Securing Fedora Installation on my laptop

Ask Fedora
1

I am seriously considering jumping ships to Fedora Linux after being on Windows for so long. I am testing out Fedora 44 KDE Plasma on my laptop (dual booting with Windows currently), and for the most part, it runs as I need it to. I’ve had no issues with any drivers so far.

My concerns is mainly regarding security on the laptop. I will be spending a lot of time online and also for work on this laptop, and I wanted to make sure I can make it as secure as I can. I’ve enabled LUKS and disk encryption on the device. I read that the firewall is enabled but I want to make sure that it’s properly configured to block unneeded traffic. Is there any documentation that I can refer to for firewall configuration?

Is there anything that I can use to make my laptop secure for work and online usage?

2

firewall docs

3

Check your firewall, but in general it will be more secure than windoze as is. Nothing you really need to worry about.

4

In a few days or weeks, we will provide a hardening page, including two types of hardening that will be maintained by the security SIG and the respective maintainers and avoiding that users’ will need to maintain their hardening themselves but can rely that it will be auto-updated etc.

Here is the draft: Making sure you're not a bot! (the formatting looks bad in Forge but it can be read :wink: )

Concerning the two Fedora-maintained hardening measures: if you want, you can already use the file: Making sure you're not a bot!

It will be installed with one of the next systemd updates, but it will be disabled by default (see the hardening page draft). The file is already final, so that’s no draft.

Some already use that, we just have not yet released it. That is more organizational reasons, not technical. You can use the file content, e.g., copy the lines without # to the /etc/sysctl.d/99-sysctl.conf file → but keep it in mind when you do this and delete it once the hardening is available! … or just wait some days for the release of this :slight_smile:

If you implement the two Fedora-maintained measures, you have already obtained a lot security that is designed and maintained to not cause issues to average desktop/workstation activities (but, e.g., its excluding stuff like software development in many cases, and providing web services).

Additionally: avoid third party software that doesn’t pass our Quality Assurance, keep every software/package managed in dnf’s repos, don’t taint your kernel. If you cannot avoid third party software, a useful means today is to use flatpaks and limit their access through the means of the flatpak containers.

That should already tackle 99% of all attack / breach scenarios.

Supplement: … and be careful whom you give access and credentials (including AI). Unfortunately, the latter has become an issue nowadays.

6

When downloading software from the software center, I see that a lot of them require access to the kernal. Is there a way to limit or revoke full access to the kernal for that software? Or is it required by the software to get full access to the kernal?

7

This is awesome! Dedicated security implementations and guides were the only thing I still wanted that Fedora didn’t seem to have yet :star_struck: (or at least I did not seem to find).
I like that it is disabled by default, but I do wonder how it would be communicated when it gets released for those that choose to enable it after the release. It almost seems worthwhile to have a notification present somewhere on the machine post update.
Robert Redford Nodding Meme

8

Can you elaborate what “access” you mean and maybe send a screenshot about what you mean with this? I expect there is a misunderstanding :classic_smiley:

I assume you mean Discover (you said KDE?)?

9

Well, I definitely will create a topic here in Discourse, and we could consider to pin it a few days because its also for average users who might not know much of our Docs.

But we cannot “manipulate” (this is how it could be perceived or as spam) installations with updates that impose news on them or so, except the usual “next Fedora” release and GUI changes :wink: This would also open the door for what else to announce, and who is allowed to announce their package changes and who not. I think no one would want to open this box :smiley:

10

Since the topic came up: I would appreciate feedback about the comprehensibility of the parts of “Fedora-maintained … hardening”.

Based on developer feedback, I improved the page. But it would be interesting to get feedback of people who ain’t engineers or packagers, to see if the page makes sense for this group too (also to avoid it is deterring or so etc). If you review, please provide feedback in matrix (#security:fedoraproject.org), or you can also open a new topic here on Discourse, and ping me with @py0xc3 in either case. Maybe a Discourse topic is more useful (everyone can open one in Project Discussion with the tag security-sig ).

The link above is the same but the content has been updated: Making sure you're not a bot! , still a draft

11

I wish I could share your optimism. Your statement gives a false sense of security. What has been suggested are small steps, when most desktop Linux distros actually need a big overhaul in terms of their security model and implementation.

Depending on the configuration of both systems, that’s debatable.

Does the default zone of Fedora still have all ports above 1024 open?

12

Just curious. What are the elements of a “big overhaul” of the security model and implementation to which you are referring?

Not asking for specific details, just a broad overview of the areas and the securing/mitigation you see as necessary. I think that would be a wonderful discussion to have. Please, do tell. Thanks!

13

Hi Nishat,

I think you may be confusing root access with kernel access. To Install any software in Linux you need root access OR you need sudo access in the wheel group (look in /etc/sudoers and /etc/group). ALL running processes in Linux require access to the kernel"." It is the kernel that determines what system resources are available to use, who owns them and who is allowed to run a specific program or have access to the resource requested (like disk access or screen access or network access or RAM access …) :slight_smile:

14

Hi Nishat,

Here is what I would suggest:

  1. Use strong passwords/passphrases and do NOT share it with anyone, not even your girlfriend/wife/brother/sister/mom/dad … If you want to give those others access to your computer, make an account just for them— My passwords are at least 12 chars long and are mixed case with at least 1 number and 1 punctuation char
  2. Disk encryption — in the event someone takes your laptop/computer and tries to get access to the disk
  3. Use the built in firewall – an easy tool for this is firewall-config. Generally the only port I allow inbound connectivity to is 22TCP (SSHD) AND I use ssh keys and disable password auth for ssh/sftp. I do quite a bit of remote access to my equipment, that’s why … also, I use ssh tunnels to secure things like RDP … also a good fail-safe in the event your console gets hung (like when an Nvidia driver update goes wrong at least you can get to the machine via the network and do a controlled shutdown or recovery activity without just crashing the machine with a rude power down)
  4. When not in active use, shut the device down to power off – suspend/sleep are nice but also can make your equipment unstable. Also, a complete shutdown completely prevents someone from remotely gaining access to your device AND it keeps the snoops/drive-bys from attempting to gain access at the command line …
  5. keep your system software up to date – I use dnf upgrade at the command line at least once a week to keep my system up to date/patched. I myself do not particularly care or trust the GUIfied software update tools …and avoid non-rpms (I don’t trust flatpaks or 3rd party repos either)
  6. Backup your data to an external storage device — I usually don’t backup the OS because it’s usually faster and easier to just do a clean reinstall if things go badly. The data you create is what is important (usually in your home directory). I am pretty old-school and use tar to make archives that are named according to the point in time of the backup. Then I DISCONNECT the external storage device and put it in a safe.

I have followed these simple guidelines for decades and have yet to have any of the computers I own or manage get compromised :slight_smile:

15

I totally get this point of view. I was even going to start my initial notification comment with “I’d hate to say it” :laughing:, but maybe there is a way to have the option to “opt-in” to security related notifications that are made available but disabled by default. There are already settings like that for telemetry related functionality, etc.

The biggest pain points I see with things that are not open source, for instance, are opt-out (or no controls at all) and enabled by default. I cannot speak for anyone else, but I for sure never enjoy anything like that. Those types of things are certainly manipulative and spammy, so I do see the perspective on it.

However, if each feature type/category allowed teams to offer an end user control to “opt-in” to notification categories, no one would be fighting over who gets included or left out. It would be the end user’s choice, possibly even a step during the initial install of Fedora. I think people may enjoy having the option and the freedom to choose, but I am open to people’s opinions on that.

  • Without this, people have to stay on top of Fedora related communities to know when something exists that could benefit them in their use case. I am not sure everyone does that.

I can take a look tomorrow and see what’s what :+1:

16

First we need to prove this project is sustainable and used by some people. This can take some time. If that works out, I’d be happy if we have a “hardening for general use cases”-like tick in the installation and maybe the GUIs. But that needs lobbying and convincing towards the related WG/SIG, and that needs proven facts :wink:

Much appreciated :classic_smiley: I guess a discourse topic at Project Discussion with #security-sig would be best. But don’t feel pressured

17

In no particular order:

  1. Integrating more exploit mitigations like type-based CFI (via clang), hardware-based CFI (e.g. PACBTI and x86 equivalents), hardware memory tagging, usage of hardened memory allocators, better usage of sanitizers, …
  2. More usage of memory-safe languages for new code
  3. Hardened kernel builds
  4. Sandboxed HALs
  5. Applications as security principals. Sandbox applications by default with a strong sandbox
  6. Full-system MAC policy
  7. Full verified boot for all privileged system state
  8. Usage of hardware key stores with specially protected spoofing-resistant UI
  9. Usage of virtualization-based security for additional protection of the kernel
  10. and more

As you might have guessed, it is totally unrealistic for Fedora alone to achieve this. And no, I don’t blame anyone working in their unpaid free time to contribute/maintain open source software or Linux distributions for the current state of security in Linux distros.

I am not optimistic that this changes in the near future, simply due to the fact that there is not enough demand and money for desktop Linux. I mean, there is a reason why Qubes OS throws the hypervisor on everything to at least provide proper isolation (and you can still use Fedora for the qubes, if you want to use Fedora).

If you want to see a Linux distro which implements most of the above and more, it is called Android. See The Android Platform Security Model.

18

Screenshot_20260722_094021
Screenshot_20260722_094021393×115 8.06 KB

I’ve copied what i mentioned.

And yes, I did mean Discover (and not Software Center - only reason i did mention Software Center is because it popped up right under Discover when hovering the mouse of the icon and I’m still getting used to the terminology).

19

I do see those ports open. Which is one of the reasons why I’m here asking this question. I wanted to block those ports by default and just make sure my laptop has access to things I access manually and not have anything else open. What are the “best practices” approach to lock them down and be a bit more secure?

20

One of the things I was looking at was that when installing software from Discover, it mentioned that the software required “full access can access everything on the system”. How deep does that access go to? Would it get access to the kernel (I don’t think it should or would but I would rather clarify that instead of guess)? Also, do these apps get “sandboxed” when using and installing them or can they access other things across the system?

21
  1. Yes, I’ve done exactly just that. Honestly, everyone in my family has their own device (sadly I’m the only one taking security seriously. My voice has gone on deaf ears to other members in my family who aren’t as tech savvy or understanding of tech in general).
  2. I turned it on when installing Fedora.
  3. Is the firewall turned on by default when booting up the device for use? I don’t need to access this device remotely so there is no need for any incoming ports to be opened. I just need enough ports open for when I browse the internet or check mail or whatever.
  4. Turning it off is what I’ve been doing when I’m not around. Only when I know that I’ll be back within 15 minutes or so after stepping away is when I lock the screen. Turned off machine is the most secure lol
  5. Is the command “dnf upgrade” in command line? I like you also don’t support the system to get updates by itself. As much as I like tech, I don’t trust it to run on it’s own. Automation is awesome - but only for work and I’d rather do it myself at home.
  6. I do have external storage for my data. Not the OS or anything but I try to keep data off of my machine when not needed