How Secure Are We?

Question

Hello there, Arch users.
I'm a fairly secure user of Windows and Android operating systems. I've also recently wanted to further expand and harden my privacy and security out of a need, as I live under not-so-favorable conditions.
I've switched my desktop OS to Linux less than a couple of months ago. Started with Linux Mint Debian Edition (a Debian "rolling release"). Was a fine learning experience and I've got to administer my home Linux box in a secure manner until it broke (nothing related to security, just that proprietary drivers broke over an update.. too lazy to fix it)
Now I intend to install Arch after testing Antergos and getting to use the Arch environment. I'm interested in reading good tips on how to secure is the system and how to further increase security in terms of remote exploitation specifically. Should I depend on Arch as a daily *secure* driver for everyday needs? I need to address that firstly as it's the uncontrollable part; unlike human-infrastructure type of attacks. I did read the Security wiki, but I also need more tips from experience as what can be installed or what should be avoided.
Some guidance questions:
1- As this is a rolling release OS, is it more or less secure than long-support release systems?
2- What specific tips can we use to further secure our systems?
I'm currently using Antergos, but I intend to switch to full Arch install in about 2 weeks (will have free time by then). I like the Arch environment (and forums) and I'm interested in ways to further secure it.
Also, a good tip would be like: you need to install ufw and gufw and run
# sudo gufw
and turn ufw on.
3- How long, on average, does it usually take to patch vulnerabilities found in Linux, from your experience? i.e. Is it usually faster or slower than other distros? An educated guesstimate would work, as I don't expect to find standardized info.
4- AUR! I need someone to go on all day about anything related to security about AUR. Awesome ArchWiki doesn't have much on this.
For example:
- When a package I installed is updated from vendors/authors, does my package pull from the source vendor and immediately update (most importantly, Google Chrome), or does my system have to wait for the package maintainer to actually update his work for yaourt to pull from? i.e. Does the system update packages as soon as the vendor updates them, or as soon as the maintainer updates them?
- When I pacman -Syu, does this include updating AUR? Here
5- What VPN do you guys use?
# mod edit: less inflammatory title
Last edited by jasonwryan (2015-01-28 20:22:08)

Answer 1

Mars wrote:1- As this is a rolling release OS, is it more or less secure than long-support release systems?
Two totally different things; "LTS" distributions aim to provide support to a generally "fixed" set of packages (ie, same major kernel, same major toolchain etc), usually back-porting security fixes to those packages where required. Rolling release aims to provide the latest packages of everything -- this can lead to a lot more breakages than an "LTS" distro if not managed properly. LTS is generally more forgiving of "lazy" management.
As far a security goes, it's difficult to compare. LTS releases generally get security patches back-ported, but sometimes they may not, especially towards the end of the LTS life cycle, or if implementing the fix would significantly change expected behaviour of the software. On a Rolling Release, you'll get the latest which includes any security fixes, but also includes any NEW security issues (probably not even discovered yet) introduced in recent versions.
Mars wrote:2- What specific tips can we use to further secure our systems?
This is the same regardless of your distribution. The standard list applies: minimize your attack surface (use a firewall, disable services you don't need), use good passwords, enforce MAC instead of DAC (eg, SELinux or AppArmour).
Mars wrote:3- How long, on average, does it usually take to patch vulnerabilities found in Linux, from your experience? i.e. Is it usually faster or slower than other distros? An educated guesstimate would work, as I don't expect to find standardized info.
You say "in Linux" then "other distros" -- are you wanting to compare Linux to other operating systems, or Arch to other distributions? If it's the later, then Arch is generally quite on the ball. Looking at recent vulnerabilities:
http://allanmcrae.com/2015/01/who-you-gonna-call/
http://allanmcrae.com/2014/09/shellshoc … rch-linux/
Mars wrote:- When a package I installed is updated from vendors/authors, does my package pull from the source vendor and immediately update (most importantly, Google Chrome), or does my system have to wait for the package maintainer to actually update his work for yaourt to pull from? i.e. Does the system update packages as soon as the vendor updates them, or as soon as the maintainer updates them?
makepkg will do whatever the PKGBUILD tells it to do. If the PKGBUILD is for a specific version of a package (as is generally the case) then that is what it will build. You are free to download the PKGBUILD from the AUR and modify it yourself if it is not the version you want/latest version. This is fairly straightforward generally, and there is lots of information in the wiki, on man pages and generally around the web.
The exception to this is git packages, which often pull the latest git tree before building, which means you'll *really* have the latest version, probably not even a version that has been released by the upstream developer.
Mars wrote:- When I pacman -Syu, does this include updating AUR? Here
No, read up on the wiki the difference between the official repos, the community repo and the AUR.
Mars wrote:5- What VPN do you guys use?
OpenVPN to my own VPS.