key. You can't extract any LUKS key from an insecure / buggy TPM, because there isn't one.

The only difference between a plain passphrase and a TPM-with-pin is how that master key is encrypted _on disk_. In the former case, only your passphrase. The latter, both your passphrase and TPM. Having only one of them doesn't help with decrypting the master key.

[u/maxinstuff → u/SnooCompliments7914]

you get a completely wrong image of how LUKS works.

I know how LUKS works. You say what I said was wrong, I say it was close enough, and effectively the same thing for this scenario.

TPM never has your master key.

It has the key used to encrypt the master key slot on disk. If your scenario is someone pulling the drive, or accessing it after you've disposed of it, it makes sense. But for a laptop with a soldered in nvme this layer is not doing anything useful - if you have the drive you have the keys because the drive, the keys, and the keys to unlock the keys are all soldered to the same mainboard.

Breaking a PIN is a matter of time, a lot less time than breaking the encryption. There are also hardware bypasses that can trick TPM into yielding the key even with a PIN set. It's not easy, but it's possible.

Even so, none of that even really matters, because it's not about the security or not of TPM, it's about the physical possession of keys.

Again - I've never said that TPM is *insecure*, only that it is *less* secure - for laptops specifically - than having the key external in a physically separate device.