[Edited 2024-03-21] "Security, Privacy and Anonymity in Linux Mint" Guide.

[MikeNovember]

Hi,

I have written a PDF Guide: "Security, Privacy and Anonymity in Linux Mint".

Revision 26, dated from 2024-03-21, is online (160 pages, 5.3 MB)

You can download it and use it for free.

It is distributed under Creative Commons license, Attribution-NonCommercial 4.0 International (CC BY-NC 4.0), see: https://creativecommons.org/licenses/by-nc/4.0/.

List of changes:
Revision 26 changes: added to 4.7 "Safe Browsing" protection against JavaScript and CSS attacks; added a NB after DNS over TLS in 4.11; typos and minor corrections.
Revision 25 changes: updated 4.14 (Install Language Tool Server) and Annex 5 (How to Enable Ubuntu Pro on Linux Mint)
Revision 24 changes: added secure file delete in 4.1; added a workaround for LanguageTool extensions 8.3.0 bug in 4.14; added "Just Verify It" extension for Thunderbird in 5.1; small corrections and typos.
Revision 23 changes: added a new distant security attack and its prevention "Protect your LAN against wireless intrusions"; minor changes in Annex 10, updated Table of Contents and correspondence matrix.
Revision 22 changes: take into account of Proton VPN GUI 4.1.0.
Revision 21 changes: take into account of Proton VPN GUI 4.0.0 and add of its flatpak version, in Annex 10; minor additions in §5.2.
Revision 20 changes: minor corrections and additions in 4.11, 4.12, 5.1; typos.
Revision 19 changes: updated "5.1 Malware and viruses detection", some more blue internal links, minor corrections, typos.
Revision 18 changes: in Annex 10, added troubleshooting; some minor changes in 5.1; internal links are now blue and underscored; typos.
Revision 17 changes: in Annex 10, added tests results (DNS check, DNS leak, WebRTC leak).
Revision 16 changes: in Annex 10, completed uninstallation procedure.
Revision 15 changes: added Annex 10: Install and Set Up Free Proton VPN.
Revision 14 changes: added installation and documentation links for I2P and Freenet in "Stay anonymous".
Revision 13 changes: added LanguageTool extension for browsers and Thunderbird settings in "Install LanguageTool local server"; completed ClamAV unofficial signatures in "Malware and viruses detection"; typos, grammar.
Revision 12 changes: added a new local security threat and the corresponding prevention mean; completed "Malware and viruses detection" with Clamav detection rate increase, using unofficial signatures.
Revision 11 changes: in "Reduce what your ISP can know", added Proton VPN; in "Protect yourself from spam", added disposable e-mail addresses; in " Stay anonymous", added Anonymous mail; in "Proposed minimum backup and restore strategy", added comments about Timeshift.
Revision 10 changes: in "Safe Browsing", added Fingerprinting protection, Web RTC Leak and Testing.
Revision 9 changes: complements about Timeshift in "Proposed minimum backup and restore strategy", typos, small corrections.
Revision 8 changes: text formatting, added a "Threats / Prevention means correspondence matrix".
Revision 7 changes: completely rewritten "DNS over TLS" in "Reduce what your ISP can know", better and simpler method.
Revision 6 changes: in "Reduce what your ISP can know", added DNS over TLS, and complements in DNS over HTTPS; complements in "Annex 8: Mullvad Browser Flatpak on Tor Network, a Secure Alternative to Tor Browser"; improved text formatting; typos and small corrections.
Revision 5 changes: in "Use a firewall", added a comment about peer-to-peer software; in "Firejail", added tests of VMware Workstation Player and Firefox, and added recommendations; in "Don't use Wine or Mono to run Windows programs", added recommendations about virtual machine securing; typos and small corrections.
Revision 4 changes: in "Safe Browsing" changed the hosts update script to let ownership to root; in "Annex 8: Mullvad Browser Flatpak on Tor Network, a Secure Alternative to Tor Browser", added a paragraph on tor security; typos and small corrections.
Revision 3 changes: added "Avoid to have your personal data stolen", AppArmor complements and corrections.
Revision 2 changes: added AppArmor and Systemd sandboxing; small corrections, typos, and English grammar polishing.

Download link from my Google Drive:
https://drive.google.com/uc?export=down ... ZwlvnvXgMW.

Download link from my personal website:
[hosted by IONOS, servers in Germany, no ad, no malware, possible logging of your IP address by the service provider]
https://nallino.net/stockage/security/L ... curity.pdf.

