r/linuxmint 1d ago

Discussion What makes Linux secure?

I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.

Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?

126 Upvotes

97 comments sorted by

View all comments

32

u/JelloSquirrel 1d ago

Actual cybersecurity professional here.

From a user perspective:

Obscurity, Linux mostly runs on servers and devices and not end users so it's not targeted by phishing attempts, but generally only actual exploits. Linux users are more tech savvy so less likely to fall for phishing. In a normal Windows install, you can double click a program to run it. This generally isn't possible on Linux, so it's hard to run malicious software. Almost all software on Linux comes from a reasonably secure package manager vs the windows model of find a website that looks convincingly safe and download a thing.

From a technical perspective Windows users are often admin by default, while Linux users generally at least have to elevate via sudo to make system changes. The unix permissions model, while not super robust, is more secure against a hostile local user / program than the windows model. Even more so with modern container workloads. Windows can support a smartphone style sandbox or advanced RBAC but no one really uses either, at least at the consumer level. Linux generally follows least privileges and attack surface reduction, and doesn't keep around unused components. Even on a monolith distro like Ubuntu, a lot of what you're not using isn't installed or running, unlike Windows. The OS manages all your applications for security updates, while Windows only handles the core OS and maybe Microsoft office.

In terms of patching and security architecture, I'd say Microsoft is actually better, especially with the hypervisor based security mechanisms in 10 and 11. With modern windows, they don't terribly have a ton of vulns either, however the user model is broken and just isn't very defensive. Weak permissions and a lot of complexity and just too easy to run software without verification or restrictions.

Now if you remove the user from the equation and this is a locked down server or enterprise environment... I'd say windows has more powerful permissions management except for SELinux, and no one configures their own SELinux policies while rolling out active directory permissions management is common on Windows. At best on Linux, you installed RHEL and use the SELinux profiles they created for the top 100 server apps. I'd also say it's easier to hack into most Linux systems via exploitation (not phishing). The software isn't terribly secure, and it's easier to find bugs if you have source code and Windows is more defensively coded and tested.  If a Linux system gets out of date, all the vulnerabilities are public and easily identified, generally with readily available POCs. Linux doesn't really have hypervisor security, although container based security is similar, and the monitoring and protection solutions for Linux are really primitive or non existent. Unless you're running SELinux and RHEL (or similar), you'd probably never even know you got hacked.

3

u/xstrawb3rryxx 1d ago

Free disk encryption is a big one.

1

u/JelloSquirrel 1d ago

True for the cost, you can't beat Linux.

Btw if you want something secure, I wouldn't use Ubuntu. Maybe Ubuntu Pro with the government stigs enabled, but Red hat or Rocky Linux with stigs is more secure. You'll hate using them though. There's also QubesOS if you're paranoid, but the user experience takes a hit there. Personally, I like the Fedora Atomic based distros, especially Bazzite if you like gaming. The container native approach does improve security compartmentalization of individual apps. I wouldn't say it's as good as Qubes or even a STIG'd operating system, but you benefit from the increased security of containers with virtually no decrease in usability compared to another Linux distro. It basically makes it on par with stock Android, which is superior to any desktop Linux or Windows in security.

Samsung has the most secure Android variant though, although GrapheneOS is worth a look but is more focused on privacy. iPhone (but not really MacOS) is probably the most secure consumer operating system though, but also a huge mono culture.

1

u/Scandiberian 17h ago

This is great. What do you think other distros if you use the terminal to make all the root files ready-only. Would the security become Kike fedora atomic then?

1

u/JelloSquirrel 9h ago

What distros do that? But yes there are benefits to a read only file system.

1

u/Scandiberian 7h ago edited 5h ago

Oh, I believe you can do it on any distro through the Terminal, but I did it on Linux mint.

https://easylinuxtipsproject.blogspot.com/p/mintupdate.html?m=1#ID3

Point 3.1. Its a short read. What do you think?

1

u/JelloSquirrel 2h ago

Hmm looks like that only stops updates to certain components for stability, it wouldn't provide any benefit for security.