Help: Questions about maintain a Linux distro.

Toggle sidebar Toggle sidebar
M

MOS_6502

Honorable
May 2, 2014
68
0
10,640
Hello to all.

Since I don't know much about Linux, I have a series of questions about Linux maintenance. A relative (A bit novice in computer matters) asked me if I can install on his computer a Linux distro, and I'm thinking on various options, but I don't know yet what distro I will select.

I have a series of questions, keeping on mind that I prefer a system can run fairly flawlessly without my intervention because I can't go to his house too often:


1- How it works Netfilter and Iptables in a self-sufficient way for a novice user? I mean, if I install a distro on his computer and I leave it alone with the default settings, how the user would be protected against port scanning or another random net attack?.

2 - How the user would be protected against a program calling home? There's some sort of visual warning against a program doing some type of net communication or there are rules by default on Netfilter that doesn't allow to any program to use the net if not stated otherwise with a program path?. (I say this because I don't know what this user will instal after a complete OS installation and I want to know how he will protected against any of these.)

3 - (Related to the above question) If I install Iceweasel and the respective security plugins and I set a Linux account with no Administrator privileges, how safe it will the browsing for the system and the browser if we are using common sense and we surf through standard pages?.

And otherwise, how the browser and system will be protected against other attacks not related to using Java,Javascript or malicious adds if the user clicks on a link and is redirected to a malicious site?.


4 - This is a bit of common sense, but here it goes:

We will think that I will explain to this user how to get packages from the repository and I explain how to install them. There's some maner to know if there are guarantes that the package are you installing doesn't have some unwanted surprises and is 100% safe? (asumming that you are geting the package from the official source)


5 - How I can prevent in Linux that certain programs can't access to some system resources or sensitive operations related to security or data integrity?.


6 - What modules / programs need to be updated regularly in Linux to stay relatively safe on the net?


---

As you can see all the questions are mainly related to network security on Linux, which I have heard that is strong on that matters but I think is useless if you don't know how exactly works.

I apologize for asking so much, but I'm a bit lost on that matters.
 
Solution
P
Sort by date Sort by votes
skittle

skittle

Splendid
Dec 27, 2006
4,036
3
23,960
The questions you ask are not easy to answer. Seriously there are entire books and people write their dissertations on the subject.
Instead I will point you to some materials on the subject to get you started:
https://wiki.archlinux.org/index.php/security
https://www.debian.org/doc/manuals/securing-debian-howto/index.en.html

For most desktop usage a simple firewall, sensible sudo/root usage, trust the package maintainers to not include anything malacious, and regularly update your system (e.g the recent openssl bug) are enough.

For beginner with firewall recommend UFW and its gui http://gufw.org/
https://wiki.archlinux.org/index.php/Uncomplicated_Firewall
 
Upvote 0 Downvote
P

Pinhedd

Champion
Aug 7, 2007
10,342
20
56,965


1. IPtables is an interface used to configure the kernel provided firewall. Since its primary purpose is to act as a complete interface, it's rather complicated to use on its own. Many distributions include a frontend to IPtables which simplifies regular user operations while still allowing IPtables to be used directly.
Ubuntu contains a frontend named 'uncomplicated firewall' which is indeed quite easy to use. RedHat derived distributions have system-config-firewall

2. The only way to prevent a program from phoning home is to disallow all outbound communication by default and open up the firewall for selected applications only. This will not stop a program from phoning home if it piggybacks on top of another program, such as a web browser plugin or script. I wouldn't worry too much about this though as installing software on linux from locations other than the distribution repository requires more work than doing the same on Windows, it's not as simple as double clicking on an executable file. As long as you instruct him to limit his software installations to those included with the operating system he'll be fine.

3. Mozilla Firefox is the default browser on most Linux distributions and will usually be installed by default. Chrome can be installed without much issue on Debian based operating systems and RedHat based operating systems. It will be as safe as it would be on Windows because the security policies are nearly identical from the perspective of the application.

4. The only sort of software that has any sort of guarantee is software that is subject to extremely stringent testing and documentation regulations. This software is found in nuclear power plants, aircraft, satellites, and medical machinery; it is not found in your desktop. Software located in Linux based operating system repositories is heavily tested and almost always open source but that does not preclude something getting overlooked (such as the infamous Heartbleed bug) or inserted maliciously (such as a patch that included a carefully hidden security exploit that nearly made it into the Linux kernel a few years ago). Security updates are regularly issued for Linux based operating systems, so don't be fooled by the "Linux is immune to viruses" line. Keep on top of the security updates and always follow best practices.

5. The only way to do this is to ensure that data belongs to a different user and is not readable by other users. It's a pain to do this, so don't bother. Just be careful what you install. The rule of thumb is if you can open and read a file without entering supervisory credentials, then any application that you run can open and read that same file without entering supervisory credentials.

6. All of them. Operating system repositories maintain updates for all of the software that is installed from the repository. As long as you periodically check for updates you'll have the latest updates available from the repository maintainer. If you install software from a location that is not backed by an operating system repository (such as a source repository, or upstream download) then you are responsible for making sure that software stays up to date.
 
Upvote 0 Downvote
M

MOS_6502

Honorable
May 2, 2014
68
0
10,640


The info about UFW has put me on the right track, thank you, but I think that the link to the Archlinux and his security document is true helpful; everything is explained in a reasonable and a helpful manner, so I owe you one.



Thanks for the responses. I've readed all and I understand all of it. I liked the supplementary information that you provided with every response, and with this precise info and the links provided by skittle, I think I have everything I needed to set up his system from zero.

First, I think I will made a sheet with the info and study the necessary steps to set up a relatively secure system based on the info that you two provided me, and after that, I will explain all to him.


Many thanks for all, I would choose both options in Tomshardware, but I think I can only pick one, sorry.

 
Upvote 0 Downvote
P

Pinhedd

Champion
Aug 7, 2007
10,342
20
56,965


Most Linux distributions are incredibly secure by design. There's not much additional work that a user needs to do to secure a system that's not providing outward facing services. The same is true for Windows. A computer is far, far more likely to be compromised as a result of something that a user did than as a result of something that a user didn't do.
Most attack vectors are exploited by goading a user into doing something seemingly innocent that enables the attack to proceed.
On Windows, most malware is packaged with other software, often freeware, and is installed along with it once the user clicks through the ever present UAC. The same vulnerability exists in all operating systems, a user is tricked into running the malicious software and gives it permission to install itself on the computer; there's no way to prevent this, it simply can't be done.
Attack vectors that can somehow work around one of these requirements, such as running without user initiation or obtaining elevated privileges without user permission are much more rare. These typically take advantage of an exploit in existing software that the user is running, such as a web browser (or a browser plugin) or a document viewer. A user may open a malforged image file in a browser that exploits a vulnerability in the platform's image rendering library to execute program code hidden within the image itself, these kinds of vulnerabilities were rife on older versions of Windows.
Attack vectors that can be used with no user interaction whatsoever (such as a vulnerability in an outward facing IP service that is enabled by default) are incredibly rare, incredibly serious, and may be patched automatically before they are even announced.
Damn near 100% of the infected computers, stolen identities, or hacked accounts that I've seen are a result of users not doing due diligence on what they download and install.

Best of luck
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom