Securing debian

What are the steps to achieve the most secure debian distro? Any software to install? Best program to check connections?

It depends on what you're trying to achieve. Stock Debian is reasonable enough out of the box. People who are in actual danger should evaluate TAILS, Whonix, Qubes, etc. An OS alone cannot make you secure. You need to know what you're doing and maintain good opsec.

>>17320 Do you have this image without background? It would be cool to do a backround like the ones of moebuntu

Debian has dedicated manual about security, I didn't read btw but I guess it's worth checking. https://wiki.debian.org/SecurityManagement

>>17320 Use stable, not testing or unstable. Stable is the focus of the Debian security team, and security patches are backported. Testing may or may not get security patches, and unstable relies on upstream and packagers for security updates. Keep your installed base as small as possible. Carefully consider every piece of software you install, and consider using the --no-install-recommends flag. Use FDE via LUKS/cryptsetup, or if you're feeling really adventurous, loop-aes (you must patch and compile a custom kernel). Use a long, hard-to-guess password for all user accounts, especially root. Use AppArmor. Use Firejail to deny applications unfettered access to your home directory and to deny network access to any application that doesn't absolutely need it. You can use netstat to check connections. You can use tcpdump, tshark, or Wireshark to monitor network traffic. Qubes is probably more secure, but it's a hog of a distro. I don't have any hardware that can actually run it with tolerable performance; perhaps you do.

>>17332 >Use a long, hard-to-guess password for all user accounts, especially root. How will i remember the long password when root is needed, do i use a password manager?

>>17324 I did my best to remove the background but the logo still has a few white pixels around it.

>>17320 I use fail2ban and ufw to block soykaf coming to my debian box.

>>17348 Use passphrases, human brains do better with that. You can generate those using diceware or keepassxc as you wish.

>>17320 I really enjoy using firejail when running untrusted softwares, it's an easy way to get proper results. Don't forget to also install the package firejail-profiles to get some preconfigured profiles for certain softwares. If you're talking about a desktop usage, OpenSnitch is a must have too. Once it's running, you'll get a desktop popup each time a new or otherwise non-trusted program is trying to reach the internet. Really useful and convenient. As mentioned by others, you can't go wrong with UFW either. It complements OpenSnitch.

>>17348 correct horse battery staple