Advanced Plus Security LinuxFan58's PC Security Config

PC Setup Configuration Help & Showcase
187 Replies 41,840 Views
Original forum configuration · expand details
Last updated
Sep 14, 2026
Main use of this computer
For work or educational use
Operating system
Linux
OS version and support details
Linux Mint 22.3 Zena Cinnamon Wayland
On-device encryption
Other full-disk drive encryption software
Device sign-in security
    • Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID)
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
User Account Control (UAC)
Not applicable - not running Windows
Smart App Control
Not applicable / not available on this device
Network firewall
Enabled
Router and network details
TP-Link triband with IPv6 disabled, We use the three WIFI-networks seperately. The 2.4 Ghz is used for IoT-devices and guest (SPI-, NAT, ARP-filtering and intrusion detection enabled). The two 5 Ghz networks are for my wife and I (each uses his/her own) with additionally IP-MAC binding and MAC filtering enabled. I have set the e-mail log message level to critical events (acting as a rudimentary NIDS). The 5Ghz network has eternal lease time while 2.4 Ghz has short lease time (8 hours) and network partitioning enabled.
Real-time protection
Non root user using build-in Linux sandboxing (AppArmor, Firejail, Flatpak) as extra protection layer.
Device firewall
Built-in Firewall for Mac/Linux
Custom security settings
  • Using only official package sources from verified publishers and de-installed all unused accessoires and applications.
  • Installed FAPOLICYD denying normal users to execute something which does not come from above repositories
  • Mildly hardened Linux by disabling P2P, remote access, old TLS versions and enabling ASLR system wide.
  • Created additional Firejail profiles with firecfg and reduced Flatpak permissions with flatseal.
  • Added OpenSnitch outbound application firewall to compliment inbound GuFW.
  • Installed logcheck with e-mail warning for security alerts & events
  • Using Wayland (experimental) on Cinnamon desktop.
Periodic malware scanners
When I receive files from others I scan them with Virus Total. My half yearly data backups to external USB are scanned with Microsoft Defender :cool:
Malware sample testing
I do not participate in malware testing
Environment for malware testing
None
Browsers and extensions
Brave-Origin policies and site-pernissions with Brave adShield disabled
Secure DNS
  1. NextDNS in the Router with OISD and telemetry blocklists enabled (for IOT devices), allowing only common TopLevelDomains to connect.
  2. We use Quad9 as default DNS (at OS-level and DoH) for our Laptops and smartphones
  3. Cloudflare Zero Trust Free with account as DOH in the browser.
Desktop VPN
Proton VPN free for Linux on-demand (out of home). At home I have little use for VPN because our IP and IP location are changed regularly :-).
Password and passkey manager
Build-in (OS and Browser)
Maintenance tools
None
File and photo backups
  • FreeFileSync quick on-demand backups to a partition on my internal SSD to which sandboxed utilities, desktop accessoires and applications have no access to.
  • The half yearly full backup saves to an external USB-SSD which is checked (afterwards) by Microsoft Defender on my wife's laptop (which has triple USB protection).
Subscriptions
    • None
System recovery
TimeShift (to another partition on 1 TB SSD)
Usage and exposure
    • Visiting familiar websites
    • Working from home
    • Making audio/video calls
    • Opening email attachments
    • Online shopping and card payments
    • Logging into my bank account
    • Streaming audio/video content from trusted sites or paid subscriptions
    • Coding and development
Computer specs
AMD Ryzen 7 (5700U) laptop with 1 TB SSD and 16GB RAM
Notable changes
To many :)

After jumping back and forth, I finally decided for:
  • Changed from ControlD free to Cloudflare free ZT
  • Replaced 7-zip (unsandboxed) with PeaZip in Flatpak
  • Moved from LibreOffice in Flatpak to LibreOffice in Firejail
  • Moved from Thunderbird to Evolution (both in Flatpak sandbox)
  • Moved from Xfce desktop with X11 to Cinnamon desktop with Wayland
  • Installed fapolicyd (simular to WDAC on Windows) application control (see post)
Feedback preference

Detailed suggestions and alternatives welcome

Add an exe rule to your rules.
If that doesn't work, none of the others will provide the protection you need.

Out of curiosity, if you press the button,

"proceed anyway"

on the AG block page (now), does it work?
 
Sampei.Nihira said:
Add an exe rule to your rules.
If that doesn't work, none of the others will provide the protection you need.

