2

I want to harden my personal computer against possible security threats.

One thing I'm considering is to for example put my torrent client inside a virtual machine, together with the applications used to execute any files I might download. I would also put a browser in the VM for visiting webpages I don't trust.

  • Does anyone do this? Does this approach make sense?
  • If it makes sense, are there any easier ways of getting same effect?

I'm aware that virtualisation is not 100% safe but I assume it greatly complicates matters for any potential malware/hacker.

Improve this question

3 Answers 3

Reset to default
3

Yes, this approach make sense. There's even a Linux distribution called Qubes OS that does exactly this, with extra care taken so that applications cannot exit their VM isolation.

I would recommend you to read their blog articles if you want to learn more on the subject.

Improve this answer
3
  • You also might want to have a look at Tails although it focuses more on anonymity.
    – 5gon12eder
    Mar 21, 2017 at 17:04
  • It seems like Qubes OS might be one step too far for me. Could you elaborate a little bit on a standard setup using a single virtual machine? Are there any "safer" alternatives to VirtualBox for example? Is there any specific OS you would use in the guest machine?
    – user1337
    Mar 21, 2017 at 20:09
  • If you do not want to go the full QubesOS road, and I can understand that, the OS doesn't matter much. I would recommend VMware over VirtualBox, but the benefit is not that high. You could also use a different OS for your host (such as Windows 10) and your guests (such as Linux) so that a VM escape will be slightly harder to exploit. The most important is to take care not to open any document in your host OS that comes from your guest OS.
    – A. Hersean
    Mar 23, 2017 at 10:47
1

There are a useful tools under Linux called firejail to isolate your application :

Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table. Firejail can work in a SELinux or AppArmor environment, and it is integrated with Linux Control Groups.

e,g : To start firefox ( without options) , you should run firejail firefox

Improve this answer
1

Using a VM would be a good solution if your computer has enough RAM and CPU. Qubes OS is one way, as A. Hersean told you, a VM based Linux distribution, but there are other options, too. However Qubes is a security focused OS, so if you are looking for something like this, Qubes OS would be a great solution.

What you want to do is an option, too. Everything you would run in the VM would normally just harm the OS installed on the VM. Hackers have recently been able to get access to the computer where the VM is installed, but those are an exception.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .