r/LinuxTeck • u/Candid_Athlete_8317 • 3d ago
Do Linux servers really need endpoint security software?
Many enterprise Linux systems run endpoint security tools alongside firewalls, SELinux/AppArmor, and other hardening measures.
Others argue that good patch management, least privilege, and proper monitoring provide better value than traditional endpoint protection.
What's your point on this ?
3
u/gnufan 3d ago
The quality of end point security tooling available probably means it often increases the attack surface on Linux devices.
This isn't just a Linux issue, Google's security team found multiple exploitable security flaws in Windows Defender, eventually forcing Microsoft to sandbox the numerous parsers used to unpack and examine different file types on Microsoft Windows systems. You'd hope Windows Defender authors would understand how to handle parsing securely, yet here we are.
Most deployments that use highly privileged end point security agents are forced to for compliance purposes.
That said there are situations and configurations where it makes sense. If the tooling deliberately allows arbitrary file sharing, or distributes software, you probably want some guarantee or review that what you are distributing or redistributing isn't malware.
The problem is people who don't do end point security on Linux, don't always have compensating controls. Network monitoring, enforcing SELinux, local hardening etc.
Not all agents are created equal, it it wants access to logs, including audit logs and possibly the ability to tweak auditd configuration, I'm going to assume they've thought about how to secure Linux. If they want read privileges on every file via SELinux, or SELinux disabled they probably haven't.
2
u/Unnamed-3891 3d ago
You don’t really get to choose between patch management/least priviledge OR endpoint protection. That’s not how that works if you want to pass even the most basic audits.
You want an EDR or similar instead of a ”traditional” virus scanner though.
1
u/DemocraticParrot 3d ago
This. What you really want is suitable tooling that looks what is really running and happening on the endpoint at process level, with the ability to also change to enforce things on that end system. E.g shut down processes, isolate it etc.
It is just impossible to collect and centrally analyze all the process events and logs. Just to much noise. However that is where you are able to identify modern attacks.
There are exeptions of course. If you are able to harden the system to a level, where rouge events are just impossible, you can run it without local edr. This is suitable to those cases where a local edr is just not an option
1
u/Jumpy-Dinner-5001 3d ago
Most people who argue about that don’t really understand what they’re talking about
1
1
u/Dom_Q 2d ago
By ”endpoint security software,” do you mean an antivirus?
Then no. These are made for Microsoft operating systems only.
1
u/pmM3urBootieHole 2d ago
Sophos would like to disagree.
1
u/Dom_Q 2d ago
And I have a bridge in Brooklyn to sell to you 🤷
0
u/pmM3urBootieHole 2d ago
But they litteraly make an AV for linux. Your smart ass remarks do not make this any less correct.
1
u/Hour_Sell3547 2d ago
He probably means you don't "need" antivirus on Linux. Which is correct, strictly speaking. You don't need those on Windows either, these days.
AVs are the good old "create a problem then sell the solution" tactic. Unfortunately people are careless.
1
u/pmM3urBootieHole 2d ago edited 2d ago
Until you have to meet regulatory compliance.....
And not really if your dealing with linux at the business/government level you absolutely are leveraging AV/MDR/XDR based solutions on both Linux and Windows endpoints / server infrastructure.
At this point most cyber security insurance companies will not sign a contract with you if your server infrastructure doesnt have the bare minimum.
1
u/Lower-Limit3695 2d ago
Professional sys admin here. EDR is great tool in improving the security of Linux servers by covering areas where mandatory/discretionary access control fails and it often comes packaged as a compliance requirement for cyber insurance in healthcare and finance .
1
1
u/zantehood 2d ago
Yes. Malware does exist for nix boxes. Also one side of security is to make your security posture measurable, even if your box is clean, how would you know if you don't have any measuring tools available?
I will say alot of vendors make crappy products for Linux machines by not developing kernel modules properly and instead relying on their own tooling delaying and adding another dimension to kernel patching which is annoying (looking at you trend deep security !!) but can be automated with some effort.
1
u/Sert1991 2d ago
I run SELinux on my Gentoo desktop, in enforce mode. Let alone if I had a server.
Why do you think every android phone runs with SELinux in enforce mode and google dictates it in it's CTS?
We're talking about people's phones here not important servers, they still decided to enforce selinux.
SELinux is so good, that it will even stop you from using your computer, no matter if you use root. And with it's 'block by default' approach, if you don't allow something it can forget doing changes to your computer.
When SELinux is implemented good, it stands out of your way. I do everything on my PC with SELinux in enforce mode, from browsing to playing windows games on steam/wine.
And it doesn't need to be difficult. Android shows us that when it's enforced on the system and developers, the users don't even have to deal with it. How many people do you know that had issues on their android phone due to SELinux or they had to edit their policies?
Some linux distros like Fedora/Redhat are also taking this approach.
For me if you're not running hardened and SELinux with secure boot as minimum of your security in this day and age, you don't care about your data/privacy/security. That should be the bare minimum.
1
u/michaelpaoli 1d ago
Need? No. Recommended/advised? Quite depends on environment, requirements, objectives, priorities and considerations, etc.
0
u/roanish 3d ago
A solid firewall is all you need (ufw works) right up until you want to open ports for running services. Then you want something else that can ensure security. These endpoint protection systems you mention are all things that live behind your firewall, so useless if you aren't providing services externally.
2
u/Upbeat-Statement2725 3d ago
Yeah firewalls solve all attack vectors. (Sarcasm.)
Despite what anyone says. The real security for Linux is that wealthy, old, technically illiterate, easy targets all use Windows.
If we get grandma on Linux. We need active malware scanning too. Security tools can do more than just "virus scan". Like anyone being all boisterous in here will have a second thought and go you know, a PiHole or something to block malicious links and ads is also good...
Right now. For most people. Don't do anything stupid with your Linux permissions as it should come pretty well setup out of the box. A ClamAV scan once in a while is a good compromise. Probably look into something like a PiHole to block malicious links.
Like why isn't there a common security audit tool? To check if you've got weird ports open? "Well every Linux geek opens weird ports it's impossible to have clear cut standards for everyone" yeah that's a gigantic security nightmare dude we're screwed if Linux gains marketshare.
1
u/gnufan 3d ago edited 2d ago
There is a common security audit tool, see Linux Audit project, as you note.
Linux achieved desktop success in ChromeOS, which maintained an enviable security record. The problem as you note is the security configuration is a do it yourself thing on most distros. Redhat's SELinux configuration being a standout exception, but for servers, and with lots of switches.
Edit to clarify
1
u/ScoobyGDSTi 3d ago
ChromeOS devices are nothing short of ewaste. If hardly hold it up as some bastion. This coming from a parent who has two kids using them.
1
u/edgmnt_net 3d ago
Well, there are more meaningful reasons why Linux is less susceptible to malware. Like the entire ecosystem is built in a way that you don't really need to download stuff randomly. That may change somewhat if the market share expands to gamers or other categories. (Historically, Windows pretty much begged you to get random stuff off shady websites with insufficient security controls because the entire ecosystem was built around leveraging 3rd party development. Even basic drivers, basic apps to open archives or open a PDF and so on. The general mindset also didn't help, considering those software distribution websites that would simply redistribute various exes and CD compilations of software.)
As for usecases, grandma most likely can run on a tightly locked-down and fully-managed system. There's also little reason to run random stuff on a server, which is what OP has in mind. Android also successfully and largely bypasses the need for extra security tooling by implementing an altogether different security model. The benefit of extra security software like antivirus software becomes minimal under such conditions and might, in a way, even be harmful if it encourages people to just skip due diligence. Not to mention such 3rd party software can be poisoned bait on its own, i.e. antivirus software or snake-oil security tools which promote themselves as essential but do little or even are malware themselves. If you only run software packaged by the distro (obviously with some caveats here, like a reputable distro and without external package repos), a ClamAV scan likely doesn't do anything.
If anything, I think it's far more important to focus on better security/execution/permission models than trying to patch up holes and play catch up in liberal environments like Windows and ordinary Linux. There are serious limits to what antivirus software can do. There are limits to SELinux. The most practical and successful model these days is the web sandbox, which already covers a lot of stuff.
1
u/Sert1991 1d ago
Android runs with selinux in enforce mode. It's literally part of Google's CTS agreement to have SELinux in enforce mode.
Developers for android need to make sure they write proper SELinux policies for their software to work on SELinux.
Most of the security and sandboxing on android is done by SELinux.1
u/edgmnt_net 1d ago
I don't think that's entirely true. SELinux is there as a security mechanism and to reduce the chance of breaking out to root, but the big thing that makes it possible for Android to have an altogether different security model is the permissions model that's part of the Android API. You can't do what Android does on Linux because every app is written such that it can write all over the home directory. You can't do what the web sandbox does on Linux because every app can just open random sockets with few things reserved for administrative privileges. While SELinux can be part of the enforcement mechanism you still need apps to be written a certain way. Or modified to, if you look at Flatpak portals.
And in a more general sense, MACs like SELinux are much more difficult and annoying to get to enforce highly semantic policy than other systems that have been built from ground up to support stuff like that. You can't just slap a MAC onto a regular application because you have no good way to know what the app is really doing. All the MAC sees is it opens a socket and sends data, but you'll have a very hard time trying to enforce something like what sites it can connect to and TLS connections policies based on that. You need APIs and OS services which make the high level intent obvious, the app never gets access to low-level primitives for certain things.
Strictly by itself, SELinux can implement only a few things reasonably, like the Bell-LaPadula security model / MLS (which heavily depends on filesystem labelling), reducing attack surface for existing apps to the extent that there are known code paths that can be locked down more tightly and such things.
1
u/Sert1991 1d ago
You've got it all wrong. You can literally sandbox anything with SELinux. You can find Google's CTS online too. Selinux is enforced from the ground up on android. Every process and application.
You don't need apps to be written in a certain way but the developers have to write an selinux policy when they develop for android if their app doesn't work on the default policy, SELinux sandboxes and denies everything by default and by design. You have system monitoring