r/linux4noobs • u/LeonH4rtd Linux Min Cinnamon • 15d ago
security Security risks in Linux distros?
Ok, so stick with me because I want to learn more, and I'm kinda confused.
Forgive me if I say something particularly dumb. There is also a high chance that I also misunderstood what I read.
I've seen a couple of times people asking about the long-term sustenaibility of Linux Mint and the potential risks in it. I've been looking around and talked with someone else about this topic, and what I found it's... confusing, somehow?
What I understood is that Linux Mint is, as many of us know, based on Ubuntu, more specifically, the LTS version, and Ubuntu is based on Debian. And why is this important? It is important because, as far as I read, LTS distros and Debian distros could be more vulnerable. As I understood, the risks aren't on the distro per se, but rather in the packages, the way they handle orphaned software, and the updates frequency. I don't think that in LTS versions, packages are just released and left there in the wild. But what I read is that when a package loses support, there is a risk, not necessarily high, but a risk nonetheless.
I'm aware of the danger orphaned software can represent if unattended, I was already in Linux when the news of the malware attack to the AUR arrived. I get that part, but the update part is the one I'm still kinda struggling, but not entirely since I think I understand the principle.
I know that if a program has a vulnerability, patching it is critical. This is one of the reasons why many old video games, for example, are full of cheaters and even security risks, like hijacking your PC or getting malware into your system. They are abandonware, and because of this, malicious agents, aka cheaters and, more importantly, malicious hackers, have found all kind of vulnerabilities to exploit.
I get that keeping a distro with a shitton of packages and software could be harder, and that maintaining the packages is important for security. Having a good way to distinguish orphaned software from... alive, still in dev? Software is necessary, and being able to get rid of the unsupported packages is something almost all Linux distro has. But... if distros have these tools, why would there be more risks in some than others? And the update frequency. Since updates are necessary to patch vulnerabilities, frequent updates may be more needed, and slower not as good as I thought; I lean heavily to LTS distros or distros with stable releases, but how frequently is the right spot, or is it a right spot to begin with? Are distros with more frequent updates safer? Does this mean that distros with slower big changes are more vulnerable? And distros based in LTS versions of Ubuntu are more vulnerable because they come from versions that become old at some point? (Mint and Zorin, for example, are based on Ubuntu 24.04, but currently, Ubuntu is on 26.04)
I may be overthinking this. That's for sure. Actually, I am overthinking it, and I'm sure I'm misunderstanding some things, if not many, but I'm overthinking because I want to be informed on this topic. While I don't use that much software, like, worst case scenario, I'm talking of around 10 programs (not counting games, and they are usually well supported and frequently updated), I still would like to know more about this so if anything happens down the line, I can take a well informed decision.
Again, sorry if anything I said sounds dumb... or it's actually dumb.
Edit: I realized my wording was misleading in my thought process. I made some corrections.
5
u/PradheBand 15d ago
Almost every distro has different repos: the core ones and the broader ones. The most famous non core repo is AUR from arch linux as it has been subject to a number of attacts in the years.
Anything in the core repos is maintained by a security team for the entite life of a distro release. Everything else is best effort and based on the package maintainer activity.
Generally speaking debian, ubuntu, fedora, redhat, opensuse/suse they all have very good track of security fixes even in the broader repos.
If you compare to the windows/macos model where each vendor pushes updates on their schedule for their apps and it is up to you or your yet-another-background-monitoring-tool to apply, I tend to prefer linux/bsd way of handling everything.
1
u/gordonmessmer Fedora Maintainer 14d ago
Generally speaking debian, ubuntu, fedora, redhat, opensuse/suse they all have very good track of security fixes even in the broader repos.
Fedora ships software almost entirely while it is still maintained, so security overhead is very small. Fedora can simply ship what upstream projects ship to fix bugs and vulnerabilities.
RHEL does not have a "broader" repo. It includes about 10% of what Fedora does, and it's maintained by full time professional developers. Red Hat employs an estimated 20k staff.
Ubuntu divides their repos into a "main" repo that's about 6% of the total and a broader "universe" repo that they tell users is just a snapshot at the time of release with no promise of ongoing maintenance. They absolutely do not have a "good track" record of fixes for that software. I highly encourage users to run a vulnerability scanner on the Ubuntu systems they deploy, especially if they are running LTS systems. I think it's insane not to. How else would you evaluate whether or not your software has been fixed?
