Hardening GNU/Linux

“Linux” is really GNU software operating with a Linux kernel, and GNU software there are many resulting in an incredible amount of distributions, all called “Linux”. Some even build on each other, such as Debian -> Ubuntu. It is impossible to cover them all.

Version 0.1: These mitigations are kept as simple as possible, with tools found in most distros. Some things are harder to cover. For example, each distro has its own privacy settings somewhere, and there are even distro’s that have specialised in privacy.

Accounts and authentication

• Introduction
• Disable and enable user accounts
• Make that secure passwords
• Use a password manager
• Password protect sleep and screen saver mode
• Use multi-factor authentication (MFA)
• Protect SSH access with MFA
• Design principles and sudo killers

Services and applications

• Introduction
• Service management
• Application armour (AppArmor)
• Restrict access to at and cron
• Disable startup applications
• Choose a secure browser that protects your privacy
• Use a secure messaging service
• Use secure email services
• Use SSH tunnels
• Use a VPN service
• Use a firewall as a VPN fail-safe mechanism
• Use alternative DNS servers
• Use a Tor proxy
• Anonymise SSH sessions with Tor
• Change MAC address
• Renew IP lease
• Edit hosts file

Data

• Introduction
• Use removable storage media
• Archiving and compressing
• Shift back and forth in time from past to present
• Disk encryption
• File encryption
• Shredding files and deleting data

Privacy

• Introduction
• Turning devices on and off
• Remove metadata from files
• Edit exif metadata in images
• Removing metadata with hex editors
• Scrub machine with BleachBit
• Use Metadata Anonymisation Toolkit 2 (MAT2)
• Distros specialised in privacy

Malware

• Introduction
• Malware detection and removal
• Analysing trojans

Operations security

• Introduction
• Use email securely
• Detecting fake emails and phishing
• Browse more safely
• Check integrity of downloads
• ‘;–have i been pwned?

Guards! Guards!

• Introduction
• Alphabet soup
• Netfilter and iptables
• NFTables
• Gufw and ufw
• Linux intrusion detection systems
• Aide
• OSSEC
• Tripwire