It is important to highlight user account security

[Just17]

Tony,
          I think the main point I was trying to make is that, as far as MY data is concerned (and on this PC that data is the only thing I value), I may as well be running as root as a user. In both instances MY data is at risk if a breach occurs.
    Yes on a multi-user PC or set up, a root breach would be able to get to other users' data also. That is not the case for most desktop users from what I have read. Mostly they have single user stand alone PCs.

On a single user PC, that is not a concern.

So, with that in mind, I feel that the security advise to users should point out this fact ....  but it is rarely done.  Almost every security advise to users seems to emphasise the 'do not run as root' even though they are addressing a single user on a stand-alone PC.

IMO, it is past time that Linux users should be warned about how their user accounts could be breached, and how to prevent or at least make difficult, those breaches.

[Tony]

On a single user PC, that is not a concern.

OK, yes I just use a single user PC.

Really all I can suggest is to take your valued data off your PC, however that's probably not an option as you'd have done so.

IMO, it is past time that Linux users should be warned about how their user accounts could be breached, and how to prevent or at least make difficult, those breaches.

[ternor]

I haven't read all of this thread so I apologise if this was mentioned previously.  I have just come across this wiki page of another distro: Features/Securecontainers.  The feature is designed for administrators but could, presumably, be adapted for users.

[kjpetrie]

If you have root access you are the administrator.

But does pclos implement SELinux?

[Just17]

PCLOS has not implemented  systemd  .....  as yet anyway ...

Summary

This change allows an administrator to run multiple services on the same machine each service in a secure Linux Container. virt-sandbox-service takes an systemd unit file and sets up all of the mountpoints and libvirt container information to run the service unit within the container.

[Tony]

PCLOS has not implemented  systemd  .....  as yet anyway ...

Well lets get cracking, I've a feeling we may all be 'Surfing in the Nude.'

Fight that urge to visualise, ...     

[ternor]

In case anyone is interested, I came across this article about systemd through tuxmachines: The Biggest Systemd Myths.

[david1958]

well, from my past experience and I think all will agree.

anything in electronics no matter how much security can be hacked

When I was a trucker, I had a detroit  diesel in my truck a series 60 and it fuel was controled by the computer that Roger Penskie had perfected and it would cut off at 64mpg with the fuel so you got no more speed, I used a .49 cent resistor from radio shack and a 3 dollar potietometer if i spelled that correct and it changed the voltage on the speed sensor and bingo the truck ran 100 mph if you wanted to but it never registered in the computer and so there was no log when they check it when I came into nebraska.  It was great.

[kjpetrie]

Potentiometer. 

Yes, people will get round things if they can, and security is about ensuring they can't, as much as you can.

I suspect a more modern system would show an inconsistency between the recorded speed and the distance travelled in the time.

It is possible to run a web browser in a chroot jail, providing you can duplicate everything it needs in the new /. I notice some tools I use (such as NX) run that way. Search your file system for directories called 'ext' to find which applications already use one. This means the application can only reach its own part of the fs or places you've linked to - providing the resources you've linked to don't leak, of course.

[veronicathecow]

Hi Just17, very glad you have brought up the root and security issue. For me data is everything, I tend to do something stuppid every 6 months anyway so re-installing does not bother me.
For security the first thing I do is make changes in the router, default user, password, switch off remote access (if on) and ensure a firewall is on. I also switch off both the PC and the router when not using them for a while (My PC boots in under 20 seconds) and I get a new IP address which is I would say is a good thing.
I run as "root", always have done, always will do because of exactly the reasons you have stated and using various versions of Linux I can get problems accessing files etc.
I then install a firewall, add noscript and web of trust to firefox along with adblocker plus.

However the comments posted here have made me realise this really isn't enough nowadays. The trouble is with so much net related stuff access to files for up/downloading is essential to what I do but browsing is certainly the one I am most concerned about. Addons of all kinds, are as others have mentioned a real potential source of problem. No matter how mature a addon may be the programmer could still be hacked and their code altered and distributed.

I am also glad that nothing will be forced on users as that is the one thing guaranteed to send me too another OS (Tried to put a folder called "music" on a Windows 7 machine for a friend and it refused to let me create it!)

