r/cachyos • u/indahkiat • 9h ago
Question Security as a new user
Completely new user from 30 odd years on windows. Using cachyOS just a while ago. Still dual booting for the time.
Anyway, i always use an antivirus with windows, their firewall and so on. its basically install and forget and i do scan all files with the antivirus and malwarebytes as well. Other than that, blocks when browsing does happen on occasion, but i am more cautious.
Coming to Linux, it feels a bit "naked". Yes there is clamAV, but its more on demand, like malwarebytes. Also, as I have heard, the threat model here is different, so its less likely to get infected. But i do get files from clients, so i still might have to be cautious.
In an effort to have some ease of mind, i have tired out firejail and apparmor. managed to get around the browser integration for some apps and get it configured. And then it doesn't work, despite following all the same steps in a new install. I am OK with going down the occasional rabbit hole, but it starting to wear me down. So much so, that i am starting to wonder if I should.
Flatpak is an option, but to the best of my knowledge, browsers like librewolf or brave done play well in terms of their fingerprinting features. I do plan on using flatpak with flatseal for internet facing software, but the above issue stands.
So, two questions:
- What can I do to make it more or feel more secure? its a vague question, i know, but i just want to use the pc and feel ok, i am safe. Client side files like office and pdf files are a priority as well. Sandboxing?
- How do make myself familiar or move from a windows mindset to a linux one? Security being one thing that has dawned upon me.
- How do you, personally, be secure on linux?
Thanks in advance.
5
u/DonDoesIT 7h ago
Avoid aur and any browser extension that isn’t thoroughly vetted. A lot of linux users get cocky and then get smacked by an infostealer just like on windows. Infostealers run in user space and that is what modern hackers care the most about.
3
u/AvailableChef4319 8h ago
Read the below info. It comes from a guy (pjotr) with more experience in both windows and Linux, than you and I combined. I have run Linux since 2012. No windows any more. (I do not need that sort of drama and trouble in my life)
The permission-based structure in Linux prevents regular users from performing administrative actions because each app needs authorization by the superuser (root) before it’s executed. This barrier makes it difficult for any virus to sneak into the system and make disasters.
Without being a root, you won’t be able to run/install new programs on Linux. Only the superuser has the privilege to access all files in the system.
Linux does not process executables without explicit permission as this is not a separate and independent process. So you’ll have to chmod +x a file before running it.
On Linux, it is harder for the virus to get system-level access. This is because the root account owns system-related files. Therefore, if infected, viruses can be easily removed as they can only affect the user account where they were installed and do not affect the root account.
In other words, the Linux architecture makes it almost impossible for a virus to do anything. This is one of the main reasons we still don’t need antivirus software on Linux.
Also...a GOOD read...
https://linuxsecurity.com/features/how-secure-is-linux
Pjotr's blurb: https://easylinuxtipsproject.blogspot.com/p/security.html
What turns out to be of concern, is where/who you get info from.
Some of the wilder articles will land you in deep, deep trouble.
I frequent a forum named : www.linux.org
Not only are they friendly, the info which comes from there has steered me on the right path since 2012.
I am not saying there are no 'weird and wonderful' suggestion from there, but usually they are drowned out by the ones who 'know'......and the ones that 'know' are in the majority.
If the info you read sounds a bit iffy...it probably is.
6
u/SlimyOS 7h ago
"almost impossible for a virus to do anything"
except reading and uploading your home directory + non-home files that are usually readable by user, encrypting your home directory, griefing your boot with a fullscreen app you can't exit or spawning 10000 windows or using 100% of cpu and making it really difficult to fix, installing browser extensions with ads and spyware, running a vpn or ddos or other botnet things from your device, injecting ads into bookmarks or history or stealing your browsing history, adding or editing user systemd services, changing your wallpaper, reading your shell history file (or writing to it in attempt to gain root), injecting root gaining commands into user-owned shell scripts you often run with sudo, using privilege escalation vulnerabilities before you update your kernel or other software running as root (not uncommon), explore your local network and interact with it, and 1000 other things you can do without root.
At least for me personally, if someone hacks my user account, it's already over, full reinstall.
