A good main system with security in mind?

Hello, I use tails from time to time but I would like to use all my communications by default. * BSD systems have a good reputation for security, but they are not usable in my hardware (modern hardware) and they do not give me the advantages of using a linux based system. I am thinking of using debian as the main system along with a very restrictive firewall and tor Is this configuration safe enough? Thanks.

>* BSD systems have a good reputation for security this is only true for OpenBSD, as FreeBSD pales in comparison and NetBSD doesn't exist. >debian as the main system as I fan of Debian, I wouldn't recommend it if security was the #1 priority. their official forums http://forums.debian.net/ lacks TSL. speaks volumes. also no option for apt via TSL. some people claim "that's no issue" since "that's not sensitive information" but it really is, since it helps see exactly what kind of software you're running. this is true even though apt's signature mechanisms prevent package tampering. in any case: not tunneling internet traffic is utter nonsense. then they have systemd with controversial DNS fallbacks to 600613. Xorg as root by default. no automatic updates by default. et c. if you do choose Debian, make sure you pick the stable branch and a minimal install. >a very restrictive firewall there's nothing about firewalls that makes it "very restrictive" beyond the minimal sane configuration: block all incoming. tailored whitelists for traffic out on an application & protocol basis - as this will prevent occasional 0day remote code executions from calling home unless they have root. >Is this configuration safe enough? safe enough for what? you need to define what you wish to protect yourself against in order to settle this.

Thanks for response. I want to use tor as the main browser, and I am looking for a system that allows me to have something relatively stable and secure. I thought I would choose debian for several reasons: 1) It is quite stable 2) It is quite clear on its website about security notices 3) I can do a minimal installation from where to build my own system I have used arch for a long time but it is a joke in terms of security.

>>6227 BSDs are perfectly usable on modern hardware. See: https://www.openbsd.org/plat.html. Their driver support might be worse, but there are usually workarounds for that. >>6228 TLS, not TSL. If you're going to pick a hill to die on, choose one that you can remember. Xorg running as a user is actually a relatively recent development, is not the default on most *nixes, and comes with teething problems - however, given it is a mechanism for a number of priv-escs historically, I see where you're coming from. >>6232 I am unsure how Arch is more of a joke than Debian. In fact, I'm unsure what you're even using as a metric of security. I'm also unsure what you're actually aiming for here, except for some kind of Tor LARPing. Your jerry-rigged installation will not have comparable anonymity provisions to Tails - Tails transparently proxies all traffic through Tor in order to prevent leakages. It's been a while, but I'm fairly sure Tor explicitly states somewhere to NOT use the Tor Browser as your day to day browser. Now, that said... Debian is stable, yes, but it's also slow as a dog, and lacks any proper modern security feature (Grsec, AppArmor, etc). If you want something modern and stable, install CentOS, read up on hardening with SELinux. It provides MAC, RBAC, along with integrity checking (i'd prefer to recommend Grsec, but spender had a temper tantrum). Sandbox any programs that reach out to the internet at any point, or run them in single-use virtual machines (Qemu can be used for this). I'd recommend that whatever you run in those virtual machines be something stripped-down, too - a very minimal Linux with Musl or Diet instead of glibc, for example. You mention security notices - you want to avoid playing update catchup with a vanilla system with public exploits available. You want to be doing as much as possible to increase the difficulty of exploitation generally, on top of everything else.

>>6233 >TLS, not TSL. indeed. that's not the first time I've wrote it like that, and certainly not the last. it's most likely a product of transitioning from "SSL". >Arch vs Debian semi-bleeding rolling release cycles vs older and more stable and reliable packages. it's not really a controversial paradigm. >Debian is slow never noticed this, or even heard of the notion. I go from the LUKS screen to XFCE login in about 2 seconds with an SSD. Python scripts are still slow, and C programs are still fast. haven't noticed much of a difference compared to other modern OS's. >>6232 right. if you're looking for something that "just works" then Debian is a wise choice. note that you're already deep down a bunker in terms of digital security running linux, compared to the general population. you should still try to define what you wish to protect yourself against, as this will guide you in terms of countermeasures. I wrote a server hardening guide specifically for Debian, but it was quite some time ago. that was on behalf of a company though. most private users will spend lots of time setting up extremely secure servers and workstations for no good reason at all. I wouldn't use Tor all the time either, and would preferably just connect to a small VPS for VPN and DNS. note that if you care about surveillance, public VPN's are not reliable. you're better off creating something for yourself with paranoid++ settings. https://arstechnica.com/information-technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ https://theintercept.com/2018/08/15/nsa-vpn-hack-al-jazeera-sidtoday/ (PS: remember that the NSA isn't more intrusive than any other surveillance agency - it has just gotten flak for doing what "an agency in a democratic country isn't supposed to do")

>>6233 If your wireless card isn't supported by OpenBSD, just drop the $15 on one that is supported. If you have access to another laptop, you could even swap the wireless cards, and that's free.

>>6227 you can basically use every well maintained distro and harden it. just look it up.

note that two of the three world-class security/privacy distros, whonix and tails (qubes being the third), are based on debian. kali linux is also debian-based, but that's a pentesting distro rather than a defensive one.

>>6404 I think this has to do with the popularity of aptitude rather than Debian's actual security potential.

>>6233 >and lacks any proper modern security feature (Grsec, AppArmor, etc). Can you elaborate on this? Grsec include things like PaX and ASLR, which Debian has. Do you mean Debian doesn't have a Mandatory Access Control system in the vanilla release?

>>6404 It might not be fair to count amnesic systems like tails. Qubes isn't tied to Debian last I checked.

>>6553 >Grsec include things like PaX and ASLR, which Debian has. Grsec and pax are 3rd party patches to the Linux kernel and are now only available commercially so obviously Debian does not include it. The upstream kernel has some weaker aslr which Debian may or may not enable. >>6233 >I am unsure how Arch is more of a joke than Debian. As far as I'm aware, for many years the package installation didn't have any kind of encryption so you could be trivially rooted by anyone on your network but that's obviously fixed now. The other thing is the AUR repository has little to no validation and malware has been discovered in the past. You can say AUR is optional but the official repos are so tiny it's not really optional for most people. >>6228 >this is only true for OpenBSD openbsd security is mostly just a meme. Make sure you actually understand what openbsd provides and compare it with what you need. >>6232 >1) [Debian] is quite stable The reason it's stable is because the packages are months, sometimes years, out of date. They make an effort to apply security related patches but not all projects announce security fixes as such so be careful.

Use Devuan, it's the very same, but stable and you don't have (((self-auditing))) security hole corrupting whole GNU userland. systemdick

>>6573 >Use Devuan, it's the very same, but stable and you don't have (((self-auditing))) security hole corrupting whole GNU userland. systemdick There's nothing wrong with systemd. It's had like 3 security holes in the last 5 years? The Linux kernel has had more than that in the past 5 days. I've never encountered anyone who spreads fud about systemd or (((The Jews))) and actually knows what the fuarrrk they're talking about. Feel free to prove me wrong.

Look into QubesOS. It is designed with virtualization as the core concept, every program and activity can be run completely isolated from the rest. It has Whonix built in and you can choose to route the networking of any VM over Tor if you want to.

>>6581 psssh, you aren't supposed to point that out aloud... how else would they look like a l33t haxor?

>>6581 >b-but my GNU NPC dialogue You're right. Arguing how *good* systemd is happens to be another subject entirely. I don't really know as much as I'd like about it, though I do know it's a point of contention for some.