Manjaro OS - security required ?
Discussion
Hi All,
I've installed the Manjaro OS (based on Linux Arch) on an elderly laptop and it works very well indeed.
I'm just wondering, how secure is the system likely to be ? - Should I install something like Malwarebytes Anti-malware and/or something like BitDefender ?
Does it need any security software and if so, what would you recommend ?
Thank you.
I've installed the Manjaro OS (based on Linux Arch) on an elderly laptop and it works very well indeed.
I'm just wondering, how secure is the system likely to be ? - Should I install something like Malwarebytes Anti-malware and/or something like BitDefender ?
Does it need any security software and if so, what would you recommend ?
Thank you.
pubrunner said:
I've installed the Manjaro OS (based on Linux Arch) on an elderly laptop and it works very well indeed.
I'm just wondering, how secure is the system likely to be ?
Very secure compared to anything Microsoft do. It's a proper full fat I'm just wondering, how secure is the system likely to be ?
multi user server operating system (Unix) made to work on smaller machines (Linux).
pubrunner said:
>- Should I install something like Malwarebytes Anti-malware and/or something like BitDefender ?
I wouldn't bother. They won't install anyway.Whereas on MS systems there is a thriving industry of third party security products,
Linux and Unix work well enough out of the box that there pretty much
is no market in security products for them.
pubrunner said:
>Does it need any security software and if so, what would you recommend ?
As standard, any linux has *proper* security installed as standard.MS operating systems these days are basically enhanced versions
of single user operating systems like MS-DOS and CP/M
Any security they have is tacked on later, not designed in from day 1.
Primary security weakness on Linux systems is the user.
Don't click on any dodgy links in your browser.
Sorry but that's semi BS - Linux actually is rather bad at security, just different types of weaknesses than MS Windows and MacOS - different vectors of attack. I agree about the lack of need for AV software (unless you are going to transfer any files you download on to another machine (Windows, andrdiod, iOS, MacOS etc)), but ideally you should have some form of file integrity manager doing routine scans (and being run after first build and after you install anything new on to your PC).
I agree main issue is the user as many attacks, as previously mentioned/inferred are OS agnostic and triggered by clicking on links or opening unknown files.
Software is just as bad as any other OS for needing patching, just with most Linux flavours the onus is on the user to maintain, not the application to check and update.
BTW not a Linux hater - UNIX professional for over 20 years and worked on/with Linux for personal and work related reasons.
edit --
I don't mean to scare of the OP - you fancy running Linux at home, go for it, you've already shown you want to be careful by asking your question here (well worth searching round for appropriate forums - I'm out of date on that side as the last fair few years I've worked with Security teams/architects and so been part spoon fed).
I agree main issue is the user as many attacks, as previously mentioned/inferred are OS agnostic and triggered by clicking on links or opening unknown files.
Software is just as bad as any other OS for needing patching, just with most Linux flavours the onus is on the user to maintain, not the application to check and update.
BTW not a Linux hater - UNIX professional for over 20 years and worked on/with Linux for personal and work related reasons.
edit --
dcb said:
Very secure compared to anything Microsoft do. It's a proper full fat
A big myth, though much improved since 2000/1 when out of the box Linux lost spectacularly to out of the box Windows NT in a series of tests by independent specialists. It's why since then most Linux installs come heavily locked down requiring you to open things up to make it usable - and yes I do realise this is where user error can come in, but also it's where knowing what you're doing can make a big difference.dcb said:
Whereas on MS systems there is a thriving industry of third party security products,
Linux and Unix work well enough out of the box that there pretty much
is no market in security products for them.
Again incorrect, but most of them are targeted at business/commercial/enterprise use, not home consumer. Costs can be appropriate for that territory as wellLinux and Unix work well enough out of the box that there pretty much
is no market in security products for them.
dcb said:
As standard, any linux has *proper* security installed as standard.
This is incorrect and one of the reason home installs of linux are a popular target amongst the hacking community.I don't mean to scare of the OP - you fancy running Linux at home, go for it, you've already shown you want to be careful by asking your question here (well worth searching round for appropriate forums - I'm out of date on that side as the last fair few years I've worked with Security teams/architects and so been part spoon fed).
Edited by dapprman on Friday 5th February 23:58
Edited by dapprman on Friday 5th February 23:59
dcb said:
As standard, any linux has *proper* security installed as standard.
MS operating systems these days are basically enhanced versions
of single user operating systems like MS-DOS and CP/M
Any security they have is tacked on later, not designed in from day 1.
Primary security weakness on Linux systems is the user.
Don't click on any dodgy links in your browser.
Windows desktop and server operating systems have been based on the same kernel for 20 years. Earlier versions of NT kernel OSes were even POSIX compliant and both desktop and server variants now come with Windows Subsystem For Linux so you can run native Linux executables on Windows desktops and servers.MS operating systems these days are basically enhanced versions
of single user operating systems like MS-DOS and CP/M
Any security they have is tacked on later, not designed in from day 1.
