Security threats Toolkit

Story: Ten tips for securing Linux desktops

• 
• 

putting /home in its own partition means nothing

if you put /home on its own partition doesnt remove any threats and in actuality, the only reason why /home should be on its own partition is to prevent any personal data from being corrupt from any system crash. that is the only reason why /home should be on its own partition. now, /home SHOULD have its umask set to 0002. this would prevent other users from `cd`ing into other peoples home directories.

/tmp should be on its own partition AND mounted as noexec, this will prevent arbitrary code from being executed from the tmp directory. the only problem to this is, if you want to install third party bin packages, you will need to remount the tmp directory with exec rights. but, afterwards, just remount it noexec and everything is back to normal.

setting up /tmp in the first place would require one to not be scared of modifying /etc/fstab and also to remount it when needed, the user should be comfortable with the command line and reading man pages (which is always a good practice).

also to note on #2, putting a "." in front of the folder/file name in a file manager will not make it hidden, this must be done in a command line. to do that, just use the mv command.

mv foo .foo

that will make it hidden. when you rename a file in a graphical file browser, it would be the same as doing...

mv foo \.foo

which would make it think that the "." is supposed to be at the beginning of the file name and not hidden.

for #3, complex passwords arent the way to go anymore. instead, passphrases are what users should be using now. the longer the phrase, doesnt matter if its all alphabet characters, it will still take MUCH longer to crack than if some special characters were put in a smaller password.

for #9, that is more of a security through obscurity practice and does not work. security through obscurity is a proven failed method of security. especially with the growing number of linux users, most linux users will know that if the desktop environment doesnt give them a terminal, that ctrl-alt-f1-5 will, of course, they will still need to know the username and password to get on, but that is another issue of security.

• 
• 

• 
• 
• 

Full Talkback thread