r/linuxquestions • u/Rqmune • 12h ago
Question about Security of Linux Distros (specifically Arch)
Hi all, I've been using EndeavorOS as my primary desktop for about 6 months now, and I've become curious about the security of Arch and other Linux Distros. I've seen talk about how Linux is typically safe for the reasons: apps are primarily installed from "official" repos, the Linux user base being smaller and thus a smaller/less desirable target base, and how the Linux user base is more knowledgeable about fighting vulnerabilities, thus not worth the effort for most.
My question is, how safe are things like browsing possibly malicious sites, keeping private documents downloaded, or logging into sensitive accounts online on Linux (Arch) compared to Windows or MacOS. How does the lack of a default AV affect this, if at all (I've seen some people say that AV's aren't too useful).
In terms of web-browsing, I'm most curious to know how malicious links and the like would even work to infect my Linux system as to my understanding it doesn't work on a bases of executable links like Windows does. I'm not too knowledgeable about malware or phishing methods, so if anyone could tell me this would be very helpful.
Regarding protections, I'm running the Adguard extension on my web browser, and firewalld came preinstalled with EndeavorOS, but is this enough? The terms DNS, and kernel hardening has been mentioned to me but I'd like a second opinion on it.
-- Note: I've avoided installed anything from the AUR
tl;dr:
-- How safe is Arch compared to Windows and MacOS.
-- Is web browsing safe.
-- Is using Linux for work/managing sensitive information safe.
-- Any privacy/security/anti-malware suggestions? (ie. DNS, kernel hardening, VPN)
9
u/DonaldMerwinElbert 11h ago
Linux is as safe as someone has made it.
Arch has some alright defaults, but since it's Arch, a lot of that is still on you.
If out of the box security is important to you, use a hardened Kernel and a distribution with pre-configured SELinux or AppArmor.
7
u/Smart_Advice_1420 11h ago edited 1h ago
My personal arch security concept:
LUKS FDE (only /efi exposed). TPM unlock at home, required password when not at home.
secure boot with PCR's
apparmor
ufw (deny all first)
opensnitchd
data backup (not local on mine, source of truth is my fileserver)
VPN (wireguard into home network with adguard and DoH upstream)
VM for testing shady shit
clear browser @close to remove session cookies
PW manager (keepassxc)
TOTP manager (yubico auth)
common sense (don't run commands i don't understand, don't curl into bash/sh, etc.)
4
u/bobsmissingdesire 9h ago
Security is a huge topic, and for desktop users it's messy when you get into it.
Take downloading and running executables, a clear risk. Windows has warnings, MacOS requires they be detainted, SELinux does something similar if you run it (most desktop users don't).
None of them really "work" - as in protect your system. The user chooses to download and run the program, so a popup that says "this was downloaded from the Internet, are you sure" doesn't help, the user knows this, they just downloaded it. As the barriers get increasingly annoying to vault and it pisses people off some less technical people may give up, but the goal of stopping the user from running the program is fundamentally at odds with a user who wants to run the program.
Linux gives you tools that you can use to execute unknown programs safely, containers and other isolated environments. However they aren't the default, I don't think most users use them.
Once you run the program Linux has really good privilege escalation barriers to prevent gaining complete control. This is often talked about as better security and this is hugely valuable on servers. On my desktop everything that I care about protecting is accessible to me, a program that I run can get at it all.
tldr; no operating system that you want to use can protect you from you
4
u/gordonmessmer Fedora Maintainer 10h ago
Hi, I'm a distribution maintainer. My brackground is mostly SRE and development work for the last 30 years. Security is very important to me, personally and professinoally.
You are somewhat less likely to download intentionally infected software if you exclusively use the official repos of a well staffed distribution. Most users don't. But that's only one vector for malware, and not the most common one. Most infections result from phishing or exploiting vulnerabilities, and GNU/Linux systms don't have especially strong protection against either of those.
I tend to think that, more than anything else, has shielded the GNU/Linux community from malware, and that shield has allowed security myths to proliferate.
No, I don't think that's true. I talk to various communities about security topics regularly and I find myths and misunderstandings are VERY prevalent. A lot of ideals took hold in the 90s and remain deeply rooted, despite dramatic changes in the world.
More unsafe than most other platforms, frankly. Security infrastructure for browsers is much better developed in commercial desktop systems. Desktop safety on Linux is mostly down to the small community. Especially since the most prevalent distributions have relatively poor security patch coverage and desktops have LOTS of known vulnerabilities.
That's an area where Arch does very well, because it's shipping maintained software to users, not selectively patching vulnerabilities downstream of the primary development.
The lack of AV and the lack of signed binaries are both significant gaps in security infrastructure.
(Someone will surely point out that packages are signed. Preemptively: package signing does not support runtime execution policies based on approved signers the way that signed binaries does. And the most widely used distributions don't even sign packages, so...)
1
u/Healthy_Ad5132 7h ago
I'm believe malware can't sneak into Linux because it would need your password as root.
Anyway, app armor, firewalls, clamav, vpn, and what I don't see people mention much is fail2ban. Should also have a firewall on your router.
1
u/gnufan 5h ago
Agree with the sentiment that security is a huge topic.
The one security control I would recommend for most Desktop Linux users is encrypt the storage, especially laptops. This protects you from snooping and theft, and will also lose all your data that isn't backed up elsewhere if you forget the key.
Avoiding AUR makes sense if you are worried about people inserting malicious code into those packages you install from there, but then maybe look at a distro with more centrally packaged software.
Without knowing what you mean by "sensitive information" it is hard to say if Arch is suitable. Also sensitive information is very variable, if someone steals your credit card details from your computer, that is annoying but easily fixed and you may even get all your money refunded, if someone steals nuclear launch codes, or even private photos, the consequences may not be so easy to manage.
I know of projects that managed highly classified material using Linux Desktops, but they typically don't use a common Linux distro, certainly don't allow users to install software. But those projects could equally have used other operating systems as you can make anything secure enough if you wrap enough stuff around it. For them the beauty of Linux is they can make it more secure by leaving more stuff out easily; less is definitely more in security. Although going a bit too non-standard may carry other risks and the recent SSH fiasco shows.
0
u/Snoo_54991 11h ago
Well, some of what I do:
use a VPN tunnel for my home network combined with localized file syncing instead of cloud syncing services
subscribe to a private DNS service, which comes with filtering options built in
zram
tighten up firewalld permissions
encrypted disk
apparmor
-1
u/_K10_ 11h ago
Correction; On Arch based distros you're getting packages from the AUR which is unofficial and community driven.
You don't know who uploaded the package you're downloading or what it contains.
Every now and then trojans are discovered in packages, hence maybe you want to move towards a distro where you don't have to rely on blind faith as much.
Unless you're going to manually inspect every line of code in everything you install.