Linux Desktop Security 5 Key Measures

Welcome to another video from explainingcomputers.com. This time I'm going to talk about keeping a desktop Linux distro secure. Please note that my focus will be on security of home Linux computers, so I'm not talking here about security of fleets of corporate PCs or Linux servers. And indeed, I'm going to assume that you're running a mainstream, end-user-focused distro like Linux Mint or Ubuntu or Zorin OS. And indeed, I'll be demonstrating things in these distros. So, let's go and get started. Computer security is concerned with preventing data loss and preventing unauthorized access. We mitigate the risk of data loss by maintaining 321 backups, which means keeping at least three copies of all data on at least two different media with one copy stored off-site. No Linux system is protected against data loss if you're not maintaining at least 321 backups, just as no Windows system is protected either. And so, as this is not a Linux-specific issue, I'll say no more about backups here, although I will provide a link in the video description to my relevant cyber security video. To protect against unauthorized access for security of any system, Linux or otherwise, depends on a number of factors. These include regular security updates, running a firewall, running appropriate antivirus and other anti-malware software, effective user account management, and appropriate user behavior. And so, let's run through each of these in turn. All modern operating systems are highly complicated pieces of code that are released before all possible security vulnerabilities can be found. Just like in Windows, over time, major security vulnerabilities have been discovered in Linux, with a classic example being the shell shock vulnerability found years ago in the Bash shell. This has been patched in modern Linux systems. However, Linux security vulnerabilities, as we can see here, do continue to be found, and so it's important to keep your system up to date. Fortunately, all supported Linux distros, like Linux Mint 22, as we're running here, can receive regular security updates. However, unlike in Windows, these are not always set to be automatically installed. For example, here in Linux Mint, automatic updates are turned off by default. With the update shield on the panel, instead notifying when updates are available. And we then need to click on the icon to open the update manager, and then click again on install updates to update our system. And often we have to click on additional requesters too, as we do here, and all would have to enter our password. And if we use the magic of filmmaking to speed on through, our system is now up to date, and on this occasion, a reboot is required. So, our system is now fully up to date. But, if you don't want to review and apply updates manually, you can set them to be automatic, just as they are in Windows. Here in Linux Mint, this is done by opening the update manager, and going to edit, and preferences, where we've got all kinds of options for scheduling update checks, and if we go across to automation, there is a toggle here to apply updates automatically. So, if we just enter our password, there we go, this system will now be automatically updated. And, it is worth taking heed of the advice at the top of the screen, to have system snapshots turned on, so we can roll back to an earlier state if an update causes an issue. And here in Linux Mint, snapshots, what Windows calls restore points, are taken by an application called Timeshift, which we can find down here in the menu. There it is, where we can see that on this system, Timeshift is indeed active, and I'd note that Linux Mint will prompt you to activate Timeshift immediately after installation, and as I've covered in other videos. Now, turning to the two other distros that I recommend for Linux beginners, here in Zorin OS, for most updates, a notification like this one is displayed whenever updates are available, and we can either choose to be reminded to install them in the future, or click to install now. However, by default, here in Zorin OS, security updates are handled somewhat differently, as we can see if we go to the menu and select System Tools, and then Software Updater. And, once this has completed a quick check, if we click on Settings, we see that by default, when there are security updates, these are set to download and install automatically, although we can change this if we wish. Similarly, if we venture across to Ubuntu, and then click on Show Applications, and open up Software and Updates, we can see that here, if we click on Updates, that Snap Package updates are checked routinely and installed automatically, and when there are security updates, they are again downloaded and installed automatically, although we can change this if we wish. But, in Ubuntu, by default, you have nothing to do in respect of this aspect of security. Next, let's turn to firewalls. These provide a barrier between your computing activities and the internet, with controls to permit only certain communications to get through. On most home networks, there will be a firewall in the router or router that provides your internet connection. This serves to protect your entire network and should be turned on. However, it's also sensible to run a firewall on each individual computing device. And so, for example, in Windows, the Windows Defender firewall is turned on by default. Most end-user Linux distros do include a firewall, often the UFW or uncomplicated firewall, which can be controlled by a graphical interface called GUFW or the GUI for uncomplicated firewall. However, in most distros, by default, this firewall is turned off. So, let's see how this can be changed. Firstly, here in Linux Mint, we can go to the menu and then go to preferences and scroll down to firewall configuration. There it is. And once again, we have to enter our password. And hey presto, here is the graphical interface to the uncomplicated firewall. And to turn this on, all we have to do is to go to status and click to, well, turn it on. And it's worth noting it sometimes takes a few seconds to toggle the firewall on or off, so do be a bit patient. As we can see, different profiles are available, including home, public and office. Although for home use, the default home profile should be fine. Indeed, as the help information tells us, normal users will be safe with this setting as it allows all outgoing communications, but denies all incoming ones. And so, in practice, this means that you'll be able to, for example, use a web browser to access websites and an email client to send and receive messages. However, all incoming requests for communication will be blocked. Now, if you do require some externally instigated communications to get through, for example, to allow remote access to your computer via SSH, then you could add rules for this if required. But for many home users, the standard home profile with no additional rules will be fine. Turning to other distros, here in Zorin OS, the firewall is also turned off by default, but is again very easy to turn on. Here, we have to go down to the menu and go to settings. And then in settings, we go to network. And then, oh look, we've got a button called firewall configuration. And here we are. Just as we saw in Linux Mint, we have got the graphical interface too, the uncomplicated firewall. And