33
How do you guys harden your systems or make them more privacy oriented? (lemmy.dbzer0.com)
submitted 3 days ago by to c/nix@programming.dev
9 comments fedilink hide all child comments
 

The responses don't have to be strictly NixOS or Linux specific as I expect the general process to be very similar.

I never hardened a system before so I'm not sure what things I should be focusing on and what solutions are out there. I'm hearing a lot good on SELinux and apparmour but but those sadly aren't supported on NixOS. Recently I set up adguard home with somewhat strict blocklists and SearxNG to take control over my web searches. In the coming days I intend to set up wireguard and a VPN in my config and I also have some firefox extensions for blocking ads, trackers, JS, port scanning, etc. but it all feels surface level and I don't know where to take things from there. What are you guys doing with your setups?

Usually I prefer to never ask questions and look things up myself but reddit will soon block everything with a login wall and that's where I get most info from so I'm finally giving it a shot. :p

all 10 comments

sorted by: hot top controversial new old
[–] 10 points 2 days ago

i love that, for homelabbing, NixOS does a lot of secure things by default. firewall ports are opened explicitly and declaratively and services run under their own user with their own data directory. everything, even on the same local machine, communicates over HTTPS.

also, IMO the way people should have been running agents from the beginning: agents get their own user and a pared down list of tools and specific directories with specific read/write access and their own git clone of whatever code i’m working on (i hate working on the same files as an agent). (running a local Qwen 27B with Hermes)

other than that the normal stuff like fail2ban, random SSH port, VPN for remote access, Adguard, etc.

  • permalink
  • fedilink
  • source
    •
    • load more comments (-1 replies)
    [–] 7 points 2 days ago

    I am also interested in this. I like that the execution of binaries is tied to the nix-store, but I am sure there are some things to be done to harden it further.

  • permalink
  • fedilink
  • source
    •
    [–] 4 points 2 days ago

    https://github.com/buildplan/du_setup

  • permalink
  • fedilink
  • source
    •
    [–] 6 points 2 days ago* (last edited 2 days ago) (4 children)

    Impermanence

    Edit: sorry I didn’t link. It has been an incredible overnight upgrade to security for me. I have all of my stateful directories LUKS encrypted and copying on write to a btrfs subvolume that gets cloned over at boot to each time and as a result, I have a minuscule attack surface. On top of that, all of the machines on my network are fully impermanent and write their state to a local NAS. It’s pretty elegant. I highly recommend rehearsing the switch to impermanent via a QEMU VM and not fully making the switch until your data is backed up.

    I did a rehearsal on my home directory that took a few iterations to catch all of the files I needed to declare. A diff on the two btrfs directories each reboot made that fairly easy. I wish I could share the config but it would dox the shit out of me!

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 4 points 2 days ago (3 children)

    Mind expending on that a bit, even if just a link to more info?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
    • [–] 2 points 1 day ago

    Reboot them once in a while

    Switched to stable to get my system to fucking build and boot again, so I can get all the fixes

  • permalink
  • fedilink
  • source
    •
    7 comments in c/privacy@lemmy.dbzer0.com view that post
    [–] 10 points 2 days ago (1 child)

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 8 points 2 days ago (3 children)

    Encrypt your computer (which will make it harder for someone to get into it). Use more complex passwords (lowercase, uppercase, numbers and symbols). Use open-source software (or at least the ones that are fully offline / can turn off tracking). Using physical devices (not bluetooth) where possible (as someone could be nearby and see that you use that brand of mouse). Turn off microphone and camera when not using it (physical switch is better, if possible).

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
    • [–] 4 points 2 days ago

    switch to temple os

    /s

  • permalink
  • fedilink
  • source
    •