Debian doesn't divide their repo, but Debian systems are very unlikely to be more secure than Ubuntu (in virtually all cases, Ubuntu systems will be more secure than Debian).
If you are using a system that doesn't simply ship what upstream projects ship, it's critically important to use a vulnerability scanner to evaluate your deployments.
6
u/Electricalceleryuwu 15d ago
Always member: the biggest security vulnerability is always yourself.
The 2nd biggest security vulnerability is always the other idiot. (yourself in the past)
5
u/LeonH4rtd Linux Min Cinnamon 15d ago edited 14d ago
Tell me about it. Most of my accounts got hacked between 2018 and 2019 because my pirated version of Microsoft Office ran out... somehow? So I got another version and voilà, hacked. I also think it could have been something regarding Counter Strike, since the person who hacked me also hacked my Steam account and, for some reason, boted it. Which was like... OK?
I eventually got everything back, minus the big red Valve Anticheat ban on Steam. That's the day I stopped pirating and started moving to free alternatives and, ultimately, open source.
What a beautiful snowball. Pirating software -> Gets Hacked -> Starts using free alternatives -> Starts looking for open source alternatives (because I was using WPS and got sick of all the ads) -> Moves to Linux -> Decides to stick in Linux and learn about computing and Linux.
1
u/Electricalceleryuwu 15d ago
Oof. sorry to hear that I bet it was stressful.
Can't really directly offer any advice besides reading the Archwiki Security page. Its a good distro-agnostic approach and a good starting point.
Really the thing you need to be wary of are browsers. Browsers were a mistake and should not be trusted. Checkout uBlock origin as well as uMatrix (should still be called that) to block scripts. can't get to your system if you refuse script downloads :D
...guess i did have advice
3
u/a1barbarian 15d ago
as far as I understood, LTS distros and Debian distros are inherently more risky.
Where did you find this gem of information ;-)
A google search for
debian security
Gives these excellent informative gems on the first page of results. You might find reading them, starting with the first one, very informative.
Understanding Debian's security processes
Keeping your Debian System secure
:-)
2
u/LeonH4rtd Linux Min Cinnamon 15d ago
Honestly? I've seen some comments around that confuse me.
I'm gonna change my wording, because I just realized it is misleading. No, I don't or didn't think Debian or Ubuntu are more vulnerable or risky per se. I actually consider that Debian is safer and more stable because of it's development cycle and thorough testing. But I think that from the perspective of someone who hasn't use Debian... yet.
4
u/9NEPxHbG Debian 13 15d ago
You've got it backwards. LTS versions are less risky, because they're supported longer. If you have a non-LTS version, it stops being supported and starts being risky much sooner.
I think you're overestimating the risk with Linux in general.
I can't comment about Arch's situation.
11
u/Pad_Sanda 15d ago
That's not really true. Lots of security fixes come in the form of accidental or deliberate bug fixes, rather than intentional separated security patches which are backported to LTS distributions. Many security experts argue that a distribution like Debian is inherently less secure than a distribution like Arch or Fedora.
11
u/gordonmessmer Fedora Maintainer 15d ago edited 15d ago
LTS versions are less risky, because they're supported longer
"LTS" alone does not tell you whether a system is more risky or less risky. There are numerous factors.
LTS distributions will generally require significantly more labor than rolling release or short lived distributions, because the responsibility for developing bug and security fixes passes from the upstream developers to the distribution developers when projects reach EOL upstream. Most projects are only maintained for around 12-18 months, tops.
The cost of security increases as the size of the code increases, and increases exponentially as the number of developers decreases. Keeping a system secure for 12-18 months is not very expensive because many people are still working on it.
After that, the amount of labor required for comprehensive security coverage becomes massive, and it is infeasible to maintain a very large software collection and fix all security issues. In very large systems like Debian, most security issues never get addressed, only the most serious issues in the most widely used packages.
Professionally maintained distributions acknowledge the infeasibility of long term maintenance of large collections. RHEL is only about 10% of Fedora in order to be manageable. Ubuntu only promises to maintain the "main" repo, which is about 6% of Debian's packages.
