- Oct 3, 2022
- 557
Ubuntu hardening. Not a script. Just follow along and paste in the commands.
Last edited:
Ubuntu Hardening
- Thread starter Victor M
- Start date
- Jan 6, 2022
- 507
Also don't run as root. Make separate account and give least privilege. My bad if you already mentioned that.
- Oct 3, 2022
- 557
No I didn't. Thanks for bringing that up.
One thing to note, when you create a second account, it doesn't have rights to issue sudo commands until it is granted via visudo or adding her to the admin group. And that's a good thing, as the attacker cannot gain root privileges when he attacks anything that is run by that account.
Last edited:
- Nov 9, 2022
- 534
Switch to Ubuntu Pro, free for 5 home devices.
ubuntu.com
Ubuntu Pro | Ubuntu
Canonical provides Ubuntu Pro with 10 years of enhanced CVE patching, FIPS compliance, CIS and DISA-STIG profiles and enterprise-grade open source software security with a single subscription for open source supply chain provenance.
ubuntu.com
Spiff
Level 1
- Jul 20, 2023
- 32
What is the source that says Ubuntu Livepatch provides live patches prior to updates becoming available?
To my knowledge, Ubuntu Pro offers Expanded Security Maintenance (ESM), and Live kernel updates, the Livepatch service. Livepatch patches critical and high-severity kernel vulnerabilities while the system runs, eliminating the need for unplanned reboots.
I don't have any source that says Livepatch provides live patches prior to updates becoming available.
https://ubuntu.com/pro
https://ubuntu.com/security/livepatch
Also, to my knowledge, the command to attach your Ubuntu LTS machine to an Ubuntu Pro subscription is not: sudo pro attach, but it is:
sudo pro attach [YOUR_TOKEN]
in which [YOUR_TOKEN] must be replaced with the token that is in your Ubuntu Pro dashboard.
https://ubuntu.com/pro/tutorial
- Oct 3, 2022
- 557
That is only my guess. I should have checked before posting. My bad. I guess the benefit of LivePatch is that you maintain up-time and can patch before your regular scheduled patching. Thanks for the explanation.
Doing it without the token, it displays the token to you in the terminal. And it gives you a link. You navigate to the link using your browser, copy the token displayed, and paste it into the field in that web form. Then it replies that you have subscribed. I've always done it that way.
Last edited:
Spiff
Level 1
- Jul 20, 2023
- 32
Ah, I understand. No problem at all.
Hey, that's handy. I didn't know that. Thanks for the information.
- Oct 3, 2022
- 557
If you don't have Ethernet on your laptop, you can always buy a USB Giga Ethernet adapter.
- Oct 3, 2022
- 557
To verify that firejail is working, run "firejail --list" while Firefox is running.
lokamoka820
Level 20
- Mar 1, 2024
- 970
Nice setup, I hope more Linux topics will be added to the forum.
SeaKelp
New Member
- Jun 6, 2024
- 8
- Oct 3, 2022
- 557
There is a typo in the line:
sudo nano /etc/firefox-common.profile
It should be:
sudo nano /etc/firejail/firefox-common.profile
sudo nano /etc/firefox-common.profile
It should be:
sudo nano /etc/firejail/firefox-common.profile
- Apr 16, 2017
- 2,469
I'm rusty with my Linux skills (to the extent I had any), running Zorin (a fork of Ubuntu IIRC) I installed Brave browser from Zorin's software package but it doesn't automagically add Brave to firejail profile. Is there a link that explains how to use firejail, set config / profiles etc...
lokamoka820
Level 20
- Mar 1, 2024
- 970
- Apr 16, 2017
- 2,469
- Oct 3, 2022
- 557
Actually, you run Firejail and indirectly call Brave. As in "firejail brave" . You can try it at the terminal.
All the icons are at /usr/share/applications/ in desktop files. And there would be something like 'brave.desktop' These .desktop files are text files. So you open it with nano. Then you find the line(s) inside which says "Exec=brave". And change them to "Exec=firejail brave".
A firejail profile is the compartmentalization settings for a particular program. Brave has a profile already made. All the firejail profiles are in /etc/firejail/ .
Last edited:
- Apr 16, 2017
- 2,469
well, I think that's how it is supposed to work BUT I did run firejail brave in terminal and it did not happen. Unfortunately I did not keep a copy of the exact error message and I'm not running Linux today. Will update next time I run Zorin.
lokamoka820
Level 20
- Mar 1, 2024
- 970
There are too many reasons, but in short, Flatpak is faster in startup time, have more packages, open source, doesn't get updates automatically, comes with sandboxing enabled by default, respect user themes, in general Flatpak is better for home users, while Snap is better for servers.
- Apr 5, 2021
- 619
Hi @simmerskool ,
I haven't used Firejail in a long time, nor have I ever used it to sandbox Brave, but the built-in sandboxing of Brave running on Linux is quite strong. Try entering in the address bar: brave://sandbox and see what it outputs. the attached shows the sandboxing types, the strongest of which is the seccomp-BPF. If you can't get Brave firejailed successfully, you still have a strong sandbox running it on Linux.
I haven't used Firejail in a long time, nor have I ever used it to sandbox Brave, but the built-in sandboxing of Brave running on Linux is quite strong. Try entering in the address bar: brave://sandbox and see what it outputs. the attached shows the sandboxing types, the strongest of which is the seccomp-BPF. If you can't get Brave firejailed successfully, you still have a strong sandbox running it on Linux.
- Oct 3, 2022
- 557
Here is the updated full version of Ubuntu Hardening. Includes protection + detection + remediation.
Last edited:
Similar threads