It is also available from archive.org:
[new revisions may appear a bit later on archive.org]
https://archive.org/details/linux-mint-security

Privacy:
Privacy protection is addressed in the guide. But, before to download it, you can't apply the guide recommendations...
That's why I advise to use Tor Browser, https://www.torproject.org/download/, to download the guide from any of the three links with anonymity and good privacy, to avoid being tracked during this download.

Document hashes (using GtkHash):

Document detached signature "Linux_Mint_Security.pdf.asc":

Code: Select all

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQRTzGp+mYMDnyzU4tr+LoXO6oGV4AUCZfxcvQAKCRD+LoXO6oGV
4EqQAP9ni7Kng/MC1aXLOnuA7JU6UnvyM1C5kcDxZvIKkqxXMgD/WnMdslAXmylR
MeCiwF3ykBUfb+VPQc9lezraY75fLQo=
=P3Rs
-----END PGP SIGNATURE-----

My OpenPGP public key, to verify the signature:

Code: Select all

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZGtgqhYJKwYBBAHaRw8BAQdAyGMXTq2v4VKXrzKhxKR/Tpq3f9LPnQ88uSai
hbcjqDW0I01pY2hlbCBOQUxMSU5PIDxtaWNoZWxAbmFsbGluby5uZXQ+iJkEExYK
AEEWIQRTzGp+mYMDnyzU4tr+LoXO6oGV4AUCZGtgqgIbAwUJA8OU9gULCQgHAgIi
AgYVCgkICwIEFgIDAQIeBwIXgAAKCRD+LoXO6oGV4JLEAQCYZPht3cFpSnhfJrfe
5Z1uP9E+3xq4kCnjgHRbbuFlfQEAt/9RZqXmkDFWIAlXAcn7YL9KUrsXswL1JQ5w
m8Hc+A+4OARka2CqEgorBgEEAZdVAQUBAQdAbOSfFPQiRLYmkI2gE+4X7ScoRe8w
nvdWcL8Klu+/NEADAQgHiH4EGBYKACYWIQRTzGp+mYMDnyzU4tr+LoXO6oGV4AUC
ZGtgqgIbDAUJA8OU9gAKCRD+LoXO6oGV4AlqAQCUeks96SnIRwa65GRE5E44zefK
o7P5A0YM9kJTMXKG7wD6AtzTLdYBWxonOENQZjR0MjANM6RfO4yUWBaB1F33Yww=
=4iOH
-----END PGP PUBLIC KEY BLOCK-----

VirusTotal test report:
https://www.virustotal.com/gui/file/897 ... ?nocache=1.

Use of this guide:
It contains a list of threats; if you feel concerned by a threat, you can find in the correspondence matrix, at the end of the guide, the corresponding prevention means.
[If you are a physician, a lawyer, a journalist, a small company, an activist, a whistleblower, or a cryptocurrencies owner you may feel concerned by all threats!]

Table of Contents:

Table of Contents

1. Introduction

2. Ubuntu Main Security Features

3. Threats List
3.1 Local security attacks, needing physical access to computer
3.2 Distant security attacks
3.3 Various security threats
3.4 Privacy threats
3.5 Anonymity threat

4. Prevention
4.1 Protect the access to your computer
4.2 Update your system
4.3 Increase your system intrinsic security with Ubuntu Pro
4.4 Use trusted sources
4.5 Use a firewall
4.6 Sandbox your applications
Flatpak
Snap
Firejail
AppArmor
Systemd sandboxing
4.7 Safe browsing
4.8 Be careful with downloaded files or attachments
4.9 Don't use Wine or Mono to run Windows programs
4.10 Set your system security
4.11 Reduce what your ISP can know
4.12 Protect your mails
4.13 Protect yourself from spam
4.14 Install LanguageTool local server
4.15 Use local translation programs
4.16 Avoid to have your personal data stolen
4.17 Stay anonymous
4.18 Protect your LAN against wireless intrusions

5. Detection
5.1 Malware and viruses detection
5.2 Intrusion detection

6. Pre-Established Arrangements
6.1 Elaborate a recover strategy
6.2 Backup and restore strategy
6.3 Proposed minimum backup and restore strategy

Annex 1: Launching Commands and GUI Applications with Superuser Rights
Annex 2: Password Protect your GRUB Menu
Annex 3: Password Selection
Annex 4: Encryption
Annex 5: How to Enable Ubuntu Pro on Linux Mint
Annex 6: Flatpak Tutorial
Annex 7: Multiboot
Annex 8: Mullvad Browser Flatpak on Tor Network, a Secure Alternative to Tor Browser
Annex 9: Tripwire Tutorial
Annex 10: Install and Set Up Free Proton VPN

Threats / Prevention means correspondence matrix

Feel free to comment, to improve next revision.