Out of curiosity, if you press the button,

"proceed anyway"

on the AG block page (now), does it work?
Click to expand...
I checked the AG rules work, either it is silently blocked (third-party) or throw a AG block page (first-party), I tested with abuse.ch entries
 
Sampei.Nihira said:
One last thing, otherwise I'll be rocking the boat too much, but I don't think your rules for blocking downloads from GitHub (etc.) are correct for blocking malicious executable downloads.
URLhaus | Checking your browser
Click to expand...
This first sample URL is already blocked by the uBlock Origin filter "Online Malicious URL Blocklist" If you proceed with uBO, it is immediately blocked by McAfee WebAdvisor and Kaspersky, as you can see in the second screenshot below. :)
1768517666369.png
1768517862217.png
Sampei.Nihira said:
URLhaus | Checking your browser
Click to expand...
This second sample URL was even more incredible. The block was performed again by the uBlock "Online Malicious URL Blocklist" filter list, and then by uBlock, followed by a block by McAfee WebAdvisor. Although McAfee WebAdvisor blocked it, it failed and did not prevent me from downloading the malware sample. Even so, when I clicked to save it, Norton Safe rose from the ashes and sprang into action, preventing me from downloading the sample, as you can see in the third screenshot below this post. (y)This was the first time I saw Norton Safe spring into action, and I was surprised that it prevented me from downloading the zip file. ;)
1768518105540.png
1768519115085.png
1768519273050.png
 
LinuxFan58 said:
From version 1.86 Brave browser allows you to disable the default blocklists (when you enable brave://flags/#brave-adblock-show-hidden-components) .
Finalized tweaking extensions and filter usage for best compatibility and performance (work profile with 19.1 score on Speedometer 3.1) and best blocking and security (surfing profile with 18.5 score on Speedometer 3.1). I disabled Brave's tracking filter (replaced it with Peter Low's) and first-party filter (replaced it with Custom rules).

View attachment 294726

Finally achieved same speedometer 3.1 benchmarks in Linux with Brave in Flatpak sandbox as my wife (on same HP laptop) on Windows 11 running standard user with Chrome and only Avira Safe Browsing extension (with its conservative anti-tracking) enabled.

:D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y) :D:cool:(y)
Click to expand...

Peter Lowe's Ad and tracking server list is excellent (same total rules) for use at the DNS level.
If you still have OISD and change your choice with HaGeZi, Peter Lowe's list is in the sources used.
 
@Sampei.Nihira

I prefer to block malware at DNS level and advertising and tracking in the browser. By replacing Brave's build-in anti-tracking filter with Peter Low's and Brave's build-in first party filter with custom cosmetic rules (in Brave), the rule count should have been reduced to a 1/3 (and Speedometer benchmark upped from 18.1 to 18.7). (y)

I am fine as it is now and start applying the "don't fix what ain't broken rule" ;)
 
Last edited:
LinuxFan58 said:
Yes, you are right (tried to cheat against the "don't fix what ain't broken" rule by editing the posts, which you as elite investigator noticed immediately :-) (y) )

Switched back to AdGuard again, because it is easier to trouble shoot (using log) and has a blockpage (triggered by $document for first-party)
View attachment 294751
View attachment 294752

I also split the $all rule for hosting services known to host malware phishing (like GoDaddy, Weebly, Hostinger and NameCheap). Bij splitting the $all rule in document and third-party, any website blocked has a fair chance of functioning after choosing 'Proceed anyway' button.

I still use $all for blocking file sharing services often hosting malware (e.g. anonfiles, discord.com/attachments, file.io. gofile.io, hastebin, ix.io, pastebin.com, pixeldrain. tmpfiles.org, ufile.io, uploadfiles.io, volafile.org, zippyshare) and Linux executable and script formats hosted on popular coding platforms (like bitbucket, github, githubusercontent, gitlab and sourceforge).

Latest 10 https links on phishtank: AG blocked 7, Cloudflare ZT 2, Google safe browsing 1

View attachment 294753
Click to expand...

I had opened a problem in October 2025, but......:rolleyes::rolleyes::rolleyes::rolleyes:

[investigate] $document block rules malfunction · Issue #3338 · AdguardTeam/AdguardBrowserExtension
 
@LinuxFan58

After lunch is better...:ROFLMAO:

Let's analyze your fourth rule, which I also use (with only 9 TLDs).
Block 3p + 3p scripts + 3p frames (Hard Mode effect) + list of allowed TLDs.

The third rule blocks all websites outside the list.
I prefer to block 1p scripts from all websites outside the TLD list.

Because, in my opinion, my choice is more consistent.
Let's take a website outside your TLD list, for example, Chilean (.cl).

In my case, a Chilean website finds Hard Mode + 1p script block, probably usable, depending on the websites, but with very strong protection.

