linux and security - by slonkazoid

a guide to linux & computer security for newbies and professionals

written
2025-03-29T11:00:00Z
last modified
2025-11-02T12:39:03Z
tags
draft linux security virtualization
link
back to home

linux and security

here i discuss the basics and the not-so-basics of OS-level security, alongside a bit of information about linux

WARNING: this is post is a messy draft of stuff i needed to get off my chest. i'll make it into a proper series of posts once i can be arsed.

terminology

the rest of the terms are explained in their respective sections.

distribution

you can't just "install linux". linux isn't an operating system itself, but a kernel to build an OS on top of, though the term is also used generically to refer to all linux distributions. linux-based operating systems are called "linux distributions", as they quite literally distribute linux, along with system components, applications, and other software to form a complete operating system (OS).
you must pick a distribution first, but don't let that intimidate you; the selection might be large, but it is possible to switch later on.

no matter which distro you pick, you should consider enabling

as everyone in the linux community knows, there is no one distribution that is the best for everything. some options for security and ease of use include:

general purpose

security oriented

some other "security oriented" distros are mostly memes or niche cybersecurity toolbelts.
examples include:

these distributions are not magic. if you are intending to do cybersecurity work, you can install all of these tools on a conventional linux distribution. they are just a bit wonkier than other software because cybersecurity people are really bad at packaging software for some reason.

software

this section details how to install software on linux, and the sources you should get them from.

No amount of security measures will protect you if you violate the golden rule: Don't fucking run random stuff you find off the internet. it is still wise to try to isolate rogue or more likely vulnerable software.

the main method for getting software for linux is using package managers.
"package manager" is a generic term for software that let you install, upgrade, remove. or otherwise manipulate other software, including the OS.
when used alone like in this section, "package manger" usually refers to the OS default package manager (dnf for fedora, apt for debian, pacman for arch, etc.).
the operating system's package manager is the most basic (not simple!) way of installing software (unless you consider downloading an archive to be 'installing' software), but it usually requires root privileges because you are modifying the operating system.

repositories are places package managers look to download packages (could be an application, or a part of the OS), and are critical to their function. repositories provide the following information:

package managers are usually configured to pull information from multiple repositores, allowing you to choose where you get your software from, and add your own if you want.

software center

the software center, or the "shopping bag icon" refers to the package manager GUI of your choice. it usually has a shopping bag icon and the generic name "Software Center" in whatever desktop environment you use. it's where you will be installing, removing, and upgrading most of your packages and operating system. it will look something like this:

KDE Discover GNOME Software

how do you get apps via the software center? well, you can type the name of the thing you want in your start menu:

searching 'Discord' in the Plasma menu

…or you can click on the shopping bag icon and search it there!

'Discord' in Discover

uninstalling stuff is just as easy. find the app and hit 'Remove':

right clicking Prism Launcher in the Plasma menu hovering over "Remove" in Discover

flatpak

flatpak is a package manager for linux, focused on providing a great GUI experience and security by sandboxing apps. flatpak applications usually have strong desktop integrations, and work across a wider selection of distributions. it's official repository, included in some (😒) distributions by default is Flathub. Flathub builds, curates, and provides thousands of linux applications for you. it should be the first place you look at to get new apps.this is extremely controversial

below is the badge you'll see on projects that are on Flathub. you can click it to be redirected to the page to install the application.

"Get it on Flathub" badge

flatpak has a permissions system like old Android. apps request permissions while you are installing or updating them, and you can choose whether to continue with the installation or not. you can also override these permissions using applications like Flatseal, or through the system settings if your OS supports it.

Plasma's System Settings app viewing the permissions of Discord

i recommend adding the flathub and flathub-beta repositories as user repositories, which makes it so installations are owned by you and in your home directory. this does make apps private to your user instead of available to everyone, though, so keep that in mind if you have sharp storage constraints. read more about "System versus user" on the flatpak docs. to do this, enter the following commands in your terminal:

flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak remote-add --user --if-not-exists flathub-beta https://flathub.org/beta-repo/flathub-beta.flatpakrepo

you should review what permissions flatpak apps request before installing them. in addition, on flathub, packages published by the original developers will have a verified badge, so pay attention to that. "unverified" apps aren't necessarily insecure, it just means that the person(s) packaging the app are not explicitly authorized by the original authors, and therefore the package is unofficial.