Regards,

MN

PS: Please avoid to open side discussions, this is the Tutorials forum, not a chat one.

[dorsetUK]

Feel free to comment, to improve next revision.

Regards,

MN

Thanks Mike.

Please don't take this nastily but I haven't laughed so much for quite some time.

[Moem]

I'm not going to download that... it's hosted on a Google drive and I avoid Google as much as I can.

[dorsetUK]

Hi,

I have written a PDF Guide: "Security, Privacy and Anonymity in Linux Mint".
(115 pages, 2.6 MB).

This Guide is hosted on my Google Drive.

Hi Mike, I've stopped giggling and this is meant constructively.

Point 1. "Security, Privacy and Anonymity in Linux Mint". (115 pages, 2.6 MB).

Actually, according to Google, it's "Linux_Mint_Security.pdf" and its 2.5 MB. Humorously - said the Nigerian Prince. Realistically, I'm not going to download something that varies - in two ways - from what has been recommended.

Point 2. As Moem said - it comes from a Google site. Personally, it's about privacy and anonymity and its author is signed up to a Google account.

Personally, Linux is - for me - perfectly safe and an IT professional was surprised at how anonymous I am, and I don't do anything special.

[Moem]

What is the maximum size of attachments to be posted in the forum?

For images it's 200Kb. Not sure about other file types but i expect it's the same.
It's not that I don't understand why you chose to host it with Google. It's just that no matter what your reasoning is, I'm not going to download it.

[Redit2]

I understand the Google thing and yeah that's a extreme paradox for sure, but his personal site that I chose, even with all the extra's I run showed not one hint of anything...zero. He obviously knows enough to author this so maybe I missed something but it appears to be worthwhile for this forum. Thanks for the effort. Caveat: If I do get a virus/malware, I'll take back my positive comments and send a thousand N Korean dwarfs to infect his computer

[MikeNovember]

[...]
Caveat: If I do get a virus/malware, I'll take back my positive comments and send a thousand N Korean dwarfs to infect his computer

Hi,

The probably you could get your computer infected with a virus is very low.

Regards,

MN

[rene]

He obviously knows enough to author this [ ... ]

You mean he can spell?

[Pjotr]

Come on, guys.... Mike took the trouble to share with you his views on, and how-to's for, improving security in Linux Mint. If anything, that was nice of him. He tries to help.

Even if some of you don't agree with some of his views, or with the way he shares them, give the guy a break. We should encourage people to participate in the Linux community, not scare them off....

[mmm]

MN - thanks for your tutorial.
I find it useful and interesting.
I didn't know uBlock Origin could be added to Thunderbird.
And you give a good description of flatpak.
You are very much against dual-boot with Windows 10 - and I have just had the problem you mention caused by a Windows update which prevented Mint form booting.
So I have wiped the drive and clean installed Mint 21.1 and now have no computers with dual-boot.
(https://www.hirensbootcd.org/ can help in an emergency need for a Windows program.)

Pjotr - on your Easy Linux Tips site you cover installation of Mint - but only dual-booting.
I never recommend that to someone new to Linux.
Might you consider a guide to single boot installation?

[Pjotr]

Pjotr - on your Easy Linux Tips site you cover installation of Mint - but only dual-booting.
I never recommend that to someone new to Linux.
Might you consider a guide to single boot installation?

That's something I need to think about....

[karlchen]

In case you need a template, on which to base such a tutorial: Linux Mint Installation Guide

[mmm]

MN - How did you learn computing and security?
Because clearly your learning method has worked well.

[MikeNovember]

MN - How did you learn computing and security?
Because clearly your learning method has worked well.

Hi,

I have been continuously using computers since 1975.

But this security Guide is not based only on computer knowledge:
- It is a security analysis of an operating system, with the 4 classical steps of a security analysis (threats, prevention, detection, arrangements).
- To perform this kind of analysis you need competences in system reliability (hardware, software, human interaction), functional and dysfunctional analysis, FMECA (Failure Mode Effects and Criticality Analysis) and security analysis.
- Computer knowledge is here to identify the threats, and to find means to be protected against these threats.

Regards,

MN

[Jerboum]

MN - How did you learn computing and security?
Because clearly your learning method has worked well.

Hi,

I have been continuously using computers since 1975.

But this security Guide is not based only on computer knowledge:
- It is a security analysis of an operating system, with the 4 classical steps of a security analysis (threats, prevention, detection, arrangements).
- To perform this kind of analysis you need competences in system reliability (hardware, software, human interaction), functional and dysfunctional analysis, FMECA (Failure Mode Effects and Criticality Analysis) and security analysis.
- Computer knowledge is here to identify the threats, and to find means to be protected against these threats.

