Advanced Plus Security LinuxFan58's PC Security Config

Current configurationLinux
Version 41Updated
197 replies
Community rating Not rated yet View setup
Detailed suggestions and alternatives welcomeWhat changed Answers for another system: 2
Staff assessment Advanced Plus Security

harlan4096 ·

What do the levels mean? Assessment history

Device & operating system

, 4 answers
Operating system
Linux
OS version and support details
Linux Mint 22.3 Zena Cinnamon Wayland
Main use of this computer
For work or educational use
Usage and exposure
Visiting familiar websites, Working from home, Making audio/video calls, Opening email attachments, Online shopping and card payments, Logging into my bank account, Downloading software and files from reputable sites, Streaming audio/video content from trusted sites or paid subscriptions, Coding and development

Protection & updates

, 12 answers
Real-time protection
1. Fapolicyd application whitelisting protection (similar to SAC)
2. Build-in Linux sandboxing (AppArmor, Firejail, Flatpak)
3. Opensnitch as outbound application firewall.
Device firewall
Built-in Firewall for Mac/Linux
On-device encryption
Other full-disk drive encryption software
Device sign-in security
Hardware security key, Account password
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
Network firewall
Enabled
Router and network details
TP-Link triband intrusion detection and block infected clients are enabled with Quad9 DNS.
  • The 2.4 Ghz is used for IoT-devices and guest. The 2.4 Ghz has short lease time (8 hours) and on the guest network partitioning is enabled.
  • The two 5 Ghz networks are for my wife and I (each his/her own). The 5Ghz band has eternal lease time with IP-MAC binding enabled.
Custom security settings
On device extra protection
1. Mildly hardened Linux and installed logcheck (e-mail warning) as simple HIDS
2. Sign in with Wayland Cinnamon which enforces UI-isolation between applications.
3. Added additional Firejail profiles with firecfg and reduced Flatpak permissions with flatseal.

Off device extra protection
1. DNS with malware protection
2. Router has also intrusion detection
3. ISP & Google check e-mail on malware
Periodic malware scanners
None
Malware sample testing
I do not participate in malware testing
Environment for malware testing
None

Browsing, accounts & privacy

, 4 answers
Browsers and extensions
Brave-Origin with Brave adShield disabled and safe browsing enabled
Secure DNS
NextDNS free with account as DOH in browser
Desktop VPN
Proton VPN free for Linux on-demand (out of home).
Password and passkey manager
Build-in (OS and Browser)

Backup & recovery

, 2 answers
File and photo backups
1. FreeFileSync quick on-demand backups to a partition on my internal SSD
2. FreeFileSync quarterly full backup saves to an external USB-SSD
System recovery
TimeShift (to another partition on 1 TB SSD)

Apps, specs & notes

, 5 answers
Maintenance tools
None
Subscriptions
Other subscription
Computer specs
AMD Ryzen 7 (5700U) laptop with 1 TB SSD and 16GB RAM
Notable changes
To many :) here are the most important ones:
  • Replaced 7-zip (default) with PeaZip in Flatpak sandbox
  • Replaced OnlyOffice with LibreOffice (both in Flatpak sandbox)
  • Replaced Thunderbird with Evolution (both in Flatpak sandbox)
  • Moved from Xfce desktop with X11 to Cinnamon desktop with Wayland
  • Developed my own extensions for better security (3PM) and privacy (uBD)
  • Installed fapolicyd (simular to WDAC) application whitelisting for standard users
  • Switched from NextDNS to Cloudflare ZT and back after NextDNS improvements
Feedback preference
Detailed suggestions and alternatives welcome

Answers for another system

, 2 answers

These answers were saved for questions that do not apply to the operating system chosen above. They are kept as entered, but they do not describe this device.

User Account Control (UAC) Windows only
Not applicable - not running Windows
Smart App Control Windows only
Not applicable / not available on this device
Community rating

Community rating

How members rate the shared configuration. This is community feedback, not a security test.

Not rated yet
An open invitation for useful feedback.

Sign in to rate this setup

Go to discussion

Shared by the member. This is a configuration record, not a device scan.

One of 211 member setups in the Security Setup Hub. Browse setupsGet yours checked

