I wouldn’t recommend using anti-virus software. It usually creates a lot more overhead, plus it usually mimics existing solutions already in linux.
The only viruses I have ever caught using an anti-virus software on Linux are the test viruses to see if all is working fine.
Anyway, here’s my 20+ enterprise experience recommendations with Linux :
enable firewall: and inly allow ports you really need.
SELinux: it is getting better, and it will prevent processes to access resources out if their scope. It can be problematic if you don’t know it (and it is complex to understand). But if it doesn’t hinder you, don’t touch it. I do not know AppArmor, but it is supposed to be similar.
disable root over ssh: or only allow ssh keys, or disable ssh altogether if you do not need it.
avoid using root: make sure you have a personal account set up with sudo rights to root WITH password.
only use trusted software: package managers like apt and rpm tend to have built in functionality to check the state and status of your installed software. Use trusted software repositories only. Often recommended by the distro maintainers. Stay away from use this script scripts unless you can read them and determine they’re the real thing.
Adhering to these principles will get you a long way!
edit: added section about software sources courtesy of @dragnucs
Firewall on Linux is something I still don’t understand, and explanations found on Internet have always confused me. Do you happen to know some good tutorial to share? Or maybe one doesn’t need to do anything at all in distros like Ubuntu?
Thank you ALL for the great advice and guides! I’m writing from behind a laptop firewall now, and don’t notice anything :) It was smoother than I expected. In the end I used UFW because it was already installed, but I’ll take a look at firewalld too in some days! I don’t have any incoming ssh connections (not a server), so I didn’t need to worry about that :)
ebtables and iptables can be very complex. And I failed my 1st RHCE exam because of them. But once you learn, you will never unlearn, as they are quite beautifully crafted. You just need to get into the mindset of the people who wrote the tools…
Look into firewalld
It has a rather simplified cli interface: firewall-cmd
The manpages will tell you a lot.
firewall-cmd —add-service=ssh
Will open the ports for your ssh daemon until you reload your firewall or reboot your system
firewall-cmd —permanent —add-service=ssh
Will open the ssh ports until you remove them
firewall-cmd —list-all
Will show you the current firewall config
For example, if I open my settings (I’m on Ubuntu+KDE) I don’t see any firewall settings to configure. So I expect this is automatically done by the OS, but maybe I’m wrong. A bit surprised that the system itself doesn’t recommend using a firewall, to be honest.
Many firewall tutorials start speaking about “your server”. Then I wonder: is this really for me? I don’t have a server. Or do I?
I now see that the tutorial from @toikpi@feddit.uk gives a better explanation, cheers! So I see it’s good to have a firewall simply because one connects to public wifis from time to time.
I see that both UFW and firewalld are recommended… is it basically OK whichever I choose?
I don’t think you need to configure your firewall.
Firewalls are usualy used to block incomming connectings. Usualy a Firewall that blocks all incomming connections is already active on your modem/router. Adding exception to the modem/router Firewall usualy happen through port forwords.
I wouldn’t recommend using anti-virus software. It usually creates a lot more overhead, plus it usually mimics existing solutions already in linux. The only viruses I have ever caught using an anti-virus software on Linux are the test viruses to see if all is working fine.
Anyway, here’s my 20+ enterprise experience recommendations with Linux :
aptandrpmtend to have built in functionality to check the state and status of your installed software. Use trusted software repositories only. Often recommended by the distro maintainers. Stay away from use this script scripts unless you can read them and determine they’re the real thing.Adhering to these principles will get you a long way!
edit: added section about software sources courtesy of @dragnucs
And when in doubt, upload the file to virustotal.
Thank you for the advice!
Firewall on Linux is something I still don’t understand, and explanations found on Internet have always confused me. Do you happen to know some good tutorial to share? Or maybe one doesn’t need to do anything at all in distros like Ubuntu?
Regarding ssh: you only mean incoming ssh, right?
@bushvin@pathfinder.social @toikpi@feddit.uk @hevov@discuss.tchncs.de @ChonkaLoo@lemmy.world @HotBoxghost2743@lemmy.ml @c1177johuk@lemmy.world (I’m surely forgetting someone, sorry)
Thank you ALL for the great advice and guides! I’m writing from behind a laptop firewall now, and don’t notice anything :) It was smoother than I expected. In the end I used UFW because it was already installed, but I’ll take a look at firewalld too in some days! I don’t have any incoming ssh connections (not a server), so I didn’t need to worry about that :)
Really great people here at Lemmy :)
Yes, usually you configure your endpoint firewall to block incoming traffic, while allowing all outgoing.
Unless you’re in a very secure zone, like DMZ’s.
ebtablesandiptablescan be very complex. And I failed my 1st RHCE exam because of them. But once you learn, you will never unlearn, as they are quite beautifully crafted. You just need to get into the mindset of the people who wrote the tools…Look into
firewalldIt has a rather simplified cli interface:firewall-cmdThe manpages will tell you a lot.
firewall-cmd —add-service=sshWill open the ports for your ssh daemon until you reload your firewall or reboot your systemfirewall-cmd —permanent —add-service=sshWill open the ssh ports until you remove themfirewall-cmd —list-allWill show you the current firewall configTry nftables directly, it’s simple and straightforward, scripting syntax is easy.
Firewall - While this tutorial is Ubuntu 16.04 it should work current versions of Ubuntu https://www.linuxbabe.com/desktop-linux/getting-started-gufw-ubuntu-16-04 It should work for other distributions once you change the package manager.
What don’t you completely understand about Linux firewall? I don’t mind helping you learn
Thank you everyone, also @bushvin@pathfinder.social @toikpi@feddit.uk.
For example, if I open my settings (I’m on Ubuntu+KDE) I don’t see any firewall settings to configure. So I expect this is automatically done by the OS, but maybe I’m wrong. A bit surprised that the system itself doesn’t recommend using a firewall, to be honest.
Many firewall tutorials start speaking about “your server”. Then I wonder: is this really for me? I don’t have a server. Or do I?
I now see that the tutorial from @toikpi@feddit.uk gives a better explanation, cheers! So I see it’s good to have a firewall simply because one connects to public wifis from time to time.
I see that both UFW and firewalld are recommended… is it basically OK whichever I choose?
I don’t think you need to configure your firewall. Firewalls are usualy used to block incomming connectings. Usualy a Firewall that blocks all incomming connections is already active on your modem/router. Adding exception to the modem/router Firewall usualy happen through port forwords.