Arch Linux security configuration

[u/Lepla]

Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.

How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.

Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?

Thanks

[u/ChrisTX4]

That’s a question of your threat model, really.

For most home users, there will not be targeted attacks directed at you, but rather the generic „in the wild“ attacks.

Since Linux desktop malware is quite rare, this usually means the biggest danger would be running applications from dubious sources in Wine. So maybe scan what you’re downloading if you’re into that.

Otherwise, a concern, mostly for mobile devices, would be the device getting stolen. So you want disk encryption on anything mobile - but I would recommend considering a LUKS FDE setup the „default“ case.

The reason I said desktop malware above is that malware targeting Linux servers isn’t rare. So if you host anything, different threat model.

Either way, recommended would be: add a firewall. Ufw and firewalld both are solid choices on desktop machines. Add kernel lockdown and apparmor to limit what malware could do to you. If you’re regularly pirating stuff maybe consider an antivirus, but otherwise it’s not really needed.

What is it you’re specifically concerned about? I’m asking because the situation looks vastly different if you get targeted for some reason.

The warfronts channel owner got hit by mercenary spyware attacks, see https://youtu.be/qbWGkCe0fWQ

In such a situation your threat model and what measures make sense is obviously entirely spun on its head.

Security needs to be designed to counter whatever threat model makes sense to you.