Arch Linux

Cyberpunk_Is_Bae

Member

Registered: 2020-03-23

Posts: 36

Overviewing Attack Surfaces

Hi, thanks for your time.

As I move deeper into Linux I like it a lot.  But there's still a lot I don't know.  I'm looking at systemd and my window manager's startup processes, but I can only imagine how many other methods of attack exist in a system as complex as Linux is.  Can someone help me start to understand where and how to audit things from a security perspective?  I already employ

arch-audit

and run

clamav

against new files if they are complex or executable.  I don't know what other steps to take, but really, I'm not looking for security or privacy right now, but transparency.

I would like to be able to "see through" what is happening. 

ps aux

is nice and the system monitor GUI tools are good too, so is

nethogs

but I just feel completely disoriented and buried by the newness of it all (versus the avenues of vulnerabilities where I would commonly see things in windows and which were auditable with services.msc and msconfig and so on).

Again, I don't expect one thread to give me all the hardening guides at once.  I'm really just looking for transparency in as great an amount as I can get a hold of it.

Thanks for any help.

Last edited by Cyberpunk_Is_Bae (2020-04-09 05:58:08)

sabroad

Member

Registered: 2015-05-24

Posts: 242

Re: Overviewing Attack Surfaces

I'm not looking for security or privacy right now, but transparency.

A good start is to know what's changing on your system (in order of increasing difficulty/complexity):
https://wiki.archlinux.org/index.php/Etckeeper
https://wiki.archlinux.org/index.php/AIDE
https://wiki.archlinux.org/index.php/Audit_framework

---

--
saint_abroad

Head_on_a_Stick

Member

From: The Wirral

Registered: 2014-02-20

Posts: 9,003

Website

Re: Overviewing Attack Surfaces

I just feel completely disoriented and buried by the newness of it all (versus the avenues of vulnerabilities where I would commonly see things in windows and which were auditable with services.msc and msconfig and so on).

The systemctl(1) command is the Arch equivalent of services.msc (or more specifically the sc command) & msconfig — use the cat option to view individual unit files and list-unit-files --state=enabled to see all enabled services. The man page is very comprehensive and well worth a read.

And in respect of security issues try

systemd-analyze security

Append the name of a specific unit file to see a detailed breakdown.

---

Jin, Jîyan, Azadî

xerxes_

Member

Registered: 2018-04-29

Posts: 1,073

Re: Overviewing Attack Surfaces

I believe this is rather for servers (where security is more important) then for desktops (where flexibility and compatibility is more important), but you may read:
https://www.ctrl.blog/entry/systemd-ser … ening.html
https://www.ctrl.blog/entry/systemd-ope … ening.html