Which Fedora distro is more secure?

goskm75f

Workstation or Silverblue?

TheGodfather

goskm75f

No significant difference in terms of security

CyberOtter

goskm75f Silverblue is more "secure" in the sense that it protects from the user messing up the base system.

This guide might help you for choosing a linux distro:
https://www.privacyguides.org/en/os/linux-overview/

goskm75f

TheGodfather Thanks

Scott

TheGodfather No significant difference in terms of security

I am very much surprised by this statement. Why? Please details

missing-root

Scott why should it be more secure?

Also note that the rpm-ostree system is used on more than just Fedora Silverblue. The desktop versions are called "atomic desktops" and there are KDE variants and more too.

There is also uBlue with Aurora, Bazzite and Bluefin (which are all not more secure) and Secureblue, which has issues but is the most experimental and sophisticated security hardened Linux distro I know, also based on Fedora Atomic Desktops.

TheGodfather

Scott

It is not at all immutable in the sense of Android. It has no good security model which tries to protect it during runtime and is not properly verified during boot time. Silverblue is just like a "normal" mutable distro with all its security shortcomings, which is why I would consider it similar secure as Fedora Workstation.

Scott

missing-root and Secureblue, which has issues but is the most experimental and sophisticated security hardened Linux distro I know

what issues?
Can you name them?

DirtyDan

missing-root would you (or anyone else reading this) say that the universal blue images (Aurora, Bluefin, Bazzite) are less secure than the official Fedora atomic distros like Silverblue and Kinoite? The ublue images definitely have very tempting usability perks and would require a lot less tweaking for a normal/noob user like me.

I tried installing SecureBlue in a virtual machine, but as you mentioned in another comment, it quickly turned into a headache as may security features are either non-optional or not easily disabled by a noob user like me.

Would you recommend something else - something that is similar to grapheneos where it's private, secure, and usable? I'm currently using Windows 11 Education using a local account that I tried to harden following some guides.

missing-root

Scott the admin is a bit strange, and they do opinionated changes like uninstalling Firefox.

In contrast to GrapheneOS, security is not that optional with secureblue. For example the Firewall will give you headaches, and you cannot use the secure Fedora Firefox.

This is being worked on. I personally applied many changes on a vanilla Fedora Kinoite, as they are often useful. Like disabling kernel modules, switches to toggle services, hardening kargs or bubblejail.

missing-root

DirtyDan

Secureblue is a monolith. They are the only project I know that implement EVERYTHING

flatpak hardening
hardened malloc
kargs, motd for kernel hardening
custom SELinux rules to isolate processes that spawn user namespaces
custom packages not in fedora (hardened chromium, bubblejail, pam authramp)
hardening of DE things (xwayland, extensions etc)
hardeninf of various system components
just shortcuts that include a ton of things

There is no good alternative. The issue with Firefox being removed is due to an issue in bootc/ostree. You cannot reinstall packages that where previously removed.

Some things like the fully locked down firewall are a pain too. It makes things really complicated. There should be a switch to reset it to fedora defaults.

I personally run direct Kinoite, with kargs, motd, additional packages and some hardening. But it is not complete at all.