Hi, I'm fucking paranoid about cybersecurity and i moved Linux. I listen "Linux is safe, don't care about malwares" but i still don't trust. I installed today Arch Linux and i3. After installation i found strange named "Remove" "After" "Upgrade" "You". Well i installed just alsamixer and i3-gaps and now i want listen. What programs do you use to protect your GNU/Linux?
>>53809186
gentoo
>>53809186
> i moved to a GNU/Linux
>strange files, named like a...
Sorry for my errors.
>>53809208
this t.b.h. f.a.m.
what???
>>53809324
I installed Arch Linux and i3-gaps and ALSA. And i found strange named files in my folder.
If >>53809186
you are using minimal distribution like arch be sure to read man page of every installed package.
>>53809186
You must have a lot of CP and loli
>>53809505
This. Google is your friend. If you don't know what it is, find out.
>>53811028
Already tried, nothing found. I just reinstalled it to XFCE.
>>53811062
Is security or also privacy what you want? They are two different things.
Also, system monitoring is apart too.
>>53809186
Systemd botnet
>>53811125
OP here
Security. I don't care about privacy. I'm not hidding .
>>53811185
In that case.
There is a tool that automatically hardens your GNU/Linux, is called Bastille. It does some security settings for you, but of course you have to be sure of what you do. Otherwise, here is a list, figure what you need according to your skills and preferences:
Anti Virus (to clean windows viruses from a friend's windows computer): ClamAV, ClamTk
HID Framework: Tiger
Rootkit Detection: Chkrootkit
Integrity Check: Tripwire
System Logging: Syslog-ng
Sandbox: chroot, LXC
Privilege Authorization: AppArmor
User Permissions: Sudo
Filtering Proxy: Privoxy
Man-in-the-middle Defense: ArpON, arpwatch
Network Intrusion Detection: Suricata, Snort
Network Intrusion Prevention: Fail2ban
Firewall: Netfilter, iptables, Uncomplicated Firewall
>>53811382
Almost fortgot. Maybe is more privacy oriented but keeping passwords safe is a good habit. I suggest KeePassX, it has autocomplete for browsers.
>>53811382
Many thanks. Not OP, but interested.
>>53811533
We should have these threads more often imho.
kys owen
>>53811583
Yea /lst/GNU/Linux Security Thread is pretty good idea.
None tbqh
>>53811382
> User Permissions: Sudo
Every bug in sudo is additional backdoor to a privilege escalation (CVE-2010-0426, CVE-2015-5602). That goes for every piece of software running with root privileges.
>>53811382
Another tool to test your system is Lynix.
>>53809186
I use iptables, grsec, OSSEC and fail2ban to protect my Linux.
Also, stop prepending "GNU/" to it like a goddamn retard.
If you want security, why would you use Linux? It doesn't even have mitigations!
>>53811888
and thus another shitty general was born
>>53812521
yes use grsec
and why did you install arch? you should be using gentoo hardened or complete lfs with specific compiler and linker flags to add protections to your programs. for example you would want full read only GOT so that ROP involving reading and overwriting function pointers in the GOT section will be thwarted, you want SSP, and in all functions so typical buffer overflows become more of a pain since there is a value in the function prologue you must match at the check at the epilogue otherwise you get jumped to a stack check failure function that will exit the program. you want full ASLR not only in your program but the libraries they use, you want a program that can exist anywhere in memory. you should use grsec's aslr in kernel and forced aslr in userland. processors today typically have a hardware bit that marks some parts of memory as non executable so code injection like shellcode is treated as data, however libraries like libc are executable because they have to be. this was marketed by AMD in 1997 as the NX bit and Intel marketed as the XD bit later on. lastly you dont want hardcoded library runtime paths so make sure RPATH and RUNPATH and not set.
-Wl,-z,now,-z,relro will make GOT readonly
-fstack-protector-all will put canaries in all functions (osdev.org has a wiki page about ssp, give it a read)
-pie -fPIE -fPIC will make sure your binaries are able to be location independant in memory
-D_FORTIFY_SOURCE=2 will help with stack based overflows
--noexecstack will simulate NX but again not really needed.
together with grsec, and anything else you want will get you set. use rbac for acls, never selinux.
