It is important to highlight user account security

[Archie]

This may or may not bear any fruits or results but we will definitely learn something pragmatic from this discussion. I think Just18's concerns for securing not just his but other users accounts and data are noble, and the least I can do is layout what I believe would be genuine concerns of the average user, the issues they face, and probably some good advice. What the readers choose to do with those advice is theirs to consider.

I believe that the more we inform and make aware, it also strengthen our own user security.

Agreed !
As I posted earlier: just don't go and start forcing things on users just because of your own personal feelings/concerns.

Would it help any if we show these users our baseball bats? 

[Ramchu]

Would it help any if we show these users our baseball bats? 

Would be an Attention Getter ! 

[TerryH]

create a new user/group called  "internet"

Thinking about how to attempt to make this as secure as possible I read about rbash (restricted bash).  I set up a new user using /bin/rbash as the login shell.  This allows me to su to this user and run a browser program (firefox) in isolation.  The rbash doesn't allow this user to issue a command with '/'.

Some console output from tests:


[terry@localhost ~]$ su webuse
Password:
gpg-agent[11657]: directory `/home/webuse/.gnupg' created
gpg-agent[11657]: directory `/home/webuse/.gnupg/private-keys-v1.d' created
gpg-agent[11658]: gpg-agent (GnuPG) 2.0.17 started
[webuse@localhost ~]$ firefox
NOTE: child process received `Goodbye', closing down
[webuse@localhost ~]$ ls
Desktop/  Documents/  Downloads/  getLOdictionary.txt  Movies/  Music/  Pictures/  tmp/
[webuse@localhost ~]$ cd Desktop
-rbash: cd: restricted
[webuse@localhost ~]$ cat getLOdictionary.txt
A LibreOffice dictionary might be available for you new locale.
.
.
Then restart LibreOffice to apply the new locale.
[webuse@localhost ~]$ cd /etc
-rbash: cd: restricted
[webuse@localhost ~]$ $PATH
-rbash: /bin:/usr/bin:/usr/local/bin:/usr/bin/X11:/usr/games:/usr/lib/qt4/bin:/usr/bin:/usr/sbin:/usr/lib/kde4/libexec:/bin:/sbin:/usr/X11R6/bin:/usr/games:/usr/local/bin:/usr/local/sbin:/home/webuse/bin: restricted: cannot specify `/' in command names
[webuse@localhost ~]$

[Just17]

As I posted earlier: just don't go and start forcing things on users just because of your own personal feelings/concerns.

If you got that impression then you have not read the thread   

This is about informing, making information available, and hopefully making an easy means to a more secure end a reality for those who want it.

Forcing?   Sheesh!

[menotu]

If storing password info in cookies, is deemed to be insecure, then it should not be done .......

Very insecure letting cookies hold that type of info, and the thing is it's absolutely not necessary as their are some extremely good password management tools available.

On a side, but associated note, I think the forum would benefit from having a Security Board of it's own, for devs to announce any known Security Updates/Issues and for other forum members to post security related questions/answers etc......

[CaptainSarcastic]

I guess I just take administering my own security for granted, and generally run very similarly regardless of what OS I am using at a given time.  It would seem that Internet security is the highest priority, and I routinely do the following:

1.  Use multiple web browsers, for different purposes.  I keep Firefox as my most secured, Chromium as the second level, and Opera as the third.

2.  On Firefox, I install the following:  NoScript, Ghostery, Flashblock, AdblockPlus
     On Chromium, I install:  NotScripts or ScriptNo, Ghostery, Flashblock, AdblockPlus
     On Opera, I install nothing

3.  I try to keep my general web browsing in Firefox, where I have the highest level of protection running.  Some spillover of this goes into Chromium, which is also locked down pretty well.  I use Opera primarily for known-safe sites, or ones that don't play nicely with the security extensions of the other browsers.

I don't use file sharing or torrent sites, don't install apps from outside the repos, and generally am very careful about anything I download.

Following these procedures has kept me problem-free for years, even on Windows.

[Archie]

Hi CaptainSarcastic,

This is perhaps a good opportunity to elaborate more on the addons. I don't run Firefox so you may need to confirm what I think is a very serious issue among addons. I run Chromium primarily and do not have any extras other than what came with it. My backup browsers are Rekonq (now using version 1.0) and Konqueror (because of its multifaceted function, web browser, file manager, ftp client, window washer ... ). I have not installed any addons to those as well. It doesn't mean that I am against installing addons but I want to check and inspect what I use. If the addons were on our own repository I probably would also give those the wuality seal.

My query is ... in installing some of these addons, do some actually inform the user that those applets would call home, use some of your personal information, access your /home folder, and maybe some other things I can't remember at the moment because I have just woken up and haven't had my first cup of coffee ... thinking this is more important and that if I make my coffee first, I might forget about this ... blah blah blah.

I'm sure that "marketplace" that Firefox, etc runs check these third-party submitted apps and allow them on their sites. Would you really trust these considering the aforementioned requirements of these extensions ... and go ahead installing them because they "enhance" and make our browsing experience much easier to accomplish?

[ternor]

The standard warning is:

Install add-ons only from authors whom you trust.
Malicious software can damage your computer or violate your privacy

[Archie]

The standard warning is:

Install add-ons only from authors whom you trust.
Malicious software can damage your computer or violate your privacy

Fair warning from the browser's repository/marketplace (I'm not really sure what it's called ... on Chromium, it's called web store). But what are the basis of trusting said authors? By the number of downloads of the extensions? Freeware/Adware/Donation/Paid?