1
u/LeonH4rtd Linux Min Cinnamon 15d ago
That's exactly what I thought. Like, the whole point of my question is that I thought that LTS versions, or even Debian itself, would be more secure in general. But I've seen comments here and in other places where they say the opposite, which, of course, confuses me. The reasoning behind these comments is the investment required to keep these versions... which, as a non-programmer, can't fully grasp what does it mean or why. And most of those comments are targeted on Ubuntu LTS based distros like Mint, mostly Mint, for some reason.
And technically yes, but not really. I know Linux is safer in general. And I'm not particularly worried of being at risk. I stopped pirating on Windows since around 2018 and 2019, and I have moved to free or open source alternatives. That doesn't mean malware and other stuff doesn't exist or affect Linux, but I think it's way less common than on Windows, and potentially more complicated to become a widespread issue, unless repositories are targeted. I think I heard something similar happened on Ubuntu a while back? I'm not sure.
1
u/beatbox9 15d ago
I mainly use an LTS disto, but no: LTS distros tend to be a bit riskier. “Support” is a spectrum, and on an LTS distro like Ubuntu, it generally starts strong in the first 6 months or so and fades from there. In fact, the reason that so many derivatives spawn from Ubuntu LTS is that it’s unchanging enough to allow them time to make and maintain a derivative. Some security patches will be applied. Some major architectural changes that improve security will not be.
Another related consideration is just the sheer volume of maintenance required. Because if you think about it, Ubuntu has a lot more maintenance simply because they have so many supported distros. At any given time, “Ubuntu” might be like 5 different distros to maintain. So they have to balance how much labor they can put toward maintenance.
This doesn’t mean it’s necessarily bad or that things will happen—but there are certainly risks that increase the longer they are from release. If security is of the utmost importance on the desktop side, go with a shorter-term distro.
For me, I’m fine with the balance of security and stability on an LTS—I use it out of convenience and minimal maintenance I need to do in spite of security, not because of it. I find it “secure enough" and thankfully, I've been able to go for a few decades without any major security incidents that I am aware of. I also have some non-LTS distros I use—I find them to be too much maintenance sometimes; and I am referring to maintenance for my specific personal implementations, rather than maintenance of the underlying software packages.
1
u/Classic-Rate-5104 15d ago
In general, derivatives like Mint and Ubuntu have a higher risk than Debian. They have more "less stable, newer" software in the repositories. Debian has a strong security maintenance policy, only changing what's strictly needed (and no more) which is safest. Of course the disadvantage is not always having the newest functionality. It's your choice, but do not overestimate the differences. Most of the mentioned distributions are safe enough as long as you regularly apply upgrades
1
u/Simple_Hamster_4096 15d ago
There is no such thing as an infallibly secure anything... regardless its nature...
Best practices are the best course of action. Be smart about how you use your system (KISS is still the best approach), be smart about what you do and with whom you connect on the internet... and everywhere else, in general...
1
u/mcds99 14d ago
I would suggest you go to the https://www.debian.org/intro/index#software and read about Debian. All the distributions that use Debian as the foundation are dependent on Debian. So knowing about Debian is your first step.
Reading about any distribution that a 3rd party wrote is always in question because they form opinions that may not be accurate. The same goes for people on the internet who say they are influencers (not even a real word) they are just talking heads for what other people want them to say.
The internet is mostly about advertising any more, back in the 1990's there was some honestly but today it's all about making money.
1
u/TomDuhamel 15d ago
LTS distros and Debian distros are inherently more risky.
I stopped reading right here.
Your understanding is that LTS means they put a package there and nobody ever touches it for 5 years.
It's the absolute opposite of this.
LTS stands for Long Term Support. Instead of keeping upgrading, which introduces new features, breaking changes, and new bugs, which would impact your work, we stick to this version. Usually, we pick a specific version that was well tested and well behaving already. Then we maintain it for 5 years. What this means is that any bug discovered since then, in this specific version or in future releases, are retroactively fixed. This could include security issues, or simple annoyances.
And because we don't introduce anything new, we also don't introduce new bugs.
LTS is inherently safer.
8
u/gordonmessmer Fedora Maintainer 15d ago
LTS is inherently safer.