Older thread fields from Nov 30, 2025 (not current) · expand details
Thread details
Last updated
Sep 14, 2026
Main use of this computer
For work or educational use
Operating system
Linux
OS version and support details
Linux Mint 22.3 Zena Cinnamon Wayland
On-device encryption
Other full-disk drive encryption software
Device sign-in security
    • Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID)
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
User Account Control (UAC)
Not applicable - not running Windows
Smart App Control
Not applicable / not available on this device
Network firewall
Enabled
Router and network details
TP-Link triband with IPv6 disabled, We use the three WIFI-networks seperately. The 2.4 Ghz is used for IoT-devices and guest (SPI-, NAT, ARP-filtering and intrusion detection enabled). The two 5 Ghz networks are for my wife and I (each uses his/her own) with additionally IP-MAC binding and MAC filtering enabled. I have set the e-mail log message level to critical events (acting as a rudimentary NIDS). The 5Ghz network has eternal lease time while 2.4 Ghz has short lease time (8 hours) and network partitioning enabled.
Real-time protection
Non root user using build-in Linux sandboxing (AppArmor, Firejail, Flatpak) as extra protection layer.
Device firewall
Built-in Firewall for Mac/Linux
Custom security settings
  • Using only official package sources from verified publishers and de-installed all unused accessoires and applications.
  • Installed FAPOLICYD denying normal users to execute something which does not come from above repositories
  • Mildly hardened Linux by disabling P2P, remote access, old TLS versions and enabling ASLR system wide.
  • Created additional Firejail profiles with firecfg and reduced Flatpak permissions with flatseal.
  • Added OpenSnitch outbound application firewall to compliment inbound GuFW.
  • Installed logcheck with e-mail warning for security alerts & events
  • Using Wayland (experimental) on Cinnamon desktop.
Periodic malware scanners
When I receive files from others I scan them with Virus Total. My half yearly data backups to external USB are scanned with Microsoft Defender :cool:
Malware sample testing
I do not participate in malware testing
Environment for malware testing
None
Browsers and extensions
Brave-Origin policies and site-pernissions with Brave adShield disabled
Secure DNS
  1. NextDNS in the Router with OISD and telemetry blocklists enabled (for IOT devices), allowing only common TopLevelDomains to connect.
  2. We use Quad9 as default DNS (at OS-level and DoH) for our Laptops and smartphones
  3. Cloudflare Zero Trust Free with account as DOH in the browser.
Desktop VPN
Proton VPN free for Linux on-demand (out of home). At home I have little use for VPN because our IP and IP location are changed regularly :-).
Password and passkey manager
Build-in (OS and Browser)
Maintenance tools
None
File and photo backups
  • FreeFileSync quick on-demand backups to a partition on my internal SSD to which sandboxed utilities, desktop accessoires and applications have no access to.
  • The half yearly full backup saves to an external USB-SSD which is checked (afterwards) by Microsoft Defender on my wife's laptop (which has triple USB protection).
Subscriptions
    • None
System recovery
TimeShift (to another partition on 1 TB SSD)
Usage and exposure
    • Visiting familiar websites
    • Working from home
    • Making audio/video calls
    • Opening email attachments
    • Online shopping and card payments
    • Logging into my bank account
    • Streaming audio/video content from trusted sites or paid subscriptions
    • Coding and development
Computer specs
AMD Ryzen 7 (5700U) laptop with 1 TB SSD and 16GB RAM
Notable changes
To many :)

After jumping back and forth, I finally decided for:
  • Changed from ControlD free to Cloudflare free ZT
  • Replaced 7-zip (unsandboxed) with PeaZip in Flatpak
  • Moved from LibreOffice in Flatpak to LibreOffice in Firejail
  • Moved from Thunderbird to Evolution (both in Flatpak sandbox)
  • Moved from Xfce desktop with X11 to Cinnamon desktop with Wayland
  • Installed fapolicyd (simular to WDAC on Windows) application control (see post)
Feedback preference

Detailed suggestions and alternatives welcome

From the setup owner View current setup
@lokamoka820 and @Miravi

Flatpak 14.6.6 landed which has the vulnabilities fixed according to AI. So went back to Flatpack except for Libre Office. Libre Office in Firejail does not has the large powerpoint problem which makes Libre Office in Flatpak unuseable for me. So went from Libre Office (Flatpak) to Only Office to Collabra Office to Libre Office (Firejail).

I moved to Firejail, because as far as I known Ubuntu favours Snaps in stead of Flatpaks and it was a Flatpak problem. It was usefull for one aspect, discovered how easy it is to create custom firejail profiles.
 
Last edited:
From the setup owner View current setup
Currently only 0.1 behind on Linux plus Flatpak compared to same laptop with Windows 11 + SAC + SRP + Defender
1776417969276.png
 
LinuxFan58 said:
Flatpak 14.6.6 landed which has the vulnabilities fixed according to AI.
Click to expand...
Are you sure your Linux Mint system has the latest version? They haven't fixed the issue yet on Ubuntu. To check, run the following code in your terminal:

Code: 
flatpak --version

Another way to check is to run the following code in your terminal and check the "Version" section:

Code: 
$ apt show flatpak
 
From the setup owner View current setup
I have to check al lot of exams this weeks which is very boring work, so I started playing with my adblock setup again, I have two favorite setups
1. Running Privacy Badge all the time (for compatibility reasons) and Brave's build in on-demand to nuke annoying website.
2. Running Brave only a specific websites (website permissions and shield settings are not cleared at exit) with light adblocking of CloudFlare ZT ads category.

