Advanced Security Linux Mint Cinnamon Wayland setup

Last updated
Jun 1, 2026
How it's used?
For work or educational use
Operating system
Linux
Other operating system
Linux Mint 22.3 Zena Cinnamon Wayland
On-device encryption
Other full-disk drive encryption software
Log-in security
    • Biometrics (Windows Hello PIN, TouchID, Face, Iris, Fingerprint)
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
User Access Control
N/A - Linux / Mac / Other operating system
Smart App Control
N/A - Linux / Mac / Other operating system
Network firewall
Enabled
About WiFi router
TP-Link triband with IPv6 disabled and all security features enabled (TP-link home care, SPI-firewall, IP-MAC binding). E-mail log message level is set to critical.
Real-time security
Sticking to trusted package sources and using Linux sandboxing (AppArmor, Firejail, Flatpak) to contain utilities, accessoires and applications.
Firewall security
Built-in Firewall for Mac/Linux
About custom security
  • Using only official package sources from verified publishers and de-installed all unused accessoires and applications.
  • Mildly hardened Linux by disabling P2P, remote access, old TLS versions and enabling ASLR system wide.
  • Created additional Firejail profiles with firecfg and reduced Flatpak permissions with flatseal.
  • Added OpenSnitch outbound application firewall to compliment inbound GuFW.
  • Installed logcheck with e-mail warning for security alerts & events
  • Using Wayland (experimental) on Cinnamon desktop.
  • Enhanced browser security with flags.
Periodic malware scanners
When I receive files from others I scan them with Virus Total. My half yearly data backups to external USB are scanned with Microsoft Defender :cool:
Malware sample testing
I do not participate in malware testing
Environment for malware testing
None
Browser(s) and extensions
Brave with two profiles, one for surfing and one for work. Privacy wise I have Brave shieds disabled in my work and enabled in my surfing profile (only Ads, Kees1958 and custom rules). Security wise my surfing profile has most site permissions on block and Bitdefender Traffic Light while my work profile has website permission on default with NVT Browser lockdown limiting website access to a few trusted domains and file download to usual office documents.
Secure DNS
  1. NextDNS in the Router with OISD and telemetry blocklists enabled (for IOT devices), allowing only common TopLevelDomains to connect.
  2. We use Quad9 as default DNS (at OS-level) for our Laptops and smartphones (to bypas router TLD firewall restrictions)
  3. Cloudflare Zero Trust Free plan (with malware protection) is used as DNS over HTTPS in the browser.
Desktop VPN
Proton VPN free for Linux on-demand (out of home). At home I have little use for VPN because our IP and IP location are changed regularly :-).
Password manager
Build-in (OS and Browser)
Maintenance tools
None
File and Photo backup
  • FreeFileSync quick on-demand backups to a partition on my internal SSD to which sandboxed utilities, desktop accessoires and applications have no access to.
  • The half yearly full backup saves to an external USB-SSD which is checked (afterwards) by Microsoft Defender on my wife's laptop (which has triple USB protection).
Subscriptions
    • None
System recovery
TimeShift (to another partition on 1 TB SSD)
Risk factors
    • Browsing to popular websites
    • Working from home
    • Making audio/video calls
    • Opening email attachments
    • Buying from online stores, entering banks card details
    • Logging into my bank account
    • Streaming audio/video content from trusted sites or paid subscriptions
Computer specs
AMD Ryzen 7 (5700U) laptop with 1 TB SSD and 16GB RAM
Notable changes
To many :)

After jumping back and forth, I finally decided for:
  • Changed from ControlD free to Cloudflare free ZT
  • Replaced 7-zip (unsandboxed) with PeaZip in Flatpak
  • Moved from LibreOffice in Flatpak to LibreOffice in Firejail
  • Moved from Thunderbird to Evolution (both in Flatpak sandbox)
  • Moved from Xfce desktop with X11 to Cinnamon desktop with Wayland
What I'm looking for?

Looking for maximum feedback.

@LinuxFan58

Hi, good afternoon.

The AdGuard Browser Extension only uses custom rules that update independently of the extension's filters.

Can you explain, in simple terms, why you need AG when you're using Brave's built-in ad blocker?

