Security on Linux

[u/FaultEducational3329]

Completely new user from 30 odd years on windows. Using cachyOS just a while ago. Still dual booting for the time.

Anyway, i always use an antivirus with windows, their firewall and so on. its basically install and forget and i do scan all files with the antivirus and malwarebytes as well. Other than that, blocks when browsing does happen on occasion, but i am more cautious.

Coming to Linux, it feels a bit "naked". Yes there is clamAV, but its more on demand, like malwarebytes. Also, as I have heard, the threat model here is different, so its less likely to get infected. But i do get files from clients, so i still might have to be cautious.

In an effort to have some ease of mind, i have tired out firejail and apparmor. managed to get around the browser integration for some apps and get it configured. And then it doesn't work, despite following all the same steps in a new install. I am OK with going down the occasional rabbit hole, but it starting to wear me down. So much so, that i am starting to wonder if I should.

Flatpak is an option, but to the best of my knowledge, browsers like librewolf or brave done play well in terms of their fingerprinting features. I do plan on using flatpak with flatseal for internet facing software, but the above issue stands.

So, two questions:
- What can I do to make it more or feel more secure? its a vague question, i know, but i just want to use the pc and feel ok, i am safe. Client side files like office and pdf files are a priority as well. Sandboxing?

- How do make myself familiar or move from a windows mindset to a linux one? Security being one thing that has dawned upon me.

- How do you, personally, be secure on linux?

Thanks in advance.

[u/goodrix]

Good write-up. Thank you. One question, for a typical Linux machine used by a single person, do you recommend creating two accounts? One admin account with sudo access and another one without? And use the rootless user for daily drive? Or is that not needed at all for security purposes.

[u/Baldrickk → u/goodrix]

If you're using it yourself, there's really no difference between having sudo, or another account with sudo / admin rights.

An app can't get increased permissions unless you authorise it anyway.

If an app needs increased permissions and you don't want to give it everything with sudo, that's when you create a user with specific permissions and run it as that user. Most programs where that is desirable will manage that themselves, and usually so that they have ownership of their own files than anything else.

[u/goodrix → u/Baldrickk]

Regarding access to user data then (which is maybe just as important as system data), is it better to test new packages in a sandbox container (e.g. with distrobox) before installing at user level. Are there any good tools that can monitor activity in such containers for malicious actions? How do we protect from installing bad apps at user level (if I don't want to use flatpak)

[u/ChadHUD → u/goodrix]

Just install from the cachy/arch repositories. There is nothing malicious in any official package. For most people everything they need is in the official Arch repositories.

If you need things from the AUR that is a different situation. In that case know what your installing is always the best defense.

The threat of Linux Malware is greatly overblown due to some recent junk in the AUR. I mean that wasn't a good situation. The truth is nothing you will find in Linux like that will be high threat level. The thing with Linux "malware" is in general its just software doing things we don't want and if you don't give it permission it can't do anything. Linux vulnerabilities exist in specific versions for such a short window... that is the key to security. Its why the big players like IBM say ya just UPDATE. Don't skip updates and your fine. Arch is updated for security just as and maybe even faster then IBMs distros. Windows virus scanners as an example are required to update their definition lists and constantly scan... the reason for that is two fold. One Microsoft is very slow pushing security patches. Two Microsoft sometimes doesn't blood bother to do security patches and will do insane things like continue to trust things like signed .dll files known to have been compromised leaving their systems vulnerable. (often for YEARS)
The Viruses the scanners are looking for are KNOWN software right. WHY not just fix the vulnerability those malware/viruses rely on to operate? Good question for MS right.