How do you secure a linux installation?Is it just enable the firewall and encrypt your disk and use a password manager like bitwarden?I know atomic distros are safe but I prefer standard distros.
>>109521142>bitwardennah
>>109521142you dont!
>>109521142secure from what? from who? these are the questions you must ask first.
1. Keep web browser up to date. Use DNS adblocking, encrypt DNS. I recommend https://libredns.gr and use the noads.libredns.gr endpoint2. Keep distro up to date3. ufw is fine4. Yes you should encrypt your disk. Use LUKS FDERecommendation for distro: Fedora. https://sysguides.com/fedora-36-with-luks-full-disk-encryption as a reference.
>>109521755how do i know custom dns isn't just more botnet. i dont turn on cloudflare firefox dns for a reason
>>109522152You can runit yourself if you're paranoid
thinkpad bios password to boot is likely one of the best available
>>109521142Containers (Docker is not a security container and hardly provides more security than bare metal), but this goes for Windows/Mac OS too, not just Linux. Linux specific securing includes the following:>a firewall (ufw, firewalld)>defensive in depth per program access definitions (ie, allowing connections only from certain subnets in your samba .conf)>very restrictive unix permissions, including ACLs and other similar shit>secure boot (it works on linux too, though afaik not as well as on windows)>selinux or apparmor (these are like ACLs on steroids and provide much more powerful and more fine grained control over what software can access and what it can do)>pen tests and intrusion tests, ie the red hat CIS benchmarks (unfortunately debian was left out the last time i looked)>encryption at rest is good but it doesn't do anything when the data is not at rest, ie when the machine is on and the encrypted partition is mountedsnaps/flatpaks are kind of like a cheap selinux/apparnor, but they are not personally up to my security standards because so many of them are built by random third parties instead of the actual devs or your distro's maintainers>>109521755dns adblocking and encrypted (or recursive) dns is more of a router thing. if you want to be a schizo, get a router that can run openwrt and install either the og adblock package or adblock fast. then install unbound to get recursive dns that sidesteps your isp's. this is considerably more air tight than DoH iirc. you can also use opnsense to do the same thing, though you'd need an x86 machine to run it
>>109521142Just don't use the AUR and odds are you'll be fine
>>109522942>Dns adblocking and encrypted (or recursive) dns is more of a router thing. If you want to be a, get a router that can run openwrt and install either the og adblock package or adblock fast. Then install unbound to get recursive dns that sidesteps your isp's. This is considerably more air tight than DoH if I recall correctly. It makes no difference whatsoever. It just saves you the trouble of doing it all your devices. If you want to do it on one or two devices, it literally makes zero difference. Just make sure your system-level DNS and your browser-level DNS are aligned (or maybe you want to use separate DNS servers for those two things, again, it makes no difference)
>>109521142>How do you secure a linux installationYou can't
>>109522987>edgy ms paint comicnot real advice
>>109522979unbound completely sidesteps third party dns servers and recursively queries the root servers. it caches the results on your device so that they're faster for next time. doh is better than nothing but unbound is definitely more secure, not to mention network wide (as you say) so you only have to configure it once for all devices (many of which may be iot devices, which you cannot tell to use doh). when you use a third party dns service, you are still putting yourself in the position of having to trust some randoms with your dns queries. unbound removes this and only queries the source
>>109523022He asked for how to setup a secure linux installation. Installing unbound is an advanced defence in depth thing that goes far beyond the threat models of most users. I gave him direct, simple, actionable steps that teach him directly how to solve the problem that he asked. You go into extreme DiD stuff that most people do not want or need. Encrypted DNS = Your ISP will not see the urls you are looking at (although it might leak in SNI, you should use v2ray for best security, ironically I see no mention of v2ray in your setup) - And not only that, I already told them that they could use their own dns server if they want. Also, shout-out to pic related, the guy who wrote the very good in depth guide that I linked earlier. You are a pedant.
>>109523041you said>It makes no difference whatsoever. It just saves you the trouble of doing it all your deviceswhich is false, unbound is the industrial grade version of private dns because it doesn't rely on anyone but the root servers. that is not pedantry, that is an obvious and real difference>v2raynow you're just namedropping random privacy related projects. no shit using them makes you more secure. using tor makes you more secure. you talk about pedantry but then start rambling about random shit>that pic and guidefull at rest encryption with snapper is basic shit and only protects you when the device is powered off. also, it's hilarious hard much harder it is to do that on fedora than it was on debian kek
>>109523124>Now you're just namedropping random privacy related projects. No using them makes you more secure. Using tor makes you more secure. You talk about pedantry but then start rambling about random shitYou are not being serious. This isn't amateur hour. In 2024, the Open Technology Fund paid a professional security firm (7ASecurity) to perform a full white-box penetration test on V2Ray. 4 senior auditors spent 32 workdays trying to break it.The result: Zero "Critical" or "High" severity vulnerabilities were found. The only medium-level issues were minor fingerprint quirks in the Go programming language, which can be patched with a simple config tweak. The auditors even praised the code for being meticulously organized.https://www.opentech.fund/security-safety-audits/v2ray-security-audit/I am done engaging in this thread. You are a joke.
>>109523158Sorry, my userscript mangles links sometimes. I've gone ahead and disabled it for now.https://www.opentech.fund/security-safety-audits/v2ray-security-audit/Here is the working link. I said I was done engaging, and I am, but it's important to me that the working link be in the thread for anyone reading.
>>109521142>Shitwarden
>>109523175what's better?
>>109521755I'm new to dns things, but reading about dns encryption leads me to believe that it hides what sites you vist from your isp. Is there any downsides to doing this? Seems like no one would use a vpn if they could just encrypt their dns for free.Pretty interesting stuff