By nature, we take risks but IMO a little bit of research on the extensions we want to use can save us sthe trouble of not being able to uninstall it when we no longer want to use it. How many do you think choose to risk the second line of the warning?

[pags]

As has been mentioned, the tighter the security, the more inconvenient the use of the computer gets (simplification, but valid for home users).  The trick is finding the balance (which will invariably differ for various users  ).

One option that has yet to be mentioned (and may have very extreme consequences, I haven't tested fully, yet) would be to ensure there is a separate /home folder, and mount it with the noexec option (see: man mount).
This would prevent any executables (downloaded malware, etc.) from being run from anywhere in the /home directory.  Then, use the OS (permissions, groups, etc.) to control who an run what from only designated areas...the inconvenience (quite large, of course) would be the inability to run installs (such as java apps, etc.) from your home directory...

Balancing act.

There are other options, I'm sure, that will get mentioned as well...

[CaptainSarcastic]

Hi CaptainSarcastic,

This is perhaps a good opportunity to elaborate more on the addons. I don't run Firefox so you may need to confirm what I think is a very serious issue among addons. I run Chromium primarily and do not have any extras other than what came with it. My backup browsers are Rekonq (now using version 1.0) and Konqueror (because of its multifaceted function, web browser, file manager, ftp client, window washer ... ). I have not installed any addons to those as well. It doesn't mean that I am against installing addons but I want to check and inspect what I use. If the addons were on our own repository I probably would also give those the wuality seal.

My query is ... in installing some of these addons, do some actually inform the user that those applets would call home, use some of your personal information, access your /home folder, and maybe some other things I can't remember at the moment because I have just woken up and haven't had my first cup of coffee ... thinking this is more important and that if I make my coffee first, I might forget about this ... blah blah blah.

I'm sure that "marketplace" that Firefox, etc runs check these third-party submitted apps and allow them on their sites. Would you really trust these considering the aforementioned requirements of these extensions ... and go ahead installing them because they "enhance" and make our browsing experience much easier to accomplish?

A lot of the decision to install extensions is based on the longevity of the extension, the general reputation of it, and where it is being accessed.

Getting an extension from Mozilla or the Chrome Web Store is one thing, getting it from some random website or due to a pop-up message while browsing is another.  All the extensions I mentioned above are easily searched, and most have Wikipedia pages on them.  This is not foolproof (The SRWare Iron web browser, despite what seems to be worsening behavior, still has relatively clean search results, although not spotless), but it can be very helpful.

Since I am the only person who generally uses this computer, my security set-up assumes a user who knows what he is doing.  If this machine were shared or public then I might be more prone to take more drastic steps in securing it.

[kjpetrie]

As has been mentioned, the tighter the security, the more inconvenient the use of the computer gets (simplification, but valid for home users).  The trick is finding the balance (which will invariably differ for various users  ).

One option that has yet to be mentioned (and may have very extreme consequences, I haven't tested fully, yet) would be to ensure there is a separate /home folder, and mount it with the noexec option (see: man mount).
This would prevent any executables (downloaded malware, etc.) from being run from anywhere in the /home directory.  Then, use the OS (permissions, groups, etc.) to control who an run what from only designated areas...the inconvenience (quite large, of course) would be the inability to run installs (such as java apps, etc.) from your home directory...

Balancing act.

There are other options, I'm sure, that will get mentioned as well...

I think the aim behind the thread was to see whether the default installation from an ISO could be tweaked to improve basic security for the average user.

This would prevent KDE's autostart features working - even the loading of bash and KDE environments and user profiles might be affected. Desktop launchers, which in KDE now have to be executable to run might also be affected, though I'm not sure whether they have to be executable or just marked as such.

As you say, it would seriously affect users' convenience. The OP wanted precautions to be transparent to the user but limit harmful access from outside. By clever use of sudo, permissions, users and groups it might be possible to tighten things up, but we always have to beware of making the system too difficult for the ordinary person to use.

[Just17]

I would like to add here .....  that the original idea was to make it easy for a normal user to lock down their system - particularly their user account - without having to go through a huge learning process to find out how - providing the 'How-TOs' in a document for the various aspects .....  and to hopefully be able (in the long term) to put a set of 'security rules' into a package that could be installed and uninstalled through Synaptic.

In that way, the user would have complete control over each item in the list of suggested items or could installed a default set recommended by PCLOS ......  or to continue with the situation as it is presently.

Hopefully that better explains what was behind this discussion.

[CaptainSarcastic]

I would like to add here .....  that the original idea was to make it easy for a normal user to lock down their system - particularly their user account - without having to go through a huge learning process to find out how - providing the 'How-TOs' in a document for the various aspects .....  and to hopefully be able (in the long term) to put a set of 'security rules' into a package that could be installed and uninstalled through Synaptic.

In that way, the user would have complete control over each item in the list of suggested items or could installed a default set recommended by PCLOS ......  or to continue with the situation as it is presently.

Hopefully that better explains what was behind this discussion.

This kind of sounds to me like it could be accomplished with a preconfigured user account.  Something with very limited privileges and access, more locked down than the standard "Guest" account.

[ternor]

I frequently work with various applications in conjunction with the web browser.  For example, I am working on a number of html pages and it is helpful to view them in the browser to check on changes I make.

The pages I write for one website frequently require me to refer to various documents, usually MS text documents and pdf documents.  I also have to upload material from my computer to add as media to such web pages.

I also need to check details of images to be used in the pages.  That means I am using an image viewer, an ide, a word processor and a pdf viewer.

I can do without the nuisance of trying to work with two user accounts at once (assuming that would be possible).