Honestly the biggest things are don't run shit as root and don't expose port 22. Especially don't run things you downloaded from some website as root but in general just don't run things as root. That'll handle most problems that are likely to arise.
this post was submitted on 15 Sep 2026
104 points (96.4% liked)
Linux
67631 readers
381 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
I'll also add that if you do enable SSH and are stupid enough to expose port 22, then at least make sure you have key-based authentication instead of password authentication and keep your keys safe.
don't get software from random sites and use your package manager with distro provided repo only
And if you need an app from a third party repo, pick one that includes at least rudimentary sand boxing such as flatpak/flathub
And if you pegleg some games, there's an ice cream-loving wrestler (or maybe some folk that just borrowed the id) that tend to bubble wrap their warez.
If it says no network access, my Wireshark says no network is being accessed. That's all the confirmation I got.
load more comments
(2 replies)
compartmentalization
top reasons why GrapheneOS is highly praised: ability to create different profiles with different encryption keys, and hardened codes.
on Linux, the top choice is QuebeOS. But i tried it 4 times and still couldnt go with it. My laptop couldnt handle quebeos...
The other choice is SecureBlue. I heard that is called the Graphene of Linux. They have hardened codes, secure browser and very strict secure defaults. The downside? You need to be able to use distrobox, flatpak, rpm-ostree, brew to maintain your apps. So in a way, it is the same compartmentalization, but a bit messy.
If u cant deal with these 2, then maybe use TailOS to do your download. Not sure if it saves the data?
Using VM is also great. But i think a "super VM" is the only answer and that is QuebeOS. You can literally control everything inside each VM.
is grahene just on phones or computer too
only on phone
but Secureblue, a Linux distro, really follows Graphene's security hardening stuff.
Take regular VM snapshots and never forget that exploits can breach the VM
very rare for exploits that can breach a VM. Like once-every-10-years kind of rare.
One important thing to be aware of. By default your VM will have access to the same network resources as the host. So, say, if you use tailscale or some other secure VPN to protect your NAS, but you give your host access, the VM will be able to access it too! You can use firewall rules or bridge networking to fix this, but tbh it isn't trivial.
Depends on your VM. qemu, by default, isolates each VM on a subnet. It's a PITA when you actually need the VM to be able to see the LAN.
It's been a while since I've tested the defaults, but if your VM has internet access it would also have access to the LAN right? From the perspective of the VM it's all the same, just sending requests to the router. Unless QEMU specifically blocks requests to LAN network ranges.
I'm not sure what the mechanism is, but I discovered the issue by empirical testing a few months ago, and I'm still trying to sort it out and make the LAN visible to that VM. Granted, I haven't been able to put much time into it, but I keep ending up down among the weeds of iptables/nftables, with all the documentation either out of date or not intended for a host using netifrc for network management (or both). I'll probably have to ask on the Gentoo boards eventually.
what do u do to stop it (before it happens) tho??
load more comments
(1 replies)
Pick a piracy site you can trust. It makes things easier.
I rather recommend torrents and download files named like "Rihanna.mp3.exe". This is to my knowledge the most secure source.
You’re totally right, the .exe stands for excellence. /s
You could make backups and practice restoring from them so you can not lose everything when you screw up.
You could learn not to screw up, which would go hand in hand with the above.
You could switch to a mac and enable all the security and privacy stuff in macos (there’s quite a bit, it’s well documented and very extensive!).
You could stop downloading from public sites and trackers and instead get on private trackers and use them exclusively.
1 does it take a lot of space usually?
2 how to do screw up (you need to screw up to learn how not to) and not get screwed with the consequences
3 thx
It either takes up a lot of space or it doesn’t. I don’t know how much you’re backing up or how much space is a lot to you.
You can’t screw up and learn without the consequences. That’s how you learn. Without the consequences you don’t take things seriously. Backups will help you to recover when you do screw up.
1 - there's 2 things to consider here... A) Your files (documents, photos, etc) B) Everything else (the Windows / Linux mac operating system, applications, your screensaver, printer defaults, etc)
You only need to backup A.
It's up to you if you want / have space for B
But, 1st time, backup everything. Then do item 2 (screw up) big time and do a full restore.
Once you've done that, you're set for life
thx
Malware could go to the router and spread absolutely. However other devices firewalls should be pretty good at stopping that. Also I dont know how common that is for malware tbh
load more comments
(1 replies)
Idk what software you're using, but most VM software has an easy way to take a snapshot of the VM state. If you're about to download something risky, take a quick VM snapshot, so if it ends up being some kind of malware, you can just roll the VM back to its earlier state without issue, takes like 2 minutes.
If you're worried about malware spreading through your network, you need to isolate your devices. The most common way to do this is with VLANs, but I don't know what your home network looks like, and if you just have a typical home setup with your ISP's modem/router and all your devices plugged into it or on the default wireless network, you won't be able to do that.
You could also use something like UFW on Linux to only allow internet traffic and block any traffic inbound or outbound to your LAN network, isolating your PC from all other devices on your LAN. This isn't great, because if your host is compromised, then your host-based firewall could also be compromised and the malware could then get out to the rest of your network.
You could invert this and have all your other devices on LAN set to block all traffic from your specific PC, which would be more secure, but also a pain to configure, plus it assumes all the other devices are able to be configured in that way on your LAN.
There are a bunch of other solutions, but it depends on your setup, your technical skill level, and your threat profile. If you're just torrenting cracked games and random software, that's somewhat risky, but not really that crazy if you are running it in a VM with rollback snapshots.
load more comments
(5 replies)
view more: next ›