Secure Linux Distro

What's the most secure and/or private Linux distro that's appropriate for daily use? No telemetry, etc.

>>22259 That's too broad of a question, lainon. So, I'll give you a broad answer: Gentoo with the absolute minimum of what you need to use your machine the right way. My reasoning behind this is a low attack vector. This isn't a joke answer, but it's the best answer you can probably get. You should probably express what your usage is. You say "daily use" but that could be anything. What is your daily use? What is your threat model? I can say that LUKS + dm-crypt is something I recommend to everyone... But no one can really help you without you giving up some details on what you are after. Also, you should ask this in the general questions thread...

qubes is the only reasonable answer to this question. If you're more interested in "daily use" than "secure" then manjaro is fine. Ultimately your computer is only as secure as you use it/set it up, qubes is already set up so that there are clear SOP to follow to maintain security but you can have arbitrarily strict security measures in any distro.

>>22261 sorry lainon but manjaro is probably the least secure distro right now. The developers just cannot manage the distro. >>22259 If you want no telemetry avoid anything from canonical (ex. Ubuntu) and red hat. They are corporations. You should also avoid anything with systemD because it's a spaghetti mess and it's full of vulnerabilities and CVEs. (see this FAQ: https://artixlinux.org/faq.php) QubesOS is very secure but it heavily hinders what you can do. For example, forget games lol Tails is a live distro that's focused on being anonymous. Whonix is basically the middle ground. These three are considered the most secure in the linux world. There is also OpenBSD but it's not linux. You can also do the DIY approach and install arch (comes with systemD, so i suggest artix) and follow the wiki to secure and actually learn what and how (which is the best approach IMO, you need to know how to protect yourself otherwise you will always be dependent and vulnerable from others, which is coincidentally also a good life advice) Anything you do, be sure to encrypt your data. Also take a look at this: https://wiki.installgentoo.com/wiki/Babbies_First_Linux P.S. nhk is cool

>>22262 >QubesOS is very secure But it also uses systemd while you just said "You should also avoid anything with systemD because it's a spaghetti mess and it's full of vulnerabilities and CVEs", which you are correct about.

>>22263 Qubes' base is the Xen hypervisor, which doesn't have any systemD to speak of. You are right in the sense that by default, Qubes ships with Debian/Fedora as the dom0 OS, which is the highest privilege VM. This can be changed by the user and you can install whatever the fuarrrk you want on dom0, as you can for all other VMs and their templates. Perhaps it would be cool if Qubes shipped with Artix, Obarun or Devuan. >>22259 I've seen a person use the above mentioned Obarun as their daily driver. Attempt it if you're brave enough :)

>>22264 I'd probably be more open to suggesting Qubes if it shipped with Artix or even Gentoo. My only actual qualm with Qubes is that a systemd distro is the default choice.

>>22263 >>22265 My bad, didn't know. Actually i am surprised, i only learned recently how bad is systemd coming from arch. Why the heck are they not using a sane init system being a "secure" distro

>>22262 >sorry lainon but manjaro is probably the least secure distro right now. As I said, "Ultimately your computer is only as secure as you use it/set it up". Manjaro can be made secure like any other linux distro.

I would say almost any widely known distro has little to no telemetry and quite private. Even in Ubuntu it is a matter of taking care of a few options during and after installation, not even remotely close to how bad things are with Windows. Your ISP can figure out what kind of Linux you are using btw (DNS & Reverse DNS)

>>22259 GNU Linux-libre, as it doesn't contain any proprietary malware or proprietary malware loading machinery. As for GNU/Linux, any distro free of proprietary malware will be secure as long as you don't run proprietary malware on it (this includes proprietary malware in the form of JavaScript).

>>22259 >What's the most secure and/or private Linux distro that's appropriate for daily use? Void Linux or Gentoo with OpenRC (you can disable a lot of dependencies with USE flags (a Portage feature). Also, Gentoo provides hardened profile that adds more protections. If you use Gentoo, be sure to install gentoolkit package (and eselect-repository and eix), and on Void Linux install xtools package. Alpine Linux is also pretty good but it uses musl (musl is great but non-free software expects that you have glibc). These 3 distros don't get in your way and the base systems they provide are pretty minimal (and no Systemd). I recommend you use Gentoo if you can build all packages from source, i.e. you have at least semi-modern quad-core CPU and enough RAM (let's say more than 8GB). Building packages in Gentoo is automated with Portage package manager and USE flags. Otherwise, use Void Linux. You can read more about Systemd from these sites: >https://without-systemd.org/wiki/index_php/Arguments_against_systemd/ >https://nosystemd.org The biggest problem with Systemd is scope creep and more code = more bugs and Systemd will become unmaintainable mess at some point if it keeps growing like this. Also, Systemd will be harder and harder to replace because it keeps on swallowing more and more programs. There are additional steps (that aren't specific to 1 distro) you can take to secure your system: https://wiki.archlinux.org/title/Security Some important ones: * Install CPU microcode updates (also called ucode) and update your BIOS/UEFI firmware. * Do not use root account all the time. Either use sudo/doas (doas has smaller codebase) or su - to become root temporarily. After you have configured sudo or doas, you can lock the root account with passwd --lock root BUT note that this will (as side-effect) also disable single user recovery mode from Grub (keep LiveUSB of your fav distro somewhere you can easily find it and chroot (follow instructions from Gentoo Handbook)). * Set up firewall using ufw (enable it and run doas ufw default deny). * Install and enable AppArmor * Update your system at least once a week. I.e. run doas xbps-install -Su or sudo emerge --update --deep --newuse --with-bdeps=y @world * Only enable daemons (services) that you need (like OpenNTPD and UFW and AppArmor). * Do not run Xorg as root. Use xinit or Wayland compositor (like Sway or something else from https://wiki.gentoo.org/wiki/List_of_software_for_Wayland) * (optionally) use Tor Browser (torbrowser-launcher package) to access Tor. But do not login to any accounts while you use Tor. * (recommended) learn to use GnuPG (GPG) to encrypt your email: https://emailselfdefense.fsf.org/en/

>>22279 >But do not login to any accounts while you use Tor. Why?

Qubes is in a league of its own and works fine as a daily browser

>>22282 It makes sure that your IRL identity is never linked to Tor. But you can login to accounts that you always access using Tor only (but even that has the disadvantage of potentially linking your Tor usage to an online alias).

>>22290 >It makes sure that your IRL identity is never linked to Tor. You think your ISP and three letter fellows can't lookup entry node IPs? Unless you use bridges your identity will be linked to tor usage for sure. >But you can login to accounts that you always access using Tor only (but even that has the disadvantage of potentially linking your Tor usage to an online alias). If you are talking about timing correlation attacks, just run a tor relay 24/7 to mask your traffic.

>>22291 Tor bridges are also easily discovered by nation states and ISPs. A Tor bridge will not prevent your ISP from knowing you're using Tor. Anyone can discover thousands of Tor bridges. A government is more than capable of doing that. ISPs probably have databases of bridges. If they were not to have databases of bridges at their disposal so as to identify customers using Tor, it would not be out of a lack of ability to do so but out of oversight. There isn't any actual evidence that Tor bridges prevent an ISP from knowing somebody is using Tor aside everyone just saying that Tor bridges do so without providing proof, in theory they could work, but in practice they do not because the Tor Project's system of dispensing Tor bridges is flawed in a way that permits anyone to amass a list of Tor bridges through exploitation. Here's an example. https://github.com/scriptzteam/Tor-Bridges-Collector The fact of the matter is that there is nothing that can be done to prevent a nation state from knowing you're using an anonymizer. They are the ones in control of the internet cables and ISPs. They can identify and block the protocols used by anonymizers with impunity. The internet in general is intrinsically inhospitable to anonymity, the connections between systems to transmit information are traceable, they have to be, computers need to possess identifiers that will allow other systems to identify them in order to communicate with them. It is still feasible to have some anonymity and privacy online, but other things like reliably preventing a powerful entity from knowing you're using an anonymizer isn't feasible. A large mixnet would be great for stymying governments' abilities to surveil internet traffic. I don't think running a Tor relay is going provide protection against timing attacks. I assume you're thinking of running a guard node at your home and using that node to connect to the Tor network. I see no way that would somehow protect you from a timing attack. Your traffic exiting the guard node will still pass through your ISP, as will the traffic of those connecting to your node. The best defense I see is trying and failing to convince investigators that a connection which was made by you that they somehow traced to the guard node you control wasn't made by you but instead originated from one of many potential individuals who connected to your guard node. Hosting a node at home which you don't connect to probably won't be very effective either, it's not a terrible idea though. Using a guard node you control could be better than connecting to a VPN or VPS before Tor though. You'd need to remotely host the relay in such a manner that it could not be linked to you. A few payments here and there could be made without them being traced back to you. The server would require maintenance, you'd have to make repeated connections to it in order to ensure it functioned properly, alongside payments for the server over the passage of time. As time passed the likelihood of you being linked to the server would increase. If you're concerned about correlation attacks you especially shouldn't use your home network to establish a guard node or nodes on remote servers. It's exceedingly challenging to preserve anonymity using servers you control, you pretty much have to be using servers that don't belong to you as they cannot be linked to your identity whatsoever. There is often a desire of people to stray away from the beaten path and try soykaf like connecting to a VPN before Tor, or host their own nodes, instead of just sticking to what works and trying to improve the security of their configuration within their means without introducing some gimmicky soykaf.

Some lainons recommended Void Linux and as a longtime Void user and contributor I'd argue against it for security. A lot of packages are severely out of date. Packages are added by some random github users to main repos and these users are never heard from again to update, so a lot of times when you want to install some not-so-popular software you might get very outdated stuff. This shows especially in the musl itself - Void has been using 1.1.24 version of musl for the past 4 years. Current musl version is 1.2.4 afaik. They don't really backport security patches, just some compatibility ones. With something that basic so severely out of date it'd be better not to have musl version at all. Similar case of outdated software happened with glibc and gcc too on Void.

>>22314 That's the whole point. Ironically, the most secure distros are either the tarded ones (like Qubes) or the ones who have fuarrrkton of developers, like Debian and Red Hat.

>>22259 QubesOS if you're that paranoid, else for daily driving Alpine Linux does the trick

>>22267 how would one exploit a systemd vuln on dom0? dom0 doesn't communicate to the internet

>>23368 use your imagination

>What's the most secure and/or private Linux distro that's appropriate for daily use? No telemetry, etc. 1. Qubes 2. Tails 3. Whonix 4. Or just use Devuan netinstall iso. At the tasksel page, deselect everything except basic tools. Boot it and install minimal desktop if desired, e.g.: apt install xorg lightdm mate-core

>>22259 >What's the most secure and/or private Linux distro that's appropriate for daily use? I'd argue Kicksecure. Kicksecure has many improvements over stock Debian. (Its the distro, on which Whonix is built on) >strict AppArmour profile >Repos, Website and Docs available over .onion >strong user account separation >anti virus/malware measures >time attack protection >disabling legacy login >higher quality randomness >application-specific hardening >root user limitations and additionally >Kicksecure/Whonix Wiki is by far the best source on anonymization/privacy, even if you dont use those distros <https://www.kicksecure.com/ also >No telemetry, etc. what kind of Linux are you using, that includes telemetry? maybe some of those bizarre newbie distros, that get spammed a lot on channels like "the linux experiment" or in those AI-generated tech articles, maybe one of those, but normally Linux doesn't have any telemetry, even those normal distros like Arch, Debian, Slackware, CentOS, Fedora,.... dont have telemetry by default.

>>23503 >Tails Tails is just a torified Debian-Live system with little security improvements. Its a common misconception, but Tails is not secure. It makes everything you do anonymous, but it doesn't harden any kernel settings nor does it apply any meaningful security patches, nor does it have any stricter userspace settings, nothing really, besides its torified Live-system. Regarding the Live-system quoting Joanna Rutkowska [1] >Tails has long been (falsely) advertised as being capable of providing security >even on a previously compromised laptop4, as long as the adversary has not been >allowed to tamper with the hardware [ 58]. LightEater has demonstrated in a >spectacular way what had been known to system-level experts for years: namely >that this assumption has been a fallacy. Needless to say, the torifycation is not secure either. Unlike with Whonix Gateway, a single vulnerability can lead to de-anonymization. Whonix makes it impossible for malware on the workspace machine (may or may not be a virtual machine like default Whonix, or be physical separation with a Raspberry PI[2] or spare laptop[3]), to escape into clearnet. Tails is just Debian with a few iptable-settings, nothing a simple vulnerability couldn't circumvent. <[1]https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf <[2]https://www.whonix.org/wiki/Dev/Build_Documentation/Physical_Isolation#Experimental:_On_the_Raspberry_Pi_3_B_.28RPI3.29 <[3]https://www.whonix.org/wiki/Dev/Build_Documentation/Physical_Isolation

qubes os would probably be the most secure people complain about systemd on it, so if you don't want systemd install some non-systemd distro (eg. funtoo/gentoo or void) and just vm everything on top of it, the idea being that if/when your vm gets fuarrrked that you can just drop it or restore it from a savestate, unless it jumps the hypervisor

