1

I'm interested in using GNU/Linux for different reasons. Partly for freedom, privacy, and security. But also to force myself to learn Linux. One issue I’ve found is that desktop Linux seems to have fairly poor security by default which is a little odd considering GNU/Linux is often recommended by security experts in certain circumstances. I looked into hardening Linux but that guide is clearly for very advanced users who have a lot of time on their hands. My threat model is sort of mixed. I'm not a highly targeted individual, but I also plan to do sensitive work with investigations and activism so security is still very important to me. I'm hoping to do everything on one laptop for monetary and practical reasons, so I want to avoid using a burner for my more sensitive work if possible. I've also looked into Qubes, but much like the previously mentioned hardened Linux guide, it looks like it is more for advanced users and it comes with a lot of usability issues.

Are there any simpler Linux hardening guides that still address many of the presented Linux security concerns? Or better yet a way to automate the "hardening" process? If it matters, I think I'm most comfortable using Linux Mint Cinnamon since that's what I've used for some time, but I'm open to using anything that's easy and just works out of the box with little to no configuration necessary.

Improve this question
5
  • 1
    Have you considered Tails? tails.boum.org
    – fuzzydrawrings
    Jun 7, 2021 at 17:13
  • You can strip down the kernel in Linux to reduce the attack surface, something which is impossible with a closed source operating system like Windows. If you're not going to be modifying it to that extent, then I would agree with most of the points in that poor security web page you linked. Windows has spent significant resources making their home users secure, including but not limited to "annoyances" like automatic, forced security updates. Have you considered looking at OpenBSD?
    – user
    Jun 7, 2021 at 18:09
  • @fuzzydrawings I use Tails occasionally, however it's only useful for very specific applications. I'm looking to use a general purpose host OS (such as Linux Mint) I'm just not sure how I can go about hardening it.
    – arrakies
    Jun 7, 2021 at 19:57
  • @user I'm not sure I follow what you mean in regards to the kernel. As for OpenBSD, I've never really used it. The same security researcher I linked to also has an article on OpenBSD, but security aside, I'm not sure how usable it is. Not to mention I'd be losing out on the whole "education" aspect for using Linux.
    – arrakies
    Jun 7, 2021 at 20:01
  • @arrakies For Linux it's relatively easy (as someone who used it a whole lot) to strip out drivers and features from the kernel. You can reduce the attack surface by removing everything you don't need. If you just want to run a web browser, then OpenBSD should be sufficient. Updating the system is also very easy with syspatch, and they have a security page with all of the security updates they release for the system.
    – user
    Jun 7, 2021 at 20:07

1 Answer 1

Reset to default
1

There is no easy guide or hard guide as such for Linux hardening. You at least need basic Linux understanding to harden the Linux systems.

Also, you should know what you are doing before following any online tutorial regarding the hardening steps. Blindly following the hardening steps will only give you false sense of security.

If you understand basic Linux, you should go with Linux security guides, books or online tutorial and try to implement on test environment and check what it does. Its time consuming although.

As of now since your work requires at least some level of security I recommend going with Windows OS if you do not have any constraints with respect to tools or command line until you are confident enough with Linux.

Configuring Windows OS with basic security settings is easy and Windows is also secure. Enabling hard disk encryption, TPM, using Virtual Smart Card (VSC) is easy and will help you to keep your Laptop and data secure.

Configuring Linux for security by blindly following online tutorial is not a good idea if your work requires some level of security.

Improve this answer
7
  • Can you clarify what VSC is? I can't remember hearing of it, and a google search only turns up VS code.
    – nobody
    Jun 7, 2021 at 20:40
  • 1
    Virtual Smart Card, can be used in combination with TPM for login, encrypting data with extra Authentication etc.
    – saurabh
    Jun 7, 2021 at 20:46
  • I’ve thought of using Windows but it would require me to disregard the very foundation of what I want to get out of my computer and how I want to use it. I would have to give up privacy, freedom, etc. As an alternative, what are your thoughts on using VMs? Something like virt-manager, GNOME Boxes, or maybe VirtualBox to contain sensitive work?
    – arrakies
    Jun 8, 2021 at 0:16
  • With VM the issue is still the same i.e. OS security. If you can't configure your OS to be secure, vm's with hardware virtualization will only provide you isolation from base OS. If you can't use windows you can also go with Linux OS like qubes which provides decent level of security even at default settings. But again you need to check as per your requirement and level of security.
    – saurabh
    Jun 8, 2021 at 5:54
  • @saurabh I took a look at Qubes before. I might go that route, though it does look like it has a lot of usability issues. If I understand correctly, the benefit to using Qubes rather than a hypervisor would be that your host OS itself is protected, correct?
    – arrakies
    Jun 8, 2021 at 23:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .