Is firewall or SELinux needed for my personal laptop

[luoleicn]

Hi, I have to say I know little about Linux security, while I used windows , Kaspersky sometimes tells me that Kaspersky stopped an attack from Internet, i think maybe I need a firewall on Linux, too, but some guys told me if I keep my Linux up-to-date, it will be OK, I don't need anything. So I'm confused

[Mike Hunt]

A firewall is a good idea. There are a bunch of links to Gentoo iptables here.

It is unlikely that you would need selinux unless you know that you need it and why.

[d2_racing]

And you have these 2 :

http://gentoo-quebec.org/wiki/index.php/Utilisation_de_Iptables_pour_un_seul_ordinateur
http://gentoo-quebec.org/wiki/index.php/Utilisation_de_Iptables_pour_un_seul_ordinateur_mode_parano

[kernelOfTruth]

je crois que francais est un peu compliqué pur quelqu'un de Chine ?

I think english would be better understandable for the poster
_________________
https://github.com/kernelOfTruth/ZFS-for-SystemRescueCD/tree/ZFS-for-SysRescCD-4.9.0
https://github.com/kernelOfTruth/pulseaudio-equalizer-ladspa

Hardcore Gentoo Linux user since 2004

[aCOSwt]

[cach0rr0]

so...basically, SELinux isn't really a *bad* idea (even though I think grsec is a vastly superior, and spender from grsec has ripped selinux a new ass repeatedly), it can just be a bit cumbersome to get working effectively on a machine that's going to be serving as a desktop or laptop. X and the miscellaneous GUI apps introduce a good many challenges.

SO, it depends largely on if you want to deal with a bit of pain getting things set up, just to protect a laptop which really isn't going to be attacked in the same fashion a server might be.

Before you decide to go through the route of building a ridiculously hardened system, you should understand the potential attack vectors.

With a laptop, unless you have something that's actually listening for an incoming connection from the outside world, what is the point of running any sort of firewall?
As well consider the limited ability of a firewall to block connections that you've initiated, and the hugely granular ruleset you'd have to have.

Personally - I don't see a point in running a firewall on a laptop. A server yes, a laptop no. Nothing is going to be connecting to my laptop anyway unless *I* initiate the connection, since I have nothing listening.

Verdict: firewall on laptop == pointless. You may use iptables if you need to do any funky routing, but none of my laptops will ever have a need for iptables.

Now, in terms of RBAC, running a hardened kernel, that sort of thing. It is not a BAD idea at all - it's just reasonably painful to get things working, and you are going to be limited in the apps you can run because far fewer desktop apps are going to play nicely with a hardened kernel+toolchain. You get to the point where you're spending so much time *relaxing* restrictions that are enabled by default (e.g. paxctl'ing half your bloody binaries), begs the question - am I still experiencing any of the advantages of this?

I have run servers under Gentoo Hardened for years (pax+grsec+grsec RBAC). Only once have I run a desktop under Hardened, and it proved to be such a huge pain I vowed never to do it again.

Some people are paranoid enough to do it - personally I'm less worried about my laptop being hacked/infected, than I am about it being stolen and someone getting information off of it. For this reason I have shit tonnes of crypto on here, enough to where even a chunk of government agencies are going to struggle.


Summary Verdict:

firewall == pointless
hardened == painful, not inherently a bad idea, but painful
disk crypto == absolute must
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash

[d2_racing]

[Mike Hunt]

[aCOSwt]

[fangorn]

To make things more clear:
As long as you are behind a router of any kind while connecting to the internet you are pretty safe, even without a firewall. Behind a router you are not directly accessible from the internet. So a firewall could only block accesses that are not happening. Problem starts when your router forwards ports to your box. But then a firewall can't do anything either, because else you could not use the port (for ssh access for example). But that is a more advanced topic.

If you are connected to the internet directly (for example through a modem/cable modem/university network/...) and therefor are reachable by any box around the world, you will have to take care of listening programs yourself (aka build a firewall).

Wireless access points usually are behind a router for internet access, so you are accessible only from participants in the same wireless network. It is up to you how much you trust them and you have to decide if you need a firewall there and then.

Selinux is another topic. It cannot hurt when setup correct, but when done half hearted you will be misguided in a false feeling of security and have security issues anyway. So do it or don't, but don't do it "a little".
_________________
Video Encoding scripts collection | Project page

[d2_racing]

I enable my laptop firewall when I am at an internet cafe, I don't want to be scan by unknown hackers when I drink my coffee

[cach0rr0]

[Mike Hunt]

cach0rr0,

Don't you get any brute force attacks on port 22 ?

[d2_racing]

This is my answer to brute force ssh attack :

[aidanjt]

[cach0rr0]

[Mike Hunt]

Cool, nice explanation. Thanks

[d2_racing]

In fact, thanks

[depontius]

[whitemist23]

Firewalld is well defined for systems administration where SELinux is intended for processes. SELinux can decide whether an interaction ought to talk over a specific port or not, however the firewall is worried about how to manage the actual traffic on that port/interface

[Goverp]