What to use for a workstation/gaming desktop?

leafnose

archbtw
Well, devices with ON/OFF switches and eject push buttons do exist, mostly 5.25 bay devices. And as far as I know, depending on the performance you want, you’ll need to connect it with OCuLink.
Regarding PCIe cards, with some models, you can remove and insert the SSD from behind the case, no need to open the case.

Sigismund

leafnose Well there's framework with swappable (obviously not hot swappable) bay drives, which is used by some for this very purpose.

archbtw

leafnose

It's not a bad idea honestly.
I'm thinking if it's going to make secure boot less secure though, since both of the system's secure boot keys would be enrolled

leafnose

Sigismund
What do you mean? I was not saying otherwise. Do you have an example?

archbtw
I can’t answer that for now, tell me if you get any more info.

BeepBeep

I've thought about getting a Steam Deck of some kind to solve this problem.

I'm still new to Linux. Can anyone recommend a thorough Linux securitization guide/checklist? I've used a couple I've found online, but I don't know what I don't know.

archbtw

BeepBeep

Soo, as far as what I plan to follow, there is the fedora secure guide standards https://static.open-scap.org/ssg-guides/ssg-fedora-guide-standard.html.

There is also https://madaidans-insecurities.github.io/linux.html#hardening but I find that it's quite biased for a lot of things

archbtw

Sigismund

Umm, you just did that.

Also, how can someone use an OS "so hard"? You use a computer, and doing that you automatically use the os, this doesn't make sense.

indigomadelin

Windows has a built-in AV, but Linux doesn't.
Windows comes with lots of preinstalled bloatware, but Arch doesn't.
Windows has UAC (secure desktop) to prevent other apps from keylogging your password, while sudo doesn't offer the same protection.
Windows is harder to configure because of its many components, whereas Linux is easy to automate since everything is just a text file.
Windows has attack surface reduction templates (powershell.exe Add-MpPreference) to prevent common malicious techniques, while... well, Linux has some sysctl configs.
Windows has WDAC, Linux has AppArmor.
Windows has a bug bounty program, but Linux is open source.
My comment is useful, but others irrelevant.

archbtw

indigomadelin

I am going to use clamAV
I will replace sudo with does, and even though that only reduced the attack surface slightly, I won't give sudo to anything untrustworthy of course. It's quite rare having to use sudo for apps anyways.
I am using wayland, so hopefully no keylogging without root access.

Sigismund

indigomadelin My comment is useful, but others irrelevant

indigomadelin ClamAV, chkrootkit, rkhunter are a joke

Damn, you're full of yourself aren't you laddie? Not only your posts are incorrect but are blatantly full of crap.

indigomadelin Windows has UAC (secure desktop) to prevent other apps from keylogging your password

No. This has nothing to do with passwords. You may want to read up on what UAC does.

indigomadelin Windows is harder to configure because of its many components

Again made up statement.

indigomadelin Windows has attack surface reduction templates (powershell.exe Add-MpPreference)

First of all ASR is not part of default preinstalled defender, second the command you shown has nothing to do with ASR. Again read up on what you paste...

indigomadelin Windows has WDAC

Which is part of windows server and requires admin center. Hardly usable in this context.

indigomadelin I'd recommend looking for an EDR like Wazuh or Falco.

You read something somewhere and think you know it all, don't ya? I'd recommend you first configure and harden some systems before going to lecture others. Your posts are full of made up statements.

indigomadelin

archbtw
I think you've already heard of userland rootkits
https://github.com/Aishou/wayland-keylogger
ClamAV, chkrootkit, rkhunter are a joke. I'd recommend looking for an EDR like Wazuh or Falco.

archbtw

indigomadelin

Would it work even with a sandboxed app with flatpak?
I mean yeah, if the malware has the same access as the user (meaning it would come from outside of flatpak), it can just put the LD_PRELOAD for the launchers all those apps, that sucks.

But if anything malicious has unsandboxed access to the user, then I'm screwed anyways, so it's better to make sure it doesn't happen, and doing regular auditing with tools like lynis.

indigomadelin

Sigismund Damn, you're full of yourself aren't you laddie? Not only your posts are incorrect but are blatantly full of crap.

No, I am 100% right.

Sigismund No. This has nothing to do with passwords. You may want to read up on what UAC does.

For example, Veracrypt and Keepass utilize secure desktop in the same manner as UAC to prevent keylogging.

Sigismund First of all ASR is not part of default preinstalled defender, second the command you shown has nothing to do with ASR. Again read up on what you paste...

No, it's available by default. My powershell example is absolutely correct

powershell.exe Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
powershell.exe Add-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled

Official docs https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#asr-rule-modes
Learn powershell before logging into the forum

Sigismund Which is part of windows server and requires admin center. Hardly usable in this context.

No, it works on Windows 11 and doesn't require admin center. You just need to read the docs and learn powershell.

indigomadelin

archbtw it doesn't matter whether the app is sandboxed or not, the rootkit hooks to Wayland.

archbtw

indigomadelin

But the rootkit first needs to leave the sandbox to hook into it and set the preload library.
It requires user-level access to the filesystem. Which a sandboxed app won't have if you set permissions right.

indigomadelin

archbtw I'm not a C developer, so my explanation might be wrong. The userland keylogger rootkit that uses LD_PRELOAD env variable acts as a proxy between an app and the Wayland C library utilized by the app. Therefore, it doesn't matter whether the application is sandboxed or not, because the rootkit is already outside of the sandbox, it's preloaded.

TheGodfather

indigomadelin

I don't see how this attack would allow keylogging from one sufficiently sandboxed program to another. The following should not be fulfilled in this case:

Requirements:

Inject an environment variable to each attacked program.

archbtw

indigomadelin

Yes, if the rootkit is already outside of the sandbox then sure. But it first needs to get out of the sandbox, unless you get the rootkit from software which is outside of the sandbox in the first place.

« Previous Page