I can't offer any technical help with security issues but would be happy to help with testing. THanks to all for contributing to this important subject

[ternor]

Running as root is, I understand, one of the worst things you can do as far as security is concerned.

[Just17]

While I understand you are doing your set up in full knowledge of the implications, it is not something I would advocate.
I would advocate running as a user, even if the root had no password --  at least a pop-up would appear to indicate to the user to be careful, as they acquire root powers/privileges.

It would lessen the damage a user could unwittingly inflict on themselves.
I have used that scheme on Live test installs myself, due to the hassle of entering the root password very often, in such circumstances.
It is preferable to running as root IMO ....  although definitely not ideal from a security point of view.

There are even some apps that will not run as root - such as VLC.

But essentially there is nothing that the root user can do to my data that I cannot do myself ....  and that is the important point for a lot of us.

The root user, though, can easily destroy the OS whereas my user cannot. I see no point in facilitating the everyday user of the PC (me in this case) the facility to destroy the OS without some indication that care should be taken - the root pop-up box.

Even if only for that reason I would not 'run-as-root' ..... I rarely even log into the root account, as everything I need can be done from the user account, which tends to keep me safe from myself (most of the time). 

But overall, yes I continue to believe there is not sufficient emphasis on 'protecting' user data.

One scheme proposed here for more secure on line activity - using a dedicated account - would not be possible if the user is root. Maybe that is something you might consider.

Making backups of the important data, if those backups are attached to the PC (a separate disk),  provides two locations from which data could be mined if there was a breach of the account 

[Just17]

Running as root is, I understand, one of the worst things you can do as far as security is concerned.

In a multi-user environment it is a complete and utter disaster.

Its impact in a single-user environment is considerably reduced.

[kjpetrie]

I wouldn't go that far. In a single user environment the impact of running as root is not reduced. It is the threat of other users seeing your data which is missing.

Data is vulnerable in either scenario, but running as root increases the risk of things being done to your system which could expose your data to further danger, such as installing backdoors, rootkits, data and key loggers.

[Tony]

I have read this thread. I had a security issue recently where a friend accidentally clicked a link in an Email which released a Virus (Windows) which sent the same Email and the Malicious code within to all people in his Address book.

To clarify my take on this thread, I can say I pretty much understand what Archie has said, as it's commonsense info, securing your browser, email, etc.; clearing your browser cache, cookies,  simple 'Online Procedures'.
Adding to your browser any security addons, turn of, or uninstall Java, and Flash Plugin.
The concerns with what I think Just17 is saying are he's concerned with multiple user's on a System, or I have read of a state in Linux where you aren't 'root' but some form of User that is more powerful (thus more vulnerable) where advanced System tasks can be executed. I'll leave that there as i don't understand well enough, but suspect this is the Topic.

Getting back to the Malicious Email I received; I use Mozilla Thunderbird.
The moment I realised the Email link was dodgy I blacklisted the sender's Address.

It was Windows Malware so it wasn't a danger, but better careful than sorry.

Also, Thunderbird doesn't execute a link by clicking, it has to be copied and pasted into a browser. It used to initiate a link, and open my Default Browser but not theses days. I have to copy every link out of Emails, to my Browser. No problem.

Thus choosing what programs you RUN, and being very familiar with how to react quickly if you suspect something is going wrong is so important. As a last resort turn off Moden/Router.
Essentially I got to see first hand an attack via a "Phising Scam", but Linux didn't react at all, which was a great experience to go through !!
I've written somewhere else about this so I won't go further.

I'm not understanding what Just17 is saying, he has already pointed it out to me so I don't know enough about Linux to grasp the problem.

I do however know if I have sensitive Data I wouldn't store it on a Computer that goes online. There's many ways like encryption, sanbox, etc. to secure the Data, also.
Lessening the priority of an application, say your browser, or the Directory the sensitive Data is stored, seems obvious so it can't be reached from an outside source.

Keeping away from known bad sites, and bad online behaviour, obvious.

Googling some Windows Security Forums may also give some further info about bad URL's, and how to avoid them.

What happened to the good old HOSTS file ? No one mentions it, but it is an obvious security measure which should be recommended, plus setting up a Firewall.

Anyhoo,...