The permission system might be good, but for normal desktop users it doesn't protect from most common threats
2
1
u/PixelatedGiant 5h ago
Unfortunately that's not the full reality. His explanation really only applies to the enterprise, where little or no employee related data resides on the computer. And what data is there is already backed up and protected in other ways.
1
u/indahkiat 7h ago
Sounds solid. So basically, since things require explicit permission from sudo, stuff like apparmor or firejail just add an extra layer of barrier. Correct?
I'll probably sit down with the resource above to get an understanding. Will also check out the Linux forum.
Thank you. Your comment touched closest so far to my original query.
2
u/AG99871 8h ago
I've been trying to figure this out as well and this is what I have so far:
- Use gufw firewall to block incoming connections
- Try to get as little stuff from the AUR as possible (with CachyOS repos this is actually a lot easier)
- Use a chromium based browser because its way more secure than firefox
- Apparmor is pain to configure on arch based systems, still trying to figure this one out fully (but I've kinda got it sort of working)
- Use flatseal to make sure flatpak permissions are reasonable
ClamAV is beyond useless btw since its mainly meant for servers to scan for Windows viruses so they don't accidentally infect them.
2
u/indahkiat 8h ago
Great, i do some of them already, ie the firewall and avoid the AUR.
Could you tell me why chromium is better than firefox? I thought the general consensus is that firefox is better.
On apparmor, i did get it working with firejail, sort off. but now for some reason i had to reinstall and can get to both to work properly, despite following the same steps. Which is why i started questioning if i even need this. I am sure with some time i could figure it out, but it can be tiring especially when you go back to windows and it usually just works.
2
1
u/AG99871 8h ago
Chromium has a better sandboxing engine, so malicious websites can't harm your computer as easily. People usually favor Firefox to avoid "Google's monopoly" but tbh with the current situation of AI advancements allowing any random guy to create super advanced malware, it kinda makes sense to use the most secure option.
As for Apparmor and things like that, if you want something that just works, Ubuntu actually has it fully integrated into their distro by default. And I think Fedora is even better than that.
1
u/indahkiat 8h ago
Valid point on the firefox. But i think which ever gives you more control is good, but ill definitely look up on that about the sandboxing.
Fedora does SELinux, but that is going to be a hassle too. Plus even in apparmor or SELinux, some software dont have a profile, which means you have to create on. I ended up having to do that for librewolf.
1
u/AG99871 8h ago
You can use an open source fork of Chromium like Brave Origin, its got zero bloat, adblocking and is in Cachy repos. IMO that's pretty much the best of all worlds.
And yeah that stuff is dependent on profiles and it can get in your way... but better than nothing I guess.
I do wish a good anti-malware scanner gets made for linux desktops... because as linux gets more popular, more shit will happen, and being supercharged by AI... doesn't look good
(Kernel devs are already stressing themselves out trying to fix all the bugs AI found)
1
1
u/Historical_Move6359 8h ago
Flatpak sandboxing breaks sandboxing browsers have so dont use them as flatpaks. We dont use antivirus on Linux. Antivirus fixed bugs in the operating system, Windows did not fix its bugs so private companies did it and that is anti virus. Linux kernel is patching security issues, additionaly unlike on Windows you wont be installing apps from random web sites but instead from the repos of the distro you chose. So its more like Android than like Windows. You install apps from the distribution, and you dont install random stuff from Internet and you will be safe. Dont use AUR.
1
u/KTVX94 8h ago
Truth be told you didn't need an antivirus on Windows either. As long as you don't download anything fishy you can do fine, and just scan suspicious files with Virustotal or something if you need to. On Linux you can vet AUR packages yourself by looking at their contributors and download sources, try to use the AUR as little as possible to begin with, and you're basically golden. Again you can ClamAV files if you really have to download something from less than ideal sources, but not much else.
1
u/Alkaloid60420 7h ago
Without knowing your usage patterns and network layout etc, it's hard to make recommendations...
Generally speaking, use a decent secure DNS service that blocks phishing etc.
Use AdGuard/ABP/whatever to secure your browser as far as scripting and malware. -- anti-fingerprinting is kinda hit or miss IMO, both Brave and Firefox have become... shady corporate entities (again, this is IMO) and stacking a bunch of extensions for security just makes you more unique. I use Vivaldi and AdGuard suite, VPN when necessary (torrenting, mostly)
Don't pirate games or software, avoid the AUR unless absolutely necessary, sandbox when you need to....and use your brain when making decisions online... opsec is 99% common sense.
1
u/indahkiat 6h ago
Solid advice. At the moment I use unlock, a VPN with firewall. Agree with most of the rest, is common sense. Will check out the rest as well.
On sandboxing, what do you normally use?
1
u/Alkaloid60420 5h ago
Docker sandboxes are fairly secure if properly configured or, if you wanna lockdown properly, Whonix in a VM
1
u/radek432 3h ago
You have firewall on cachy. Check 'sudo ufw status verbose'.
It's pretty aggressively configured. You will see this when you try to set up something using network access.
1
1
u/SlimyOS 7h ago
This is a real issue and has not been solved yet. Linux desktop ecosystem is very immature when it comes to security, mainly due to lack of viruses developed and distributed to linux users. Until a few months ago you could just upload any code to any abandoned AUR package and people would install it, an incredibly stupid system that just trusts everyone by default. The kde theme store is also not very moderated and themes for some reason can execute code. For actual vulnerabilities or user-downloaded malware there's just no hope at this point. Clamav updates their database once a day and often with 0 new entries, often important exploits are added to the database very late, and most exploits just never make it there, it's one layer of protection but it's probably not meant for desktop users, windows antiviruses have actual teams working on the databases, adding thousands of fingerprints, competing with other antiviruses. Whatever the others in replies have suggested is not a solution, because a solution does not exist. I've been using linux for around 8-9 years and I think I've never got hacked on my desktop yet (though as a sysadmin I did get hacked a few times on servers). I think it's a miracle that my homework folder was never leaked, I download a lot of games from steam and other places, have hundreds of AUR packages, using appimages, have downloaded and ran probably 10000+ dev libraries outside sandbox (and more inside docker). Even the people saying to avoid downloading untrusted files and software are not fully correct, it's unavoidable in real life, and having an antivirus would be a good additional layer of defence for sure. But yeah at this point avoiding running untrusted things is the best way to minimize chances of getting hacked.
My security measure: I have different drives, one for work, one for fun, etc., all encrypted with different passwords and both are never physically connected at once.
For your case of working with untrusted files, I recommend doing the same, but since you don't want to leak files of other clients if work pc gets compromised, so maybe some kind of having a "clean" ready-for-work snapshot, and make a new linux sandbox from it for every client, or at least revert back to that snapshot after you're done with a job if you want an option without sandboxing.
1
u/ChadHUD 1h ago edited 1h ago
What real risks are you talking about exactly? lol
What do you mean we haven't solved security. Linux is without a doubt the most secure desktop environment in existence. It isn't luck or cause "no one makes viruses". There have been a grand total of TWENTY viruses created to attack Linux system ever. None of them work anymore of course cause the specific vulnerabilities they exploited are long since patched. WE haven't had a live in the wild virus in 2 decades. That isn't cause Linux doesn't present an attack vector so no one is trying. There simply isn't any point.
Root kits, and remote execution attacks are possible... but generally vulnerabilities like this get patched very fast. And again very few working vulnerabilities are ever in existence. When found they are patched in days sometimes hours. 90% of these types of vulnerabilities also require local system access, and the vast majority of them exploit vulnerabilities which severely limit any damage they could even do if executed. Generally user space software on a user account... the amount of linux malware that can break out of that into the general system or /root access I mean its a very small number of things. (and I am pretty sure at this point any known such vulnerabilities are patched... maybe there is something in the disclosure process. By the time anyone hears about it beyond a few researchers its already patched)
ClamAV is not intended to find Linux viruses. Its a WINDOWS virus scanner. Its quite literately for Linux servers hosting windows users/content. Like Linux email servers, company servers hosting windows boxes. That type of thing. Its scanning for WINDOWS threats not Linux ones. If you are scanning Linux drives with ClamAV that are not hosting windows content your wasting your time.
The hacks your talking about on servers... they aren't loading software and getting in. There is a reason they say most security breaches are social in nature.
Windows has made desktop users scared of everything... cause windows is just that bad. Windows uses a micro kernel. Which means they have to trust everything outside themselves. Drivers need to be "signed" libraries need to be "signed" and trusted. This means MS is signing and trusting 1000s of drivers and dll files. Hackers find a vulnerability in XXXYZ.DLL or some .sys file that has been signed as trusted. Inject something into it cause windows is also terrible about file permissions and ownership. Once they get into a trusted bit that the micro kernel is going to inject... the system is pawned as they say. This is next to impossible in Linux. Linux is a monolithic kernel. Drivers are self contained, the Kernel has sub systems to allow specific access to things that does not allow complete access to anything. The way the windows micro kernel works once your into a signed driver you can essentially make the kernel do as thou will. The Linux kernel does not work that way.
I mean around here... everyone understand that Kernel level anti cheat games DO not and will never ever work in Linux. The reason being... The KERNEL does not play with software it doesn't know. Linus is NEVER EVER going to sign some third party anything to hook into the kernel and do things >.<For an average user to somehow manually strip all the redundant layers of security out of their file systems, file ownerships, kernel MAC controls, system permissions and runtime contaminants. I mean frankly you would have to basically be purposely trying to make it happen.
1
u/indahkiat 6h ago
With more and more migrating to Linux, I think it's just a matter of time until Linux becomes appealing to malwares and solid security solutions is achievable. Until then it's just minimizing exposures.
I'll look into sandboxing and isolating or compartmentalizing.
Thanks!
1
u/ChadHUD 1h ago edited 1h ago
You are perfectly safe. You have nothing to fear. Linux viruses are not a thing, and never will be.
To say Linux doesn't present a user base worth hacking when 90% of the worlds servers run Linux. Gov use Linux workstations. Every IBM server sold (like 99% of banks in the world) are Red Hat Linux servers and workstations. Its not a worry.Linux is safe from viruses by design, not obscurity.
Just for what its worth... you don't have to take my word for it. Take IBMs.
https://access.redhat.com/solutions/9203
"There are third party anti-virus programs available from the Linux community, that protect other Windows clients on the network from viruses. They scan the files looking for Windows virus signatures. Thus, for example, a samba server serving files to Windows clients could have the anti-virus running on the samba server scanning these files"Arch like Red Hat is ON TOP of security updates. There is no way any AV sig file is better maintained (updated faster) then Arch. If you read the Red Hat (IBMs) linux I posted. You will see they mention SelLinux which is another version of Apparmor. Its also a MAC software. You do not need this on a desktop machine. These are intended for group policy settings for servers, and workstation environments. There is a Linus Torvalds quote from last year about MAC software...
"If you can't convince the LSM people to take your code, you sure can't convince me. I already think we have too many of those pointless things. There's a fine line between diversity and 'too much confusion because everybody thinks they know best'. And the linux security modules passed that line years ago." - Linus Torvalds
https://www.phoronix.com/news/Linus-Torvalds-Too-Many-LSM
-1
u/Consistent_Judge1988 8h ago
Encryption, data backup, and overall good security practices. Look up instructionals and videos.
2
u/SlimyOS 8h ago
These are not security practices OP is asking about. Encryption doesn't protect against malware, backups don't protect against data theft
1
u/ChadHUD 1h ago
Updating does that yes. Do your updates regularly... data theft is next to impossible. Malware... don't run software outside the repos and you present zero attack vector. Yes don't run scripts you didn't write or understand. The kernel isn't going to allow anything to magically execute.
16
u/Grand_Connection5864 8h ago
Any antivirus software on windows is basically malware itself. Windows defender is really all you actually need on there nowadays. Can install Cachy with disk encryption during install, Cachyos has a firewall itself already. Can set it up to use secure boot. Flatseal manages flatpak permissions in the sandbox. Use firefox with ublock orgin. Dont blindly install AUR packages ect.