Linux security hardening and other tweaks | Hacker News Reader

Linux security hardening and other tweaks

vez.mrsk.me

111 pointsfonder28 comments

Linux has randomised TCP Timestamps per-connection since v4.10 so there's no longer any need to disable them: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

I'd stick to having a unified vfat boot+EFI partition mounted at /boot. systemd-boot is the simplest bootloader and it doesn't support loading it's config and kernels from non-vfat partitions anyway. Just make a 5GB boot+EFI partition so you can store plenty of kernels or even a recovery image.

For security, I recommend following Madaidan's Insecurities Linux hardening guide, it has good explanations of most of the same sysctl options and kernel flags. [1]

The only option that may be best left disabled is `init_on_free=0` since this is one of the few options that has a measurable performance impact (besides the normal spectre/meltdown related options).

For NTP, systemd-timesyncd works fine and is probably the default for any modern distro.

Desktop security is still a nightmare, if you use a Wayland based desktop environment and Pipewire for audio/video streams then maybe in 10 years you'll a secure clipboard and no unauthorized keyloggers.

[1] https://madaidans-insecurities.github.io/guides/linux-harden...

> wayland & pipewire

Is there something desktop users can do? Fedora seem to use both by default.

Reading it through now, pulseaudio might be the way. Now i am in github rabbithole…

pipewire is replacing pulseaudio. Besides reducing latency it tries to manage permission for audio and video streams.

And if 5GiB seems too dear to lose, I use a 128MiB EFI partition that's still big enough to hold three UKIs, since each UKI is ~30 MiB.

> Sandboxing is a way to limit the potential damage a compromised process can do. Firejail is the tool I like the most for this task.

Note that Firejail is a suid binary that has had a reasonable number of vulnerabilities in it, so it may hurt more than it helps.

https://www.cvedetails.com/product/36171/Firejail-Project-Fi...

> it may hurt more than it helps.

If we use a web browser as an example, what are the odds that a compromised website is going to try to exploit the browser itself vs. exploiting an external sandbox application? Clearly the former. Sandboxing a web browser will prevent many more classes of attack than it exposes you to.

Also worth noting that the suid binary you mention will refuse to run at all if the executing user isn't in its whitelist. It's not like you can pop a shell on some ftp user and run firejail as root.

You're assuming escaping the browser sandbox wouldn't also escape the firejail sandbox. The bypasses are likely the same.

I hardened my Linux by installing https://qubes-os.org instead. My daily driver for years.

What did you install it on? Qubes has tempted me for years but it's weight/lack of hardware compatibility has put me off.

I run it on a Librem 15. For more laptops have a look here: https://forum.qubes-os.org/t/laptops-that-just-work-with-qub....

Works just fine on my Dell Precision 7540. Tried briefly to get GPU passthrough to work but failed. I lack the time to seriously try. Otherwise, it works great.

You know, I rarely think about this:

# chmod -R go-rwx /home/*

Why are most default homes setup with a mode other than 700 directories 600 files? I know, it is because of the default mask system wide, but it seems to make sense to do this to homes, unless I am missing something?

Before UPGs, every user would have `users` or something similarly generic as their primary group, and it was intentional that everyone's homedir allowed read access to that group for the purpose of sharing files between users.

With UPGs, every user will have a bespoke primary group, so having group access to the homedir is not a problem. Whether the distro still keeps the other-readable bit is up to the distro. For example, OpenSUSE used to be in the pre-UPG 0755 camp, but switched some time ago to the UPG 0700 camp.

The default UPG usage and homedir permissions are controlled by USERGROUPS_ENAB and HOME_MODE in login.defs (under /etc or /usr/etc, depending on your distro).

> For example, OpenSUSE used to be in the pre-UPG 0755 camp, but switched some time ago to the UPG 0700 camp.

When was this? 15.4 doesn't have user per group by default, nor does it have 0700 on $HOME by default. I have several fairly recent installs around I checked. Something in Tumbleweed perhaps? My last Tumbleweed install was last year sometime and does not have user per group nor 0700 $HOME.

https://bugzilla.opensuse.org/show_bug.cgi?id=1182850

https://bugzilla.opensuse.org/show_bug.cgi?id=1189139

I did a new TW install in April 2022 that had UPG by default, which is how I noticed.

I got around to checking, and turns out that my Tumbleweed installs are creating new users with 0700 home directory now. I didn't think to try creating a new user in my earlier checks, I just checked the existing users I've had. New users are still 0755 home directories on 15.4 though.

Yes, the change was to login.defs, so new users will be affected. There's no migration for existing users, because it would be breaking.

Funny enough Ubuntu didn’t even make that change until 2021 https://news.itsfoss.com/private-home-directory-ubuntu-21-04...

I have the same question. And why not go a step further? Set a default ACL on the home directory.

Possibly a legacy of websites with tilde home directories being the norm at one time.

I'd also recommend checking any sudo commands you would like to put, in GTFObins first.

You'd be surprised how many executables can actually permit running commands.

It's great to have guides like this, but there are a lot of recommendations in here, and I don't understand the implications of all of them, individually or together.

The author seems opposed to disabling security mitigations for performance reasons, but what are the trade-offs? What if you use your workstation for 3D rendering or machine learning, and you really do want to maximize the performance of your hardware?

Most of the options don't have much or any performance impact. The few that do e.g. the spectre/meltdown related ones provide improve security far more than they impact performance on a recent-year CPU. If these security options make or break your ability to do certain kinds of work - then you'd probably benefit most from using a more modern and faster CPU.

If anything some of these options are more likely to break the occasional application completely e.g. some applications use user-namespaces.

This article starts with an Arch-based system. I think it should be noted that the Arch wiki also has its own recommendations for hardening. [1]

[1] https://wiki.archlinux.org/title/Security

linux is such garbage security-wise that it had to be a niche "hardening patch" to make processes not be able to see the argv of other processes. this normally wouldnt be a problem, except for the fact that linux and its proponents claim that it and other unixes have ultra secure user separation facilities

I'm not sure who's ever claimed that. From the get-go, Unix design philosophy was simplicity, and it was in opposition to Multics and other complex multi-user OSes that had a lot of security and compartmentalization baked-in.

I remember during my first job discovering that SunOS had C2 security available and trying to enable that, then realizing it messed up a lot of stuff and trying to disable it by hand... what a nightmare. I was fascinated by compartmentalized security type stuff but I really had no idea. That sort of security will really hamper user productivity and collaboration. You need to spec it out, because otherwise an OS is going to default to the latter.

No wonder how we got C instead of PL/I.

Reply on news.ycombinator.com