Basic (non-paranoid) security

Question

Hi, everybody,
I've done a modest research on the forums. There emerged certain keywords, like iptables, chkrootkit,  rkhunter, tripwire, and snort. The question is: am I reasonably safe just running the Arch "as is"? If not quite, are there "fire and forget" security solutions?
I'm just an ordinary Internet user: firefox, ktorrent;
I don't live in the root account;
I don't build packages in the root account;
That's pretty much it. I don't care to know more about security measures than I absolutely have to.

Answer 1

According to the chicha idea I'd say... Why don't you turn off your computer put it inside a steel box, weld it and send it to a friendly military base? That's security!
You are safe if you do not use your computer!
Joking a part, if you do not have an hardware firewall or a NAT using iptables is a good idea imo.
But yes, if you avoid living in root you are reasonable safe as is.
About building packages in root is (always imo) overrated as risk. I saw some ugly made PKGBUILD that make unusable packages is some situation (e.g they rely on user umask value), but I never seen a PKGBUILD (from both aur or abs) were builiding damages the system.
Surely, even if not risky... why doing it?
A little script I used to configure iptables.
#!/bin/sh
# firewall.sh
if [ "`/usr/bin/id -u`" != 0 ]
then
echo "`basename $0`": you need to be root to do that.
exit 1
fi
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --flush # Flush all rules, but keep policies
iptables --delete-chain
### Basic firewall rules ###
iptables --policy FORWARD DROP
iptables --policy INPUT DROP
iptables --append INPUT -i lo --source 127.0.0.1 --destination 127.0.0.1 -j ACCEPT
iptables --append INPUT -m state --state "ESTABLISHED,RELATED" -j ACCEPT
### icmp services ###
#iptables --append INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
#iptables --append INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
#iptables --append INPUT -p icmp --icmp-type echo-request -j ACCEPT
#iptables --append INPUT -p icmp --icmp-type echo-reply -j ACCEPT
### Open ports ###
#Bittorrent, ten downloads at time
#iptables --append INPUT -p tcp --dport 6881:6890 -j ACCEPT
#Utorrent
#iptables --append INPUT -p tcp --dport 41688 -j ACCEPT
#aDonkey network
#iptables --append INPUT -p tcp --dport 4662 -j ACCEPT
#iptables --append INPUT -p udp --dport 4672 -j ACCEPT
#ssh server
iptables --append INPUT -p tcp --dport 22 -j ACCEPT
#skype
#iptables --append INPUT -p tcp --dport 59945 -j ACCEPT
#http server
#iptables --append INPUT -p tcp --dport 80 -j ACCEPT
#https server
#iptables --append INPUT -p tcp --dport https -j ACCEPT
### Limits the logging to 40 entries per minute ###
iptables --append INPUT -j LOG -m limit --limit 40/minute
### Everything other is dropped ###
iptables --append INPUT -j DROP
### Finally saves the settings for the next reboot.
iptables-save > /etc/iptables/iptables.rules
echo "`basename $0`": Done.
Last edited by ezzetabi (2008-05-15 09:22:39)