In your case, the third rule that completely blocks the Chilean website renders the fourth rule useless, as it will never apply Hard Mode outside the TLD list.

Think about it.;)

The Clinic | Reportajes, columnas, entrevistas, humor, memes y más.


1.png
 
Last edited:
Last edited:
As you can see, your image is identical to mine, but I also have the 1p script block.

So total protection against XSS clients.
Total protection against JS fingerprinting.
First-party tracker blocking...

Ask the AI this simple question:

"Does blocking only 3p + 3p scripts + 3p frames eliminate all possible privacy/security issues?"

Of course, I occasionally have to write a 1p script exception rule.
But with only 9 TLDs, there are only 5 exception rules so far.
It's not a big deal for me.

Have a good evening.
 
After six days od no False Positive (AdGuard TLD firewall breaking websites), I replaced AG by uBol (is a tad faster in Speedometer 3.1 than AG, 18.8 in stead of 18.7)

EDIT and yes the 8th day I encounter a TLD block again, so reverted back to AdGuard (using the log function I see what is blocked) :ROFLMAO:

In the past I had two classic bikes and could spend saturdays fiddling with carburetors, needles, yets and pre-ignition to optimize the engine. I recognize the same tweaking frenzy with uBol and AG in my two Brave profiles. :)
 
Last edited:
Added policy specific explanation to personalized Cloudflare block page.

1785182007238.png

Rule 8 (partly), 9 are only effective when the bad-guys don't use a Content Delivery Network with server hubs in the whitelisted resolved IP geo locations. According to latest data nearly 80% of the "advanced" attacks from well known adversaries use trusted services (bypassing these rules). Reversely 80% of the unsophisticated attacks are delivered locally (that is why these rules often trigger block screens when playing with URLhaus links).
 
Last edited:
Back to 1 profile in Brave again :ROFLMAO: added Advertisements content category in Cloudflare Zero Trust with uBlockOriginLight in basic mode with all filters disabled and only (at the moment) 35 Custom cosmetic rules and 35 DNR rules. I occasionally enable Brave Adshields for a website (which Brave forgets when closing the browser).

uBol has a problem that when disabling protection somtimes DNR rules are still applied through Chromium mechanisms (the rules which are only updated when the extension is updated). I discovered that this is not the case when using custom DNR rules because these are implemented as dynamic rules (of Chromium is something totally different than Mv2 uBO's dynamic filtering).

So I copied the Kees1958 EU + US most used (around 1700 ABP-rules) into Custom DNR and they converted to ONLY 1 DNR rule (y)
 
Last edited:
LinuxFan58 said:
Back to 1 profile in Brave again :ROFLMAO: added Advertisements content category in Cloudflare Zero Trust with uBlockOriginLight in basic mode with all filters disabled and only (at the moment) 35 Custom cosmetic rules and 35 DNR rules. I occasionally enable Brave Adshields for a website (which Brave forgets when closing the browser).

uBol has a problem that when disabling protection somtimes DNR rules are still applied through Chromium mechanisms (the rules which are only updated when the extension is updated). I discovered that this is not the case when using custom DNR rules because these are implemented as dynamic rules (of Chromium is something totally different than Mv2 uBO's dynamic filtering).

So I copied the Kees1958 EU + US most used (around 1700 ABP-rules) into Custom DNR and they converted to ONLY 1 DNR rule (y)
Click to expand...

Even when selected:

"Automatically reload the page when you change the filter mode".:unsure:

__________________________________________________________________________________

Can you explain the filtering method better within/outside TLDs?
 
Sampei.Nihira said:
Even when selected:

1 "Automatically reload the page when you change the filter mode".:unsure:

__________________________________________________________________________________

2 Can you explain the filtering method better within/outside TLDs?
Click to expand...

1. Yes, but it seems to happen in basic mode mostly (then uBol has no running processes of itself, only uses Chromium)

2. Not using TLD filtering at the moment (because I went back to 1 profile for all).
 
uBol used to get my the highest Speedometer 3.1 benchmarks, but after latest update it fell back to 18.5 to 18.6. So I tried Adguard again and Brave Shields. When I disable CSP and Procedural filtering in Brave://flags for Brave shields and I enable only Brave AdShield (with Kees1958 and my custom rules), I am getting the highest speedometer 3.1 benchmarks (18.9 to 19.1).

I know it is useless tweaking, but when I have to wait for some jobs to finish in the evening every fortnight, I either play a game of chess or kill the time with some benchmarks every fortnight when there is nothing interesting to read on MT and my bookmarked news websites.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Continue exploring the conversation.

Back
Top