Today I thought of reversing my setup, running Brave with custom rules only and uBOL on demand (with only EP, Peter Low and uBO filters), while I was playing with this setup, ChatGPT told me to have a look at Kees1958 most used (see screen print) to accompany my own custom rules in Brave (and disable all other Brave filter lists).

The medium mode ChatGPT referred to is the that I complete strip the websites I visit a lot (to minimize trackers and ads on bookmarked websites).
The medium mode ChatGPT is talking about is not system wide , but applies only to the few websites I made custom rules for in uBlockOrigin Lite.

1777632303233.png

I followed Chat's advice and added Kees1958 most used EU-US DNR to custom rules, so according to ChatGPT I am now officially a power user :ROFLMAO:
 
Last edited:
From the setup owner View current setup
AI explanation why I replaced Avira Browser Safety (when it moved from German privacy law to US law) with MalwareBytes Browser guard (with adblock off)

1777115425507.png

Avira when under German law had an only 7 day retention for blocked URL's (with IP Geolocation, not IP) and only collected anonymized telemetry totals of blocked URL's (running year stats). Now it is moved to Gen Digital (US Law), the tight German privacy laws are also abandoned. Funny to see when the context changes AI's interpretation also changes. Because Avira dropped in valuation AI increased its valuation for MBAM (increased from good to strong :-) )
 
Last edited:
I’m just reaching out because you changed the feedback.
I had Claude AI analyze your security configuration (it’s very trendy right now), and he suggested several areas that need attention.
Here are the ones I think you should check as soon as possible:
1.png


Let me know if Claude AI was helpful or not.
Thanks for your attention.:)
 
From the setup owner View current setup
Sampei.Nihira said:
I’m just reaching out because you changed the feedback.
I had Claude AI analyze your security configuration (it’s very trendy right now), and he suggested several areas that need attention.
Here are the ones I think you should check as soon as possible:
View attachment 297427


Let me know if Claude AI was helpful or not.
Thanks for your attention.:)
Click to expand...
Thanks my friend I really appreciate your tips (y), I installed USB Guard. Good addition, very helpful (also installed USBGuard notifier).

Claude overlooks that I only install/update from official sources and with Linux it is impossible to install without user consent (as far as I know). So my mild HIDS (logcheck) and NIDS (router) do the job for me, considering everything non-basic OS is sandboxed or double sandboxed (like the browser and e-mail). I asked ChatGPT whether I should add something like AIDE, Tiger, SNORT or Suricata and it said it was not worth the trouble or overhead.

Moving to Fedora (with Sellinux) and Wayland woud be more productive (according to AI), but I will delay that until 2029 (remember @oldschool advice "stay safe, not paranoid" ) :-) practical maximum is enough (not seeking absolute maximum).
 
Last edited:
From the setup owner View current setup
Met a php/backend programmer, who uses Linux himself. He explained that running Chrome with (full sandbox) with a (partly crippled) Firejail is stronger then Chrome solo or Chrome (with crippled sandbox) in Flatpak. So dropped Brave (in Flatpak) for Chrome (in Firejail) and also replaced Cloudflare Zero Trust with ControlD free with OISD large (because of the obvious impact of losing Brave's adblocker),

CUPS (print) runs in AppArmor, all desktop accessoires. Libre Office and Chrome run in Firejail and Teams plus Evolution in (stripped) Flatpak. Evolution uses Bubblewrap to sandbox the HTML renderer and is itself also sandboxed in Flatpak. The programmer uses Fedora.
 
Last edited:
From the setup owner View current setup
Made a 180 :-) (again :unsure:)

Because I switched from Brave in Flatpak (adds a horizontal layer, but breaks Chrome vertical sandboxing) to Chrome in Firejail (keeps Chrome's internal sandbox in tact and adds a less restricted horizontal layer), I switched back from CloudFlare Zero Trust to ControlD free with OISD and using two browser profiles.

Because I discovered the Safe browsing v5 API flag (link) and read about NVT Api Void Browser Protection on MT, so I decided to drop my free URL filtering browsing protection extension and translated some ideas of NVT to extra protection rules in uBol with different TLD rules for work and surfing.

Main differences between work and surfing browsing profiles:
  • Theme
    Work has 'Chrome classic darker blue' and Surfing has 'Simple red' theme for visual feedback which profile I am using.
  • Site permissions
    Work set some permission related to MS Teams to ask (camera, mic, window management, scroll and zoom), Surfing has all on block.
  • uBlock Origin Lite filters
    Work only has custom rules while Surfing profile has EasyList with AG parameter filter and Kees1958 most used (as adviced by ChatGPT).
1777619901274.png
 
Last edited:

Join the discussion

Write your reply below. You'll create a free account or log in before it's posted.

Create account Log in

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top