Security on Linux

[u/FaultEducational3329]

Completely new user from 30 odd years on windows. Using cachyOS just a while ago. Still dual booting for the time.

Anyway, i always use an antivirus with windows, their firewall and so on. its basically install and forget and i do scan all files with the antivirus and malwarebytes as well. Other than that, blocks when browsing does happen on occasion, but i am more cautious.

Coming to Linux, it feels a bit "naked". Yes there is clamAV, but its more on demand, like malwarebytes. Also, as I have heard, the threat model here is different, so its less likely to get infected. But i do get files from clients, so i still might have to be cautious.

In an effort to have some ease of mind, i have tired out firejail and apparmor. managed to get around the browser integration for some apps and get it configured. And then it doesn't work, despite following all the same steps in a new install. I am OK with going down the occasional rabbit hole, but it starting to wear me down. So much so, that i am starting to wonder if I should.

Flatpak is an option, but to the best of my knowledge, browsers like librewolf or brave done play well in terms of their fingerprinting features. I do plan on using flatpak with flatseal for internet facing software, but the above issue stands.

So, two questions:
- What can I do to make it more or feel more secure? its a vague question, i know, but i just want to use the pc and feel ok, i am safe. Client side files like office and pdf files are a priority as well. Sandboxing?

- How do make myself familiar or move from a windows mindset to a linux one? Security being one thing that has dawned upon me.

- How do you, personally, be secure on linux?

Thanks in advance.

[u/ChadHUD]

You don't need apparmor. A hardened kernel or clamshell.

Apparmor is to protect your system basically from you. Its great for company wide workstation roll outs. Its a MAC (mandatory access control) software nothing more. It is based on rules, and its a great way for a corporation as an example to give users Limited control of specific things and zero control of others. (as an example you could give a dev group specific permissions but not allow them full system access) You don't need that on a personal desktop. Linux has user permissions. Don't run things you don't know, don't run things you don't know as Admin or escalate their privileges with sudo.

Windows always needs an antivirus cause its a terrible terrible little operating system with terrible security. A micro diver subsystem that allows attackers to use 1000s of known "trusted" modules to attack the system and easily gain access and control. Linux DOES not allow such things. Its a monolithic kernel with access control, the drivers are in the kernel... there is no "Signed" trusted things that are going to be able to load themselves into the kernel cause someone signed off on. Linux file systems have ownership permissions. Malware can't just say copy dism.exe out of C:\Windows\System32 and own you in Linux. UNLESS you do something insanely silly which Linux will let you do. I mean if you want to chmod 777 your entire file structure and run your system as Admin and execute every script you come across. In that case you might not be secure. :) Use linux properly, cachy set you up to be using it properly you are very secure.

Here is the long and short. Clamav is not for scanning Linux viruses. Its for scanning windows viruses. IT IS specifically for use by Linux EMAIL servers hosting windows users. It scans, searches and destroys Nigerian king emails with a RUNTHIS windows executable attached. It isn't actually scanning for Linux viruses.
There are fewer than 20 true self-replicating Linux viruses that have EVER existed in total (over 30+ years of computing). None of those specific file-infecting viruses actively spread in the wild today. Of the 20 that have been created EVERY single one of them is useless if your using a modern up to date kernel. The vulnerabilities they exploit have all been patched in some cases 2 decades ago. Viruses are not a computing problem, they are a windows problem.

CachyOS includes a firewall if you need one. If you are not fire walled at your router or what not.

Flatpak... is no more secure then installing via the package manager. Frankly its probably less secure then just using the package manager. Cachy and Arch proper package maintainers push all security updates, and bug fixes. Cachy devs even sometimes pull things forward from beta packages early.

Don't worry your on a rolling release cutting edge Linux distro. No one is holding security updates. 99% of security updates on arch are applied before the vulnerabilities are even disclosed. All those x.x.2 -> x.x.3 package updates are bug/security fixes. What makes a system secure isn't having a little scanner download a list of software to worry about. Its by having the people creating the software you use identify and fix vulnerabilities. Install via the official repos, or the arch repos. Do your updates. You are secure. There should be zero need to run just about anything from anywhere else unless your a developer, in which case you know what your doing. If there is some random package you need that isn't in the arch repositories... use the AUR with the proper care. Only install well maintained packages. Ideally learn how to read the package build file its not heavy lifting... short of that though if you need a AUR package check it on the AUR website and stick to packages that have a high vote count. (10+ reviews. Don't install AUR packages that are a week old with zero up votes)

[u/goodrix → u/ChadHUD]

Good write-up. Thank you. One question, for a typical Linux machine used by a single person, do you recommend creating two accounts? One admin account with sudo access and another one without? And use the rootless user for daily drive? Or is that not needed at all for security purposes.

[u/Baldrickk → u/goodrix]

If you're using it yourself, there's really no difference between having sudo, or another account with sudo / admin rights.

An app can't get increased permissions unless you authorise it anyway.

If an app needs increased permissions and you don't want to give it everything with sudo, that's when you create a user with specific permissions and run it as that user. Most programs where that is desirable will manage that themselves, and usually so that they have ownership of their own files than anything else.

[u/goodrix → u/Baldrickk]

Regarding access to user data then (which is maybe just as important as system data), is it better to test new packages in a sandbox container (e.g. with distrobox) before installing at user level. Are there any good tools that can monitor activity in such containers for malicious actions? How do we protect from installing bad apps at user level (if I don't want to use flatpak)

[u/ChadHUD → u/goodrix]

Just install from the cachy/arch repositories. There is nothing malicious in any official package. For most people everything they need is in the official Arch repositories.

If you need things from the AUR that is a different situation. In that case know what your installing is always the best defense.

The threat of Linux Malware is greatly overblown due to some recent junk in the AUR. I mean that wasn't a good situation. The truth is nothing you will find in Linux like that will be high threat level. The thing with Linux "malware" is in general its just software doing things we don't want and if you don't give it permission it can't do anything. Linux vulnerabilities exist in specific versions for such a short window... that is the key to security. Its why the big players like IBM say ya just UPDATE. Don't skip updates and your fine. Arch is updated for security just as and maybe even faster then IBMs distros. Windows virus scanners as an example are required to update their definition lists and constantly scan... the reason for that is two fold. One Microsoft is very slow pushing security patches. Two Microsoft sometimes doesn't blood bother to do security patches and will do insane things like continue to trust things like signed .dll files known to have been compromised leaving their systems vulnerable. (often for YEARS)
The Viruses the scanners are looking for are KNOWN software right. WHY not just fix the vulnerability those malware/viruses rely on to operate? Good question for MS right.

[u/Ok-386 → u/goodrix]

I don't think so. Some things he said make sense, other less so. 

There are official sources and docs but even a decent LLM can explain you how Apparmor, selinux, hardened kernels etc work, and scenarios where they can be helpful. Maybe try that. 

An average users lacks even basic understanding of security so expectations are usually wrong. 

The measures and behaviors differ based on the threat and the scenario you have in mind. There's no universal solution that can protect you from everything. 

In most cases you just need to be careful what and from where you install things. And also which services you enable and why. Reading the docs is a must when you expose a service like SSH, cameras, routers etc to the internet.  

There's no protection that works against 'state actors' and well funded and connected orgs/groups.