>>22262 >tails is live distro that's focused on being anonymous >whonix is basically the middle ground please don't give people terrible advice like this. both of these distros rely on tor for anonymity and have very similar use-cases: browsing the web anonymously, and browsing the dark web. TAILS does this with a USB stick that you can insert and remove from a system with no evidence of the past use habit, while Whonix is designed to be run in a VM (which makes it perfect for use in the Qubes operating system). because of their specialized nature, these OSes are designed to be used out-of-the-box for that purpose only. putting additional software, like games, on them not only increases attack vectors and makes you insecure, it does so in ways they weren't designed for and that devs weren't expecting. in fact, there's ways this can even make you less secure: tor was designed with a particular opsec in mind, and part of that opsec is not logging into any accounts. if you do, the fact that you're using tor to access your accounts could itself be used to build a unique signature to hosts and advertisers, there's also the part where using an account linked to any trace of identity (such as the content of what you post, look at, or who your friends are) undermines the use case of tor tremendously. the bigger issue with what you're saying is that anonymity != security or privacy, there exists many different ways that educators break this down but essentially - using tor *with appropriate opsec* makes you anonymous, but these systems cannot, say, torrent your favorite anime, or play video games online. for those you will need to find and use a secure VPN (this reddit spreadsheet has some info regarding that https://thatoneprivacysite.xyz/) with an operating system that supports it. the reason why this segues into OS hardening instead of a particular operating system is that I'm not aware of any linux distros that provide out of the box similar experience to windows while also offering anything close to the best security available. however I do want to return to your point that >If you want no telemetry avoid anything from canonical (ex. Ubuntu) and red hat. They are corporations Ubuntu comes ootb with apparmor which is a security software that essentially controls narrowly the permissions each application has, so that vulnerable applications don't compromise the whole system. its called Mandatory Access Control (MAC) and red hat does this with SELinux, and android has something similar. all of these make for a considerably more secure system than windows whose MAC solution, MIC, is organizing software into only 4 security levels.

>>22259 Anything that runs SELinux and doesn't run glibc or systemd, so Hardened Gentoo or LFS

I think when you maximise security you inevitably give up usability. If I could hit a reset button on two decades of Internet activity I'd do a lot of things differently, but right now Mint is my general, normal person system, and my security is more focused on encryption and proper data storage than anything else. Use Tails or whatever, but use a password manager and encryption software too,

>>23932 So Hardened/SELinux is functional using Musl and LLVM instead of glibc? What's wrong with it?

>>23678 >Fedora >Unlike Debian and some other distributions, Fedora has not historically invested in reproducible builds. >https://fedoraproject.org/wiki/Changes/Telemetry#Privacy-preserving_Telemetry_for_Fedora_Workstation Honestly suspicious or is there a good explanation?

just use whonix in a vm and only use it when you actually need security your metal os doesnt really matter since its going to be connected to you in some way no matter what

Qubes is the most secure. It's also very picky about hardware and a pain in the ass for an average user to get installed and working. Btw, if you don't like systemd in Debian on Qubes, why not just use Devuan or MX Linux on it instead? The average Linux user with the average hardware and average skill and average masochism in fighting with installation would probably find Whonix way secure enough. It's more secure than Tails, and Tails isn't even suitable as a daily driver. So IMO for the ultimate, Qubes, sure, but for something still very secure and a lot easier to deal with, Whonix. And Tails on a usbstick for occasions when you're out and about using other computers.

what do you guys think of splitlinux?

>>26261 Seems pretty neet, I'll give it a look lain, not investing too much since it seems the author is no longer updating it...

>>26262 theres not much to update its just a layer on top of void

>>26261 looks very cool, but also wonky as hell. might try it out on a cheap laptop and see how well it compares to, for example, QubesOS

I'd learn how to use OpenBSD, It's quite similar to Linux. QubesOS is probably overkill unless you're hacking into the Pentagon. Well, you asked for most secure I guess.

Secureblue is quite good. It's based on Fedora but with added hardening. It's way better than Kicksecure. https://secureblue.dev/

>>22259 Kicksecure they are making great strides, soon they will have a GUI for selecting browsers you want to install. They also are implementing a better RAM wipe then tails in the works. https://www.kicksecure.com/wiki/Dev/browser-choice https://www.kicksecure.com/wiki/Dev/RAM_Wipe

Ubuntu. Literally no one will bother. They'll see your blog posts about how you ditched Windows because it's proprietary bloat and spyware and how open source is so cool and superior, and they'll leave you alone.

the distro that you make for yourself

QubesOS if you have the required RAM to be able to run it (with multiple VMs). >>26309 Linux From Scratch is actually less secure because you won't get security patches as quickly as you would get on a properly maintained distro (Gentoo, Arch, OpenSUSE, Lubuntu, Fedora, Debian ...)

>>26270 Do you have any good video resources for using OpenBSD as a desktop OS?

>>26341 Why would you specifically say Lubuntu and not Ubuntu and derivates / *ubuntu ?

>>26346 I use OpenBSD as my primary desktop PC. There's no resources required. During installation you'll be asked if you want X started by default. If you say yes, the system will boot to Xenocara's graphical login manager and you'll get an fvwm2 desktop when logging in. See https://www.openbsd.org/faq/faq11.html

The goal: make forensics recover less valuable data if compromised during use. Put a vault.img in boot. Make it hold keyfiles to encrypt root and vm.images insm"ide When in use, open vault in initramfs, use cryptroot key to unlock root partition, close vault. On boot, open vault.img to unlock a vm.img (work/fun/development), close vault. Use different tty for different vms, or even use no vm to work with multiple vms or the system. Only one cryptographically secure passphrase needs to be remembered. The vault or /boot can be put on a separate USB stick so that it is always with you.