Primary security weakness on Linux systems is the user.
Don't click on any dodgy links in your browser.
dapprman said:
Sorry but that's semi BS - Linux actually is rather bad at security,
Really - news to me. Mind you, I've only been running Linux professionallyand personally for 27 years across hundreds of boxes.
More detail requested. Feel free to go downto the kernel level if you want to.
dapprman said:
ideally you should have some form of file integrity manager doing routine scans (and being run after first build and after you install anything new on to your PC).
Strange. Despite decades of use, I've never heard of anybody running a file integrity manager on Linux.dapprman said:
It's why since then most Linux installs come heavily locked down requiring you to open things up to make it usable
Not seen this on any Linux installs I've done or heard of, either.It just works fine straight out of the box.
Even connecting linux to a network doesn't require buying third party products for security.
dapprman said:
This is incorrect and one of the reason home installs of linux are a popular target amongst the hacking community.
Nope. That doesn't ring true with me either. Hackers know most home users don't have muchof value on their machine. Universities and research institutes have higher value data
and so get targeted appropriately.
Some bloke's credit card data versus details of some new emerging tech ? No contest.
dcb said:
dapprman said:
ideally you should have some form of file integrity manager doing routine scans (and being run after first build and after you install anything new on to your PC).
Strange. Despite decades of use, I've never heard of anybody running a file integrity manager on Linux.It's utterly bonkers to have even mentioned it to someone getting started with Linux. The OP doesn't need to worry about one or anything else, Linux is as good a place to start as there is from a security perspective.
dapprman said:
<snip>
A big myth, though much improved since 2000/1 when out of the box Linux lost spectacularly to out of the box Windows NT in a series of tests by independent specialists. It's why since then most Linux installs come heavily locked down requiring you to open things up to make it usable - and yes I do realise this is where user error can come in, but also it's where knowing what you're doing can make a big difference.
<snip>
This stems from the late 90's / early 2000's when Linux boxes ran a telnet server by default, along with an open relay SMTP server and no firewall.A big myth, though much improved since 2000/1 when out of the box Linux lost spectacularly to out of the box Windows NT in a series of tests by independent specialists. It's why since then most Linux installs come heavily locked down requiring you to open things up to make it usable - and yes I do realise this is where user error can come in, but also it's where knowing what you're doing can make a big difference.
<snip>
It was (incorrectly) assumed by Linux developers that most end users would (could??) setup a firewall and secure open ports, but as Linux became more popular many end users were just not savvy enough to do so.
You didn't have to be a master hacker to be able to make use of the open relay. Add to that people setting easy to guess passwords and many (home) internet facing Linux boxes were an open door via telnet.
Of course there were exploits as well, but a correctly firewalled machine was mostly immune to these.
Incidentally, Windows NT4 was hardly a bastion of security with no firewall (not even an O/S option!) and putting an NT4 box directly on the internet would result in swathes of messenger spam and the box would eventually keel over and die. I know - I tried it, both with NT4 and Win2K.
dapprman said:
dcb said:
As standard, any linux has *proper* security installed as standard.
This is incorrect and one of the reason home installs of linux are a popular target amongst the hacking community.And even when SSH is enabled, root logins are denied.
So the OP has nothing to worry about.
dcb said:
MS operating systems these days are basically enhanced versions
of single user operating systems like MS-DOS and CP/M
Any security they have is tacked on later, not designed in from day 1.
You are confusing 9x with NT which had multiuser ACL from its inception, its command prompts arent a DOS.of single user operating systems like MS-DOS and CP/M
Any security they have is tacked on later, not designed in from day 1.
dcb said:
Strange. Despite decades of use, I've never heard of anybody running a file integrity manager on Linux.
I have, and do, on all the Linux servers at work. It's a requirement for compliance on all servers, be they Linux or Windows.You've never heard of anyone running OSSEC or AIDE?!
Modern OSes are very secure, by far the biggest risks come from the user. I hate to say it but linux users are the worst.
A combination of confidence, enthusiasm and ease of access mean that linux users are much more likely to tinker, and that tinkering is likely to go much deeper, this creates a very large attack surface.
The only defence against it is to not be the person who installs Manjaro OS or what ever else. Your next best hope is to acknowledge that you are that person, buy a chromebook, keep it on the stable channel and do your tinkering elsewhere.
A combination of confidence, enthusiasm and ease of access mean that linux users are much more likely to tinker, and that tinkering is likely to go much deeper, this creates a very large attack surface.
The only defence against it is to not be the person who installs Manjaro OS or what ever else. Your next best hope is to acknowledge that you are that person, buy a chromebook, keep it on the stable channel and do your tinkering elsewhere.
SBDJ said:
I have, and do, on all the Linux servers at work. It's a requirement for compliance on all servers, be they Linux or Windows.
