Setup Idea Ubuntu Hardening

PC Setup Ideas
67 Replies 22,756 Views
Thread details
Last updated
Aug 23, 2024
Main use of this computer
For home and private use
Operating system
Linux
On-device encryption
Other full-disk drive encryption software
Device sign-in security
    • Account password
Security updates
Allow security updates
Update channels
Allow stable updates only
User Account Control (UAC)
Not applicable - not running Windows
Smart App Control
Not applicable / not available on this device
Network firewall
Enabled
Real-time protection
clamav (linux free AV)
Device firewall
Built-in Firewall for Mac/Linux
Custom security settings
this is what the article is about
Periodic malware scanners
clamav
Malware sample testing
I do not participate in malware testing
Environment for malware testing
n/a
Browsers and extensions
firefox
Secure DNS
quad9
Desktop VPN
proton vpn free
Password and passkey manager
firefox built-in password manager
File and photo backups
deja-dup (built-in backup app)
System recovery
clonzilla
Usage and exposure
    • Visiting familiar websites
Computer specs
ASUS Vivobook 2021 model
Recommended for
  1. All types of users
Sandbox Breaker said:
if you already mentioned that.
Click to expand...
No I didn't. Thanks for bringing that up.

One thing to note, when you create a second account, it doesn't have rights to issue sudo commands until it is granted via visudo or adding her to the admin group. And that's a good thing, as the attacker cannot gain root privileges when he attacks anything that is run by that account.
 
Last edited:
Victor M said:
Ubuntu hardening. Not a script. Just follow along and paste in the commands.

[...]
### Enable Ubuntu One LivePatch, which provides live patches prior to updates becoming available
sudo pro attach
Click to expand...
What is the source that says Ubuntu Livepatch provides live patches prior to updates becoming available?
To my knowledge, Ubuntu Pro offers Expanded Security Maintenance (ESM), and Live kernel updates, the Livepatch service. Livepatch patches critical and high-severity kernel vulnerabilities while the system runs, eliminating the need for unplanned reboots.
I don't have any source that says Livepatch provides live patches prior to updates becoming available.
https://ubuntu.com/pro
https://ubuntu.com/security/livepatch

Also, to my knowledge, the command to attach your Ubuntu LTS machine to an Ubuntu Pro subscription is not: sudo pro attach, but it is:
sudo pro attach [YOUR_TOKEN]
in which [YOUR_TOKEN] must be replaced with the token that is in your Ubuntu Pro dashboard.
https://ubuntu.com/pro/tutorial
 
Spiff said:
I don't have any source that says Livepatch provides live patches prior to updates becoming available
Click to expand...
That is only my guess. I should have checked before posting. My bad. I guess the benefit of LivePatch is that you maintain up-time and can patch before your regular scheduled patching. Thanks for the explanation.
Spiff said:
sudo pro attach [YOUR_TOKEN]
Click to expand...
Doing it without the token, it displays the token to you in the terminal. And it gives you a link. You navigate to the link using your browser, copy the token displayed, and paste it into the field in that web form. Then it replies that you have subscribed. I've always done it that way.
 
Last edited:
Victor M said:
That is only my guess. I should have checked before posting. My bad. Thanks for the explanation.
Click to expand...
Ah, I understand. No problem at all.

Victor M said:
Doing it without the token, it displays the token to you in the terminal. And it gives you a link. You navigate to the link using your browser, copy the token displayed token from terminal, and paste it into the field in that web form. I've always done it that way.
Click to expand...
Hey, that's handy. I didn't know that. Thanks for the information.
 
Victor M said:
There is a typo in the line:
sudo nano /etc/firefox-common.profile

It should be:
sudo nano /etc/firejail/firefox-common.profile
Click to expand...
I'm rusty with my Linux skills (to the extent I had any), running Zorin (a fork of Ubuntu IIRC) I installed Brave browser from Zorin's software package but it doesn't automagically add Brave to firejail profile. Is there a link that explains how to use firejail, set config / profiles etc...
 
simmerskool said:
but it doesn't automagically add Brave to firejail profile
Click to expand...
Actually, you run Firejail and indirectly call Brave. As in "firejail brave" . You can try it at the terminal.

All the icons are at /usr/share/applications/ in desktop files. And there would be something like 'brave.desktop' These .desktop files are text files. So you open it with nano. Then you find the line(s) inside which says "Exec=brave". And change them to "Exec=firejail brave".

A firejail profile is the compartmentalization settings for a particular program. Brave has a profile already made. All the firejail profiles are in /etc/firejail/ .
 
Last edited:
Victor M said:
Actually, you run Firejail and indirectly call Brave. As in "firejail brave" . You can try it at the terminal.

All the icons are at /usr/share/applications/ in desktop files. And there would be something like 'brave.desktop' These .desktop files are text files. So you open it with nano. Then you find the line(s) inside which says "Exec=brave". And change them to "Exec=firejail brave".

A firejail profile is the compartmentalization settings for a particular program. Brave has a profile already made. All the firejail profiles are in /etc/firejail/ .
Click to expand...
well, I think that's how it is supposed to work BUT I did run firejail brave in terminal and it did not happen. Unfortunately I did not keep a copy of the exact error message and I'm not running Linux today. Will update next time I run Zorin.
 
Hi @simmerskool ,

I haven't used Firejail in a long time, nor have I ever used it to sandbox Brave, but the built-in sandboxing of Brave running on Linux is quite strong. Try entering in the address bar: brave://sandbox and see what it outputs. the attached shows the sandboxing types, the strongest of which is the seccomp-BPF. If you can't get Brave firejailed successfully, you still have a strong sandbox running it on Linux.

brave sandbox-linux.png
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top