again, very simply, we can turn the firewall on. Finally, returning to Ubuntu, hello, once again, the uncomplicated firewall is installed, but turned off by default. However, we can't control it quite as easily here in Ubuntu as the GUFW graphical interface is not pre-installed. And so, we either have to operate the firewall via terminal commands or install GUFW ourselves. And so, let's do that by going to the app center. And we'll now do a search for firewall. And we're going to select firewall configuration, which, as we can see, is the graphical interface to the uncomplicated firewall. And so, we will here click on install. And there we are. The interface is installed. So, let's close that down and go across to show all apps. We're hopefully on page two. Yes, there it is. And just as we saw in Linux Mint and so in OS, we can now have the firewall enabled. For some time, a common opinion has been that desktop Linux systems do not need antivirus and wider anti-malware software. But is this true? Well, the logic that desktop Linux does not need anti-malware stems from the assumption that less malware is targeted at Linux due to its smaller user base. However, whilst only a few percent of desktop systems run Linux, it's installed on the majority of web and public cloud servers and is therefore an increasing target for hackers. Indeed, as security.org notes, cybercriminals know that Linux devices are very often used as servers by organizations. This means tons of devices running different operating systems, Windows, MacOS, Android are linked to the Linux server. And malicious actors know that if they manage to spread malware to the Linux machine, they'll be able to compromise the linked devices. The first piece of Linux malware, STOAG, was identified in 1996. And today, there are lots of different Linux malware strains, many of which are nicely summarized in this article on Linux security, which I'll link in the video description. But in short, we have Cloud Snooper, Evil Gnome, Hidden Wasp, QNAP Crypt, GonnaCry, FBot, and Tycoon. Such malware has been used in attacks against servers. Admittedly, Evil Gnome is different as it's a disguised shell extension for the default desktop used in Ubuntu and some other desktop Linux distros. Dating from 2019, it includes a keylogger and has access to your files and microphone. However, the Evil Gnome script needs to get onto your computer in the first place and then to be executed, which brings us back to the importance of taking other desktop security measures. Commercial Linux antivirus and wider anti-malware software are available from companies including Bitdefender, Avast, and Sophos. However, reflecting the nature of the threat, applications from these vendors are primarily intended for business use to defend Linux servers. This said, the free ClamAV antivirus software can be installed from a software center in many desktop Linux distros. However, do be aware that there's no graphical user interface. And indeed, ClamAV is mainly installed on mail servers to scam messages. But, if you're worried, you may want to investigate ClamAV. So, am I worried? Well, not yet. The existence of the Evil Gnome script is most certainly a wake-up call to remind us all to be vigilant. But, there's a big difference between Linux malware existing and being mainly directed at servers and desktop Linux malware being widely distributed. And so, right now, I'm sticking with the latest advice from Canonical, the creators of Ubuntu, which states that antivirus software does exist for Linux, but you probably don't need to use it. Linux viruses are so rare that you don't really need to worry about them at the moment. Clearly, this situation needs to be kept under review. But, I personally run desktop Linux systems with no antivirus or wider anti-malware software. And, I believe this to be appropriate at the current time, provided that other security measures are taken to patch software vulnerabilities and to stop malware getting onto a system. Another way to keep a desktop Linux system secure is to limit the rights of different users. This is mainly an issue for administrators running large fleets of computers on a company network. However, even on a Linux home PC, it's worth being aware that there are three basic types of user account. Firstly, we have the root account, which has total, unrestricted super-user privileges. And, by default, the root account is locked in Linux Mint, Ubuntu, and Zorin OS. Secondly, we have administrator accounts. And, the first account created on a Linux system will always be an administrator, and this means that it's possible to do things like opening up a terminal, here we go, and executing a command prefixed with sudo, which stands for super-user do. And, when we enter a command prefixed with sudo, it requires us to enter our account password, but then allows us to install an application or to do other things that require root privileges. And, for inexperienced users, this can be a security risk. Finally, we have standard or regular accounts, which, by default, do not have sudo rights, and which can only modify files within their own home directories. If you're running a Linux desktop computer that's shared by several people, and you cannot necessarily trust everybody to keep security in mind, it's therefore wise to create a standard account they can use, and which will limit the potential for security problems. As an example, to do this here in Linux Mint, let's close down this terminal and go to the menu, and then to administration, where we will scroll down right at the bottom to users and groups, which immediately requires us to exercise our admin rights by entering our password, and where we can now add a new user account of type standard rather than administrator. Finally, and critically, we get to the issue of appropriate end-user behavior, because it's often end-user actions rather than insufficient technologies that pose the greatest security risk. This of course matters regardless of what operating system you choose to run. But it's worth stressing that to keep a Linux system secure, it's important to only install trusted software from trusted sources, which in practice usually means choosing mainstream packages from your distro's official repositories. To only execute sudo-prefixed commands again from trusted sources, or in other words, to be very careful indeed if you ever paste bits of code from the web into your terminal. To never click on links or open attachments in unsolicited emails. To use strong passwords and to enable two-factor authentication on all accounts where this is available. To consider the use of a virtual private network, and especially on portable devices, to encrypt sensitive data either by using whole drive encryption or by creating encrypted containers using software such as VeriCrypt, as I've covered in another video. Finally, it's worth remembering that one of the reasons that people migrate to Linux is to gain greater control of their desktop operating system. However, this also requires the user to exercise appropriate responsibilities to keep their system secure. And I hope in this respect that here I've shared some useful tips. But now that's it for another video. If you've enjoyed what you've seen here please press that like button. If you haven't subscribed please subscribe. And I hope to talk to you again very soon.