Im courious to know about how these large enterprises secure their linux desktop as Google does with ubuntu LTS. I am the only user at home with linux on the desktop and had already created some iptables incoming rules and that all. I want to copy some of those methods for my own desktop. How do they configure the following?

  • IPTables rules (in/out/fwd)
  • Antirootkit (apps/notifications of warnings and threats founds)
  • Antivirus (apps/notifications of warnings and threats founds)
  • Banned Repositories
  • Banned defaults apps
  • AppArmor/SELinux settings
  • GUI Policy Settings (polkit)
  • X-Windows / Unity settings
  • Allowed web browser (firefox?)
  • Allowed browser plugins (adblock, noscript?)
  • Malware detection daemons
  • Anything important not listed


closed as too broad by TildalWave, Xander, schroeder, Rory Alsop Aug 21 '14 at 8:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Jose - while we do have some hardening questions which have worked here (see the Related sidebar to the right) this one would require a book to answer fully. – Rory Alsop Aug 21 '14 at 8:25
  • Without a threat model it's hard to tell Jose what s/he should do that would provide the best ROI. Does s/he trust the GUI apps s/he installs, the extensions to his/her apps? That's where the lowest hanging fruit are. – Steve Dodier-Lazaro Aug 27 '14 at 21:53

FF is likely a fine browser and it's either that or Chrome on Linux, so employees would probably feel more at home with Chrome. True security would be from a terminal based browser, but that's highly inconvenient.

As for addons, likely none. I imagine that noscript would make an employee confused and angry. AdBlock might be fine though.

Superuser would be banned, so no root terminal.

rootkits seem unlikely in a corporate environment, but there is always rkhunter if needed.

Remember, there must be a balance between usability and security. Sure, everything can be perfectly secure. But then it becomes unusable.

As for an OS, Ubuntu or Fedora must be common. With one of the desktops similar to windows like LXDE.

Not the answer you're looking for? Browse other questions tagged or ask your own question.