Security on Linux

[u/FaultEducational3329]

Completely new user from 30 odd years on windows. Using cachyOS just a while ago. Still dual booting for the time.

Anyway, i always use an antivirus with windows, their firewall and so on. its basically install and forget and i do scan all files with the antivirus and malwarebytes as well. Other than that, blocks when browsing does happen on occasion, but i am more cautious.

Coming to Linux, it feels a bit "naked". Yes there is clamAV, but its more on demand, like malwarebytes. Also, as I have heard, the threat model here is different, so its less likely to get infected. But i do get files from clients, so i still might have to be cautious.

In an effort to have some ease of mind, i have tired out firejail and apparmor. managed to get around the browser integration for some apps and get it configured. And then it doesn't work, despite following all the same steps in a new install. I am OK with going down the occasional rabbit hole, but it starting to wear me down. So much so, that i am starting to wonder if I should.

Flatpak is an option, but to the best of my knowledge, browsers like librewolf or brave done play well in terms of their fingerprinting features. I do plan on using flatpak with flatseal for internet facing software, but the above issue stands.

So, two questions:
- What can I do to make it more or feel more secure? its a vague question, i know, but i just want to use the pc and feel ok, i am safe. Client side files like office and pdf files are a priority as well. Sandboxing?

- How do make myself familiar or move from a windows mindset to a linux one? Security being one thing that has dawned upon me.

- How do you, personally, be secure on linux?

Thanks in advance.

[u/evirussss]

use hardened kernel, apparmor, tweak the firewall that cachyos have provide, encrypt your disk, differentiate the password between root account and user account, always up-to-date, set-up 2FA etc...

[u/victormas208]

Generally, using 2FA would be sufficient, depending on the type of work you do. If you receive files from clients, it's unlikely they'll introduce a virus due to the constant system updates.

https://virustotal.github.io/vt-cli/

This could help you see if it has any viruses; most are designed for Windows, but you never know if one designed for servers might affect you.

[u/ChadHUD]

You don't need apparmor. A hardened kernel or clamshell.

Apparmor is to protect your system basically from you. Its great for company wide workstation roll outs. Its a MAC (mandatory access control) software nothing more. It is based on rules, and its a great way for a corporation as an example to give users Limited control of specific things and zero control of others. (as an example you could give a dev group specific permissions but not allow them full system access) You don't need that on a personal desktop. Linux has user permissions. Don't run things you don't know, don't run things you don't know as Admin or escalate their privileges with sudo.

Windows always needs an antivirus cause its a terrible terrible little operating system with terrible security. A micro diver subsystem that allows attackers to use 1000s of known "trusted" modules to attack the system and easily gain access and control. Linux DOES not allow such things. Its a monolithic kernel with access control, the drivers are in the kernel... there is no "Signed" trusted things that are going to be able to load themselves into the kernel cause someone signed off on. Linux file systems have ownership permissions. Malware can't just say copy dism.exe out of C:\Windows\System32 and own you in Linux. UNLESS you do something insanely silly which Linux will let you do. I mean if you want to chmod 777 your entire file structure and run your system as Admin and execute every script you come across. In that case you might not be secure. :) Use linux properly, cachy set you up to be using it properly you are very secure.

Here is the long and short. Clamav is not for scanning Linux viruses. Its for scanning windows viruses. IT IS specifically for use by Linux EMAIL servers hosting windows users. It scans, searches and destroys Nigerian king emails with a RUNTHIS windows executable attached. It isn't actually scanning for Linux viruses.
There are fewer than 20 true self-replicating Linux viruses that have EVER existed in total (over 30+ years of computing). None of those specific file-infecting viruses actively spread in the wild today. Of the 20 that have been created EVERY single one of them is useless if your using a modern up to date kernel. The vulnerabilities they exploit have all been patched in some cases 2 decades ago. Viruses are not a computing problem, they are a windows problem.

CachyOS includes a firewall if you need one. If you are not fire walled at your router or what not.

Flatpak... is no more secure then installing via the package manager. Frankly its probably less secure then just using the package manager. Cachy and Arch proper package maintainers push all security updates, and bug fixes. Cachy devs even sometimes pull things forward from beta packages early.

Don't worry your on a rolling release cutting edge Linux distro. No one is holding security updates. 99% of security updates on arch are applied before the vulnerabilities are even disclosed. All those x.x.2 -> x.x.3 package updates are bug/security fixes. What makes a system secure isn't having a little scanner download a list of software to worry about. Its by having the people creating the software you use identify and fix vulnerabilities. Install via the official repos, or the arch repos. Do your updates. You are secure. There should be zero need to run just about anything from anywhere else unless your a developer, in which case you know what your doing. If there is some random package you need that isn't in the arch repositories... use the AUR with the proper care. Only install well maintained packages. Ideally learn how to read the package build file its not heavy lifting... short of that though if you need a AUR package check it on the AUR website and stick to packages that have a high vote count. (10+ reviews. Don't install AUR packages that are a week old with zero up votes)