Advice Request Help with installing Linux

[Antimalware18]

what is this program exactly?

Currently im setting up the machine and transferring all personal documents over. I wish gaming on linux was where multiplayer games with anticheats could run
id happily switch every PC in the house.

Also i picked ubuntu because i knew as the most popular that if one had the chance to install perfectly the first time it would have most likely been that distro
Ive used Ubuntu, Kubuntu and Linux Mint MATE, I was considering a switch to Manjaro when my friend approached me about building a gaming PC for me since he wanted me to game with him. and that brought me back into the windows ecosystem about 5 years ago. On my personal laptop at the time was where i had Linux and was using it as my daily driver my wife didnt like the idea of me switching the Family PC over lol

 

[Victor M]

what is this program exactly?

It is a security suite designed to be resilient against attacks. It is defense in depth, assuming that you would get malware & attackers and that your clamav (not really good signature based AV ) would fail you. Resilience is key; it stops attackers from gaining a foothold, communicate with their command and control servers and gaining root. The important thing is that attacker would not reach his goal. Good defense is not relying on just your AV and patching, but having layers of defenses that would step in one after another to stop an attack. As the current security thought goes: assume compromise, and work from there.

In simple words, your AV has no behavioral blocking and you use Ubuntu therefore your patches goes thru slow testing. Hackers have more up to date arsenal than you. What do you do?

 

[LinuxFan58]

My security on linux:
1. Use TimeShift for image backups
2. Use FreeFileSync for data backups
3. Enable additional firejail profiles for desktop assecoires
4. Install flatseal to strip permissions of flatpaks (and use as mutch flatpak as possible)
5. Install OpenSnitch outbound application firewalk on top of inbound GuFW inbound
6. Install FaPolicyD for application whitelisting for normal user only
7. Use Brave Origin with 3P Matrix conten firewall startup level 3

 

[Acadia]

Good grief! I also use Linux Ubuntu and all I have running is the already installed AppArmor. Of course, this is all inside of a virtual machine so when I am done surfing for that session, everything gets wiped out and next time I surf, I start over again with a pristine snapshot. Does anyone one feel that surfing this way, I need to install other security programs? Don't even ask what security programs I have on my real Win11 system, got a ton of them.
Thanks, Acadia

 

[Victor M]

Don't even ask what security programs I have on my real Win11 system, got a ton of them.

So you would agree that if Ubuntu were your 'real' system, you would need more security ?

 

[Acadia]

So you would agree that if Ubuntu were your 'real' system, you would need more security ?

Yes, I would. Just wondering because after each "surfing session" everything gets wiped out and I start out "pristine" again. I never do any banking or finances inside Ubuntu, just reading.
Thanks, Acadia

 

[Jonny Quest]

@Victor M and @LinuxFan58 for a common user, how is malware going to get through? Are apps installed from within Software Manager prone to malicious updates? I installed IVPN from their website, as well as Bitwarden from theirs.

I'll do the "I haven't had malware on a Windows PC since XP, just PUP's" thing, only using 1 AV (different AV vendors at times) and good browsing habits. I have the UFW Firewall up and running, do the TimeShift backups, and use Google Drive. I use NextDNS, uBlock Origin (Firefox with Containers), TraffficLight (may be redundant?), Bitwarden, and IVPN. I just install my minimum apps I need and use, which is what I did with Windows. Isn't the greater threat online at the browser level, and ID Theft? And I know better than a TerminalFix (ClickFix) command.

I'm not saying I'm bulletproof being in the Linux environment, but what am I missing? TIA Apologies @Antimalware18 not trying to derail your thread, but security was mentioned a couple of times

Edit: and is it okay to allow these auto update settings, as it does notify of the "bigger" or critical updates to install?

 

[Victor M]

@Jonny Quest , malware is not coming via your downloads, since you have good security habits. It is going to come via DriveByDownloads exploiting your browser, or phishing, or rarely, a friend's usb stick or a hacker.

I don't recognize your update manager, which distro is it ? I only know Ubuntu, Kubuntu, Fedora and Fedora Cosmic

 

[Jonny Quest]

@Jonny Quest , malware is not coming via your downloads, since you have good security habits. It is going to come via DriveByDownloads exploiting your browser, or phishing, or rarely, a friend's usb stick or a hacker.

I don't recognize your update manager, which distro is it ?

Mint Cinnamon. Thank you for your reply, as that's kinda what I was thinking as far as some of my previous back and forth AI questions.

 

[ghostkernel]

@Jonny Quest

One can not simply ignore supply chain compromises, fake download mirrors and domains. So it's good to remain cautious and always check. As for drive by's, on a fully patched and updated Linux browser, execution is extremely rare without a zero day exploit chain. Phishing and social engineering are far more common.

 

[LinuxFan58]

@Jonny Quest I am running Mint 22.3 Cinnamon Wayland

Linux is pretty safe when you stick to official repo's only. With good security hygiene steps 1 to 2 are enough.
That said some extra's are easy tweaks which offer a second (flatpak/firejail), third (fapolicyd) and fourth layer (opensnitch) with no usage hassle or performance loss.

3. Install additional firejail profiles for desktop assecoires (set and forget)
It is only 1 command and all desktop assecoire profiles are solid and tested = set and forget

4. Install Flatseal and use flatpaks (set and forget)
Again easy and for good security hygiene you have to understand the settings Flatseal offers. Most official flatpak's come which way to rich permissions.
To make the flatpak sandbox really useful you can strip a lot of permissions with most applications. Using flatpak has onother IOM big advantage.
With flatpak you use the latests versions, while on LTS you are bound to te supported versions.

5. Install OpeSnitch outbound
That is the only one requiring some "learning" period. It is optional IMO, but I always liked to have an outbound firewall.
After a 2 to 3 weeks OpenSnitch will show no more popups.

6. Install FaPolicyD (set and forget)
Ask AI to only apply it on standard users and only for execution plus add an update sweep after installing stuff. It only allows sh and txt, but by assigning editor to it and disabling the run-execute-popup you close this hole also for users to execute a bash script. FaPolicyD is like SAC it only allows to execute stuff coming from official repo's (the repo's you added to whitelist).

7. Brave Origin
It is free on Linux and it is the fastest browser on Linux by far (30% faster than UnGoogled and 50% faster than Firefox on my laptop). Because I am the developer of 3P Matrix - content firewall, I suggested to use this swiss security knife at startup level 3 and enable all protections. Lock some risky websites at level 4. Move the slider to 1 for important websites and lock it at level 1 (allow all). And you reduce the attack surface on the interne by probably 60-80% (depending on your TLD whitelist) without web breakage.

 

[7Oz-64]

@LinuxFan58
No competiton here
Hey, i assume you've installed UG via flatpak, on my side NONE-flatpak Ungoogled Chromium is faster than Brave-origin.

@Antimalware18
Good advice for your installation have been posted, goodluck, personal preference for pure Debian distro, but Ubuntu-based are ok.