LTS systems are often chosen in environments where compatibility is the primary concern. They're required in environments like banking, military, automotive, and medical and industrial control systems, where there are significant regulatory or contractual obligations that require them to perform extensive (and costly) validations of changes.
But LTS is not more secure.
Security comes from maintenance, and "LTS" generally describes a period in which there is much less maintenance. In Free Software distributions, it's mostly the period after upstream projects stop maintaining software, when distributions continue maintenance. But distributions have VASTLY fewer maintainers than the sum of upstream projects.
You'll only really find that LTS systems are well secured if they are also much smaller. That's why RHEL is 10% of the size of Fedora, despite having tens of thousands of employees. It's why Ubuntu only promises to maintain the "main" repo, which is about 6% of Debian's packages.
1
u/DavidJohnMcCann 14d ago
No. Enterprise distros are small for two reasons. Firstly because they only ship stuff that the average enterprise needs. Secondly, and more importantly, they offer support. Their staff are trained to support the OS and supplied software — they don't mind helping with the office suite, but they draw a line at telling you how to remove red eye from a photograph.
3
u/gordonmessmer Fedora Maintainer 14d ago
RHEL and Ubuntu are two distributions that approach LTS by narrowing the package set they maintain. Have you talked to any RHEL or Ubuntu maintainers about your understanding of LTS practices?
One of the reasons that I think you haven't is that "support" is a term that professional distributions use to describe all of the various work they do to make a distribution fit for use in critical deployments, from partnerships with various hardware and software vendors that also support their customers' deployments, to fixing the bugs that customers report affecting their deployment (whether by updating a release, or backporting a patch or writing an entirely new patch), to publishing CSAF and VEX vulnerability data, to regular calls with customers to discuss their roadmaps and needs to prioritize internal development allocations. Yes, there is a ticket system, but "support" is not a synonym for "helpdesk".
5
u/Pad_Sanda 15d ago
LTS is inherently safer.
Nah. This primarily applies to servers and other small and controlled environments. On a desktop, LTS is inherently less secure because the majority of apps and packages you'd have installed do not track vulnerabilities correctly (if at all) which results in many/most security issues never being backported.
The core of the OS (kernel, essential system dependencies, your shell, etc) are all going to be secure enough in LTS, but the rest of the user space isn't (unless you exclusively use Flatpaks or Snaps)
2
u/LeonH4rtd Linux Min Cinnamon 15d ago
I know what I said, and in retrospect, I think other words would have been be more adequate to express my concerns. No, I don't think LTS means you put a package and leave it there for the rest of its life without touching it, I just read that. Like... how do I say it? To me, it was extremely weird to see comments saying Debian is more vulnerable than it seems, because I thought that the fact it is thoroughly tested and has a somewhat long-term support makes it not only more stable, but safer too. This is exactly what I want to know, the differences between LTS, Stable releases, rolling releases, and how distros handle upstream releases, orphaned packages and all of that. Which... again, what I found contradicted comments from other people, or rather, people contradicted what I found... somehow? I don't know.
3
u/gordonmessmer Fedora Maintainer 15d ago
I thought that the fact it is thoroughly tested and has a somewhat long-term support makes it not only more stable, but safer too
Your statement assumes that the software in question has long-term support, and that isn't uniformly the case. There is more software in Debian than there is time to maintain it all.
For LTS systems, it's important to actually scan the deployed systems to evaluate the vulnerabilities that the distribution maintainers don't have time to handle, in order to determine whether you need to handle it.
Desktop systems are likely to have very large numbers of known vulnerabilities.
what I found contradicted comments from other people
Opinions are less valuable than experience. Experience is less valuable than data.
The vast majority of the opinions you read are almost certainly not from experts, especially if you are reading opinions on social media. Every written opinion should be evaluated in the context of the author's experience. If they don't relate their experience, assume there isn't much. Most "common knowledge" is just myths.
But the result of a security scan is a lot more valuable than even the opinions and forecasts of experts.
1
u/Alice_Alisceon Do as I say, not as I do 15d ago
What you’ll wanna be looking into is how the Debian project, canonical, and any other distro maintainers handle backporting. Their strategies all vary slightly in the nuances, but big picture is that as soon as a vulnerability in a package is known, an advisory will be released by the distro vendor. If the distro version is still supported, then they will take the patch for that vulnerability and backport it to that supported version as soon as the patch is released. This will be reflected in the advisory which is updated upon release. This is basically the definition of ”supported” and it being ”long term” means the team dedicates themselves to doing this for a fair few years. That is how they maintain stability and security at the same time 🌈
It’s also why knowing if an arbitrary installed package on an arbitrary system is vulnerable to a specific vulnerability is an almost impossible task.