For example, I'm not sure if the websites in your bookmarks are handled only by AG, or by both AG and Brave's ad blocker.:unsure:
 
  • Like
Reactions: piquiteco and lokamoka820
@Sampei.Nihira

When I am using 2 profiles, I only use Brave Shields. In my work profile I disable Brave Shields and enable the shields per website. In my surfing profile I run with Brave Shields on aggressive.

When I am using 1 profile (as now), I run Brave with Adshields disabled and run either AdGuard or uBlockorigin lite with custom rules which are all website specific (that is why I have some overlap in rules with AdGuard and in AdGuard my total custom rules are around 175 and with uBol are around 95 custom rules). It does not matter whether AG or uBol run all the time, because they rules are website specific. In AdGuard it is possible to reverse the allow list (meaning AG is only active on the websites listed in the allowlist) and with uBol it is possible to move the all-urls to no-filtering and enable basic mode only on a few bookmarked websites.

Brave is set to forget history, so when I encounter a annoying website during surfing I enable aggressive mode. In this way Brave is also only used ad-hoc (for specific websites). So with 1 profile either Brave AdShield is enabled (ad-hoc or annoying websites encountered during surfing) or Ad/uBol for bookmarked websites.

Hopes this explains it.
 
  • Like
  • Thanks
Reactions: piquiteco, Sampei.Nihira and lokamoka820
Okay thanks to @NoVirusThanks I switched back to two browser profiles. 🫣🫣

Reason is that I discovered one of his other extensions API Void Browser Lockdown. So I added API Void Browser Lockdown to my work profile and limited acces to a few domains and allowed only a few file types to download. In my surfing profile I have Brave Shields enabled, but all blocklists disabled.
 
Last edited:
  • Like
Reactions: piquiteco, NoVirusThanks and lokamoka820
@LinuxFan58

Hi,
I have a question.
When comparing Brave + Shield vs Brave + uBoL vs Brave + AG in a hypothetical Speedometer 3.1 benchmark, which one is the fastest and which is the slowest?
Or is there practically no difference?

If I replace uBo with AG in the Speedometer 3.1 test, I’m about 6–7% slower.
A (theoretical) analysis with ChatGPT reveals that replacing Chrome with Brave would slow me down by about 3–4%.
So using Brave + uBo could at most gain me 3%, which the AI estimates is negligible in terms of perceived speed.

Do you agree with this theoretical analysis, or,having conducted various tests and also used Chrome, and thus having practical experience that shouldn’t be underestimated,do you assume it’s incorrect?

Have a nice day.

P.S.

It's almost 32°C in the shade here in my city.
I'm about 12 km from the Tyrrhenian Sea.;)
 
@Sampei.Nihira

Fastest is Brave Shields disabled (enabling only ad-hoc for annoying websites) plus uBlockOrigin Lite on basic with only custom cosmetic rules and custom DNR rules and Kees1958 most used (which is only 1 rule in uBol :-) ). It is used to be 0,3 to 0.4 difference (so on 19 average that is only 1 to 2 %), but since a week or three the difference between Brave + AdGuard is nothing to 0.1 (so practically no difference). Brave in standard mode used to be 0.2 slower than AG (also only custom rules plus Kees1958 Mv3) , but Brave standard is now nearly as fast as uBol or AG, that is nice (may be I am sticking to the same setup now, because there is nothing to gain anymore).

It is 33°C here now, just over 1700 km from the Tyrrhenian Sea.;)
 
  • Thanks
Reactions: Sampei.Nihira
First of June, start of the meteorological summer and having many things to do (around the house for maintenance, developing two study courses), it is time to do setup summer freeze (no changes until September first). My wife already printed a calendar with weeks to show how much time I have left before holiday trip to Poland (with my self converted van) and classes start again. In last year's winter break, I completed only half of the renovation of our back yard and in spring break I renewed our solar panels (in stead of finishing the back yard), so I am in risky waters :-) happy wife is a happy life,
 
Last edited:
  • Like
  • Applause
  • Hundred Points
Reactions: lokamoka820, Captain Awesome, Sampei.Nihira and 1 other person

You may also like...