Regards,

MN

I am not sure wanting to read a long text in english about a subject for which I have allready a good knowledge, but I would insist on some important things
- avoid wifi, and ban bluetooth, separate the connection between cell phone wifi on one side, and PC ethernet on the other side, never connect both together and even connect the phone on usb to the PC when PC connected to the internet
- check weekly if you have access to the router's interface and if the settings are kept (encryption level, DNS, upnp, wps, multimedia disabled etc firewall enabled)
- the best is to restore a snapshot of the system as often a possible, too
- when you connect the phone to the wifi, check that it is the good connection, MAC address, DNS etc the only or few devices set and allowed in the routeur
- I personnaly avoid to let the system connected to the internet more than the minimum when proceeding to some updates, because in that time it is vulnerable as I know that all modification, wanted or not, will be written for a long time in the further snapshots ... you can do a monthly update in some few minutes, one or 2
- The advice I would give to a new linux user, is to disable the thumbnailing, and use Pix to view and deal with thumbnails because it put them only on RAM cache, put also the browser's caches on a RAMdisk

It is a synthesis of my view about security, I forgot probably the most important when it is generally well know by all ...
I have also a long former "security aimed" background, since let's say 2010, I even surfed the internet with Windows XP for years after it was theorically at high risk and without an antivirus, only a good firewall, and many services disabled, I used a tool called Stripmyrights too, to limit all process to non admin rights by default

[MikeNovember]

I am not sure wanting to read a long text in english about a subject for which I have allready a good knowledge, but I would insist on some important things
- avoid wifi, and ban bluetooth, separate the connection between cell phone wifi on one side, and PC ethernet on the other side, never connect both together and even connect the phone on usb to the PC when PC connected to the internet
- check weekly if you have access to the router's interface and if the settings are kept (encryption level, DNS, upnp, wps, multimedia disabled etc firewall enabled)
- the best is to restore a snapshot of the system as often a possible, too
- when you connect the phone to the wifi, check that it is the good connection, MAC address, DNS etc the only or few devices set and allowed in the routeur
- I personnaly avoid to let the system connected to the internet more than the minimum when proceeding to some updates, because in that time it is vulnerable as I know that all modification, wanted or not, will be written for a long time in the further snapshots ... you can do a monthly update in some few minutes, one or 2
- The advice I would give to a new linux user, is to disable the thumbnailing, and use Pix to view and deal with thumbnails because it put them only on RAM cache, put also the browser's caches on a RAMdisk

It is a synthesis of my view about security, I forgot probably the most important when it is generally well know by all ...
I have also a long former "security aimed" background, since let's say 2010, I even surfed the internet with Windows XP for years after it was theorically at high risk and without an antivirus, only a good firewall, and many services disabled, I used a tool called Stripmyrights too, to limit all process to non admin rights by default

Hi,

You should understand that you cannot, with some ideas on half a page, have the same content as a full guide.

You don't want to read the guide? It is your right!

You have already good knowledge in this subject? It's nice for you!

You are an expert of unmaintained Windows XP use to surf internet? We speak here of Linux Mint.

Regards,

MN

[Bolle1961]

I'm not going to download that... it's hosted on a Google drive and I avoid Google as much as I can.

Exactly, making a guide to privacy and the distribute it by google

[Jerboum]

Hi,

You should understand that you cannot, with some ideas on half a page, have the same content as a full guide.

You don't want to read the guide? It is your right!

You have already good knowledge in this subject? It's nice for you!

You are an expert of unmaintained Windows XP use to surf internet? We speak here of Linux Mint.

Regards,

MN

It is generally good to have another point of view ... as you said, Linux is not very oftenly attacked or infected so what value for the experience of a pure linux user ?

[MikeNovember]

[...]
It is generally good to have another point of view ... as you said, Linux is not very oftenly attacked or infected so what value for the experience of a pure linux user ?

Hi,

I have been using computers since 1975, so I am not "a pure linux user"!

And a security study requires computer knowledge, and other competences (see the text you quoted yourself).

Regards,

MN

[MikeNovember]

I'm not going to download that... it's hosted on a Google drive and I avoid Google as much as I can.

Exactly, making a guide to privacy and the distribute it by google

Hi,

It is also available from my website. Did you read my original message ? Or do you just quote other forumers posts?

And you misunderstand what Google Drive is: it is a 15 GB storage on cloud; when I connect, I need to enter my user and password; but when anyone downloads something from a link on a Google Drive, nothing is asked. And, if you are afraid with privacy concern, your can use Tor Browser (this is also explained in my message).

Regards,

MN