You've never heard of anyone running OSSEC or AIDE?!
Nope. Never heard of OSSEC or AIDE and I have done multi year assignments inYou've never heard of anyone running OSSEC or AIDE?!
the data storage industry.
Mind you a quick google suggests that if you have to run a third party file integrity manager
then you must have a pretty rubbish file system.
I rather suspect someone is selling "not really needed" software to corporate folks
who don't have much technical knowledge of how proper file systems work.
Hardware failures do occur and that's what various levels of RAID are about.
But I've never seen a Linux file system failure and that includes systems up to thousands
of networked computers on the same site and petabytes of data.
Exactly that. It's not about file system failure, it's about security - which is what the thread was about. Assuming that people using FIM are idiots because you've never seen something is a strange approach.
Noone is selling me anything; these are FOSS packages that perform a function that is a mandated requirement in certain industries.
You either perform FIM or use a container that you can rebuild more frequently than the required FIM schedule. Or the auditor fails you
If you don't believe me then have a look at PCI-DSS certification. Requirement 11.5 IIRC. Also have a look at industry accepted security benchmarks such as CIS which explicitly mention AIDE by name.
Noone is selling me anything; these are FOSS packages that perform a function that is a mandated requirement in certain industries.
You either perform FIM or use a container that you can rebuild more frequently than the required FIM schedule. Or the auditor fails you
If you don't believe me then have a look at PCI-DSS certification. Requirement 11.5 IIRC. Also have a look at industry accepted security benchmarks such as CIS which explicitly mention AIDE by name.
Edited by SBDJ on Sunday 7th February 22:48
SBDJ said:
If you don't believe me then have a look at PCI-DSS certification.
Thanks, but I won't bother. I am not that interested. I had no idea about the world of FIM, thanks for letting me know.
You describe some of the corporate world. Original user isn't in that category.
I think poster essayer has the right idea.
BTW, just to be nosey, I priced up a copy of the latest Win10 from MS for a single small user.
About £80. Add in about £20 for a copy of a third party network security package and £100 is a
significant fraction of the purchase price of a small computer.
No wonder so many folks on a budget opt for Linux. It's the right price - free - and
the licence means you can give it away happily to friends and colleagues. Ok, if you get keen
and fear breaking something, you might want to pay for a support contract, but most
one man bands and smaller groups manage without and rely on support from the Internet.
I note with interest that linux-5.11-rc7 has just landed. Time for some more testing
and debugging !
dcb said:
Thanks, but I won't bother. I am not that interested. I had no idea about the world of FIM,
thanks for letting me know.
Good move thanks for letting me know.
dcb said:
You describe some of the corporate world. Original user isn't in that category.
I think poster essayer has the right idea.
Absolutely, I wouldn't recommend FIM for your average user, even in a corporate environment.I think poster essayer has the right idea.
dcb said:
Thanks, but I won't bother. I am not that interested. I had no idea about the world of FIM,
thanks for letting me know.
You describe some of the corporate world. Original user isn't in that category.
I think poster essayer has the right idea.
BTW, just to be nosey, I priced up a copy of the latest Win10 from MS for a single small user.
About £80. Add in about £20 for a copy of a third party network security package and £100 is a
significant fraction of the purchase price of a small computer.
No wonder so many folks on a budget opt for Linux. It's the right price - free - and
the licence means you can give it away happily to friends and colleagues. Ok, if you get keen
and fear breaking something, you might want to pay for a support contract, but most
one man bands and smaller groups manage without and rely on support from the Internet.
I note with interest that linux-5.11-rc7 has just landed. Time for some more testing
and debugging !
Why would they need a third party security package when Windows 10 has AV and Firewall distributed with the O/S?thanks for letting me know.
You describe some of the corporate world. Original user isn't in that category.
I think poster essayer has the right idea.
BTW, just to be nosey, I priced up a copy of the latest Win10 from MS for a single small user.
About £80. Add in about £20 for a copy of a third party network security package and £100 is a
significant fraction of the purchase price of a small computer.
No wonder so many folks on a budget opt for Linux. It's the right price - free - and
the licence means you can give it away happily to friends and colleagues. Ok, if you get keen
and fear breaking something, you might want to pay for a support contract, but most
one man bands and smaller groups manage without and rely on support from the Internet.
I note with interest that linux-5.11-rc7 has just landed. Time for some more testing
and debugging !
A more common FIM would be tripwire. Useful tool but on home system the auto updates are changing the system so frequently that it’ll just give you a firehose of false positives.
I don’t tend to do much hardening on desktop Linux these days, they’re fairly decent out of the box. Encrypt root/home, enable auto updates, ad blocker in the browser and that’s probably about it.
I don’t tend to do much hardening on desktop Linux these days, they’re fairly decent out of the box. Encrypt root/home, enable auto updates, ad blocker in the browser and that’s probably about it.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff