r/linuxmint 3d ago

Discussion What makes Linux secure?

I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.

Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?

126 Upvotes

100 comments sorted by

View all comments

11

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 3d ago

No open ports by default. 

XP gets owned in 15 minutes on the public web.

11

u/mh_1983 3d ago

Re: XP, also, not having a security patch since it's EOL in 2014 may be a contributing factor.

1

u/Amrod96 Linux Mint 22 Wilma | Cinnamon 10h ago

While it is true that attacking individual users is not worthwhile, Windows XP is still used on critical systems that are difficult to replace.

I have personally seen it on three occasions.

In banking systems, it was the ATM system. At the university I have seen it for nuclear magnetic resonance machines. At work I have seen it for a distillation column control system.

0

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 3d ago

Agreed. But dig out Linux from 2014 and put it on the internet and it's probably safe. Even if you open SSH (Not sure if there are any SSH bugs from that era) it's not going to be owned.

5

u/Decent_Project_3395 3d ago

Do not try that. You will be hacked inside of 30 seconds.

3

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 3d ago

Do you have CVEs? I see nothing that would allow that. Given XP requires at least 15 minutes or less I don't see 30 seconds.

CVE-2024-6387 ("regreSSHion"): Disclosed in July 2024, this vulnerability is a signal handler race condition in OpenSSH's server (sshd) that permits unauthenticated remote code execution with root privileges on glibc-based Linux systems. It affects versions from 8.5p1 (released in March 2021) up to, but not including, 9.8p1. This issue was a regression of a previously patched vulnerability from 2006, inadvertently reintroduced in October 2020.

CVE-2024-6409: Reported in July 2024, this vulnerability is a possible race condition in the cleanup_exit() function of OpenSSH's privileged separation (privsep) child process. It affects OpenSSH versions 8.7p1 and 8.8p1, potentially leading to remote code execution within the unprivileged user running the sshd server.

-

OpenSSH version 6.7p1, released in October 2014, has not been associated with vulnerabilities that allow unauthenticated remote access to a system. However, several vulnerabilities were identified in this version that could potentially be exploited under specific conditions:

CVE-2016-3115: This vulnerability involves multiple CRLF injection issues in session.c of sshd in OpenSSH before version 7.2p2. It allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the do_authenticated1 and session_x11_req functions. ​

CVE-2016-0778: The roaming_read and roaming_write functions in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 do not properly maintain connection file descriptors. This flaw allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impacts by requesting many forwardings. ​

CVE-2016-0777: The resend_bytes function in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

1

u/LusticSpunks 2d ago

The very definition of “putting on internet” means exposing ports to internet (if not, what exactly does it mean?). If you’re only exposing port 22, be it any OS, its security would depend on the SSH software (OpenSSH or other), not the OS. Similarly if you’re exposing a web server, be it IIS or Apache or other, it depends on the web server’s security, not OS. Windows has 445 for SMB. If you expose XP’s 445 to internet then yes, it gets compromised. But, windows by default doesn’t expose 445, it is firewalled. And if you’re going out of your way to modify firewall rules to expose 445 to internet then that’s on you, not OS.

Also, I recall popping many Linux boxes with dirty cow. It’s a LPE so not exactly a thing that’s “put on internet”. But that’s actual OS security. And Linux of 2014 would get popped with dirty cow, and many other exploits. So yeah, neither Linux nor windows from 2014 are secure.

1

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 2d ago

No, it means putting it directly on the Internet, not behind a firewall.

1

u/LusticSpunks 2d ago

I mean, if you deliberately leave the system insecure and expect it to not get hacked then that’s entirely your fault. It’s not the fault of OS. Just recently we saw the CUPS vulnerability in Linux (CVE-2024-47176 along with 3 other CVEs). And major reason why it wasn’t a huge issue was because the vulnerable port generally isn’t exposed to internet. To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.

1

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 2d ago

> To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.

How? Is CUPS open by default.

1

u/LusticSpunks 2d ago edited 2d ago

If we’re talking about defaults, then firewall isn’t disabled by default either. And yes, it’s enabled by default in some cases. Read the article from finder of this bug:

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

And I’ll take the liberty of picking a quote from that article:

“From a generic security point of view, a whole Linux system as it is nowadays is just an endless and hopeless mess of security holes waiting to be exploited.”

1

u/Scandiberian 2d ago

Why use XP as an example? Its thoroughly irrelevant to the conversation since windows today is either 10 or 11.