OS package manager

conventional linux distros come with a default package manager, through which the operating system and default applications are installed. Fedora has dnf, Debian and Ubuntu have apt, etc. the OS package manager is also

stick to official repositories not just for malware-related reasons, but also because unofficial repositories aren't maintained up to the same standard and can break your system. in the end, it's your choice who you trust. i recommend using the package manager to get stuff like CLI programs and development tools such as IDEs, rustup, and such.

other

what to do if the application you want isn't available (or outdated) in the software center?
well, you go to the project's website and follow the installation instructions. apps may not want to be included in official repositories—or the other way around—for a plethora of reasons, therefore a lot of them choose to host their own.

Windows applications

see Wine.

games

Just use Steam . that's it. if the game you want isn't on Steam, add it to your library. if you want to play Epic Games or GOG games, take a look at Heroic Games Launcher .

for Minecraft, use Prism Launcher , even on Windows. it's lightyears ahead of the official launcher.

the section below is for advanced users only; recommended to do your own research concerning these topics
it is filled with major footguns that unless you know what you are doing, you are likely to misuse

compositor

aka: "Desktop Environment" (DE), "Window Manager" (WM)

you could use something tried and true like KDE Plasma/GNOME or go with a more minimal, safer approach like niri. stay away from Xorg, it is 6000000 lines of barely functional code with an inherently insecure protocol, requiring the reimplementation of display, input, etc. drivers for itself (more attack surface! yay!). stick to wayland + Xwayland for X11 apps. i recommend staying clear of wlroots-based compositors because the only 2 functional ones have major downsides:

my compositor of choice is KDE Plasma. it just works out of the box and comes with security features that are missing in some other popular compositors. it's also the first DE i daily drove.

luks

LUKS ("Linux Unified Key Setup", though no one cares what it means) is a method of disk encryption for linux. you interact with it using cryptsetup. it supports detaching the encryption metadata from the disk itself, providing plausible deniability without compromising security.

defaults to keep

recommended options

these options will make unlocking the partition far slower in exchange for strength against wordlist and bruteforce attacks.

cryptsetup luksFormat --cipher=aes-xts-plain64 --key-size=512 \
    --pbkdf=argon2id --pbkdf-force-iterations=24 \
    --pbkdf-memory=8388608 --pbkdf-parallel=4 \
    /dev/<device>

filesystem

i recommend btrfs with the BLAKE2b checksumming algorithm, and no compression. but the 'no compression' part might hurt performance and waste disk space, and the confidentiality gains are in the paranoia zone.

mkfs.btrfs /dev/mapper/<encrypted> --checksum blake2

kernel

use a known-good kernel. linux-hardened is a popular one but imo it cuts down on usability for non-existent 'security' gains. SELinux is recommended.

lockdown

this is enabled by default if you boot with Secure Boot, but you might want to change it to it's stricter mode: confidentiality.

cmdline

you should be mounting root read-only ro for Not Fucking Up The Filesystem reasons, among other things.

another good idea is disabling the emergency shell and other emergency options, as that can lead to the initramfs being compromised before the system boots (you don't want that!). this is a requirement if you are planning on doing TPM-backed LUKS, as keys are released to the initramfs, and anyone can trigger an emergency.

ro lockdown=confidentiality nowatchdog rd.shell=0 rd.emergency=halt

initramfs

ideally, you should be using dracut to generate a signed UKI, which you verify while the system is offline, before each boot. this is unrealistic however, and a better solution would be to use the TPM to implement some kind of remote attestation. i go over this in the dracut-sshd-tpm section.

hibernation

don't do hibernation. if you must, use a swapfile in the encrypted btrfs filesystem. archwiki has a guide on this.

sshd

if you want to unlock your LUKS partition over the network, i recommend dracut-sshd. it's Reasonably Secure and allows you to verify that the initramfs hasn't been tampered with when used in conjunction with dracut-sshd-tpm:

dracut-sshd-tpm

i made a tool to extend dracut-sshd with TPM sealed host keys, effectively providing cryptographic remote attestation with tools everyone has access to: just an ssh client.
source code

it works because when your ssh client first connects to a host, it remembers it's host keys' hashes in the ~/.ssh/known_hosts file. whenever you connect to a host, it checks against that file and warns you if the key is not recognized, and errors out when it has changed between connections. if you seal the keys with the assistance of a TPM, you can set up rules for when the keys will be released to the initramfs. the keys still have to be stored (in encrypted form) in the initramfs, because they wont fit in the TPM, only the AES keys will.

please note that this project is unfinished and still requires a lot of manual work to actually persist keys across rebuilds. this is not a problem for confidentiality.

secure boot

<todo>

init system

for auditability, you might want to use a minimal init system, but i highly recommend against this for a desktop system. systemd is widely used and audited, with many security advantages such as isolation of processes via namespaces, user services, and such.

not covered (yet?)