[HN Gopher] Linux Security Hardening and Other Tweaks
       ___________________________________________________________________
        
       Linux Security Hardening and Other Tweaks
        
       Author : fonder
       Score  : 52 points
       Date   : 2022-10-28 15:51 UTC (7 hours ago)
        
 (HTM) web link (vez.mrsk.me)
 (TXT) w3m dump (vez.mrsk.me)
        
       | suprjami wrote:
       | Linux has randomised TCP Timestamps per-connection since v4.10 so
       | there's no longer any need to disable them:
       | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
        
       | fsflover wrote:
       | I hardened my Linux by installing https://qubes-os.org instead.
       | My daily driver for years.
        
         | triter wrote:
        
         | Shared404 wrote:
         | What did you install it on? Qubes has tempted me for years but
         | it's weight/lack of hardware compatibility has put me off.
        
           | fsflover wrote:
           | I run it on a Librem 15. For more laptops have a look here:
           | https://forum.qubes-os.org/t/laptops-that-just-work-with-
           | qub....
        
             | drewlander wrote:
             | Works just fine on my Dell Precision 7540. Tried briefly to
             | get GPU passthrough to work but failed. I lack the time to
             | seriously try. Otherwise, it works great.
        
       | matthews2 wrote:
       | > Sandboxing is a way to limit the potential damage a compromised
       | process can do. Firejail is the tool I like the most for this
       | task.
       | 
       | Note that Firejail is a suid binary that has had a reasonable
       | number of vulnerabilities in it, so it may hurt more than it
       | helps.
       | 
       | https://www.cvedetails.com/product/36171/Firejail-Project-Fi...
        
         | fonder wrote:
         | > it may hurt more than it helps.
         | 
         | If we use a web browser as an example, what are the odds that a
         | compromised website is going to try to exploit the browser
         | itself vs. exploiting an external sandbox application? Clearly
         | the former. Sandboxing a web browser will prevent many more
         | classes of attack than it exposes you to.
         | 
         | Also worth noting that the suid binary you mention will refuse
         | to run at all if the executing user isn't in its whitelist.
         | It's not like you can pop a shell on some ftp user and run
         | firejail as root.
        
       | readingnews wrote:
       | You know, I rarely think about this:
       | 
       | # chmod -R go-rwx /home/*
       | 
       | Why are most default homes setup with a mode other than 700
       | directories 600 files? I know, it is because of the default mask
       | system wide, but it seems to make sense to do this to homes,
       | unless I am missing something?
        
         | nerdponx wrote:
         | I have the same question. And why not go a step further? Set a
         | default ACL on the home directory.
        
         | technion wrote:
         | Possibly a legacy of websites with tilde home directories being
         | the norm at one time.
        
       | icare_1er wrote:
       | I'd also recommend checking any sudo commands you would like to
       | put, in GTFObins first.
       | 
       | You'd be surprised how many executables can actually permit
       | running commands.
        
       ___________________________________________________________________
       (page generated 2022-10-28 23:01 UTC)