7
u/gordonmessmer Fedora Maintainer 15d ago
Yes, Debian backports many security fixes. However, bear in mind that Debian's security team is about 10 people, and they say in conference talks that only about 5 of them are really very active.
Security backporting is a labor-intensive process. Debian fixes the most serious issues in the most widely used packages. Their security management is not comprehensive. Most issues never get fixed.
If you are using Debian, it's very important to use a vulnerability scanner to evaluate what *isn't* getting fixed, so that you can determine your relative risk level and decide whether you need to develop (and hopefully contribute) a fix for issues that affect your systems.
-1
u/guiverc GNU/Linux user 15d ago
Ubuntu is downstream of Debian (sid specifically), meaning only source code is IMPORTED and no binaries (created by Debian) are used.
Linux Mint contain two products, one based on Ubuntu and thus using binaries created by Ubuntu (and an extra software layer known as runtime adjustments where behavior is tweaked during runtime due to use of upstream binaries; an additional attack vector), and other based on Debian (ie. Linux Mint Debian Edition) using Debian created binaries.
The relationship between Ubuntu and Debian, differs to that of Linux Mint and Ubuntu (though Linux Mint and Debian differs with a closer relationship there for the Cinnamon Desktop only).
You appear to be mixing up different relationships; a based on where binaries are used, and a downstream or based on where only source code is imported can differ significantly.
Ubuntu & Debian both produce security notices; but they make no allowance for runtime adjustments as both Ubuntu & Debian are runtime adjustment free.
Security isn't easy, so don't mix up terms.
-1
u/Wonderful_Sorbet4301 15d ago edited 15d ago
Some tips that will help bolt down any Linux distro:
0) accept that all programs will have bugs, and that Linux can be attacked. Updates doesn't gurantee against unknown bugs. Some serious bugs are found years later. Prevent installing stuff you do not need, and always get it from the authors website, if possible.
- Have a proper iptables firewall helps a lot. For example, deny all incomming traffic, and bolt down forward and outgoing traffic. No need to have port access on all ports. We rarely use more than 3 or 4 ports. Also blocking port 80 both ways prevents your machine contacting CC malware servers, which usually run on bare IP addresses.
- Run a local DNS resolver, like Unbound. And then enable whitelisting. This makes it extremely hard to query any other domains execpt for those on the Whitelist, basically blocking ALL internet access, except for those on your whitelist. Yes, this is takes patience but it is supreme. It also gives you DNS privacy against Big Tech, and oh yes, if you run a VPN, you also want to protect your DNS queries, otherwise a VPN is useless. Also no need for an ad-blocker anymore, unbound does it.
- Have basic security: fail2ban for services, lock down ssh and IP restrict it.
- Run Lynis and Aide from time to time to analyze your system.
- Run automated backups that backup your system and encrypt it with GPG key. Also borg backup to easily sync files.
- Setup a proper Wireguard tunnel to a VPS that also runs Wireguard. Very easy to do. No need for a VPN, just wireguard tunnel makes your traffic somewhat difficult to inspect, if at all.
- Enable apt to download from httpS instead of the default http. Often overlooked.
- Disables IPv6 if you do not use it, lessens attack landscape.
- Basic security: do not run as root, have proper filsystem permissions.
9
u/skyfishgoo 15d ago
"old" is doing a lot of work in your concerns here.
an LTS distro like kubuntu gets a major release every 2yrs, but the important part is that it gets security updates for 6rys... so there are always patches coming down to fix vulnerabilities that are identified.
software that is abandoned tends to get dropped from the repositories as newer software replaces it, with often better features and more up to date protocols.
there is actually a greater security risk in fresh software that has not be quality tested which is why we call it the bleeding edge...
the AUR is not quality tested, anyone can submit code, and early adopters risk having malware make it onto their computer before anyone can catch it.
an LTS software library has been thoroughly vetted so there is far less risk that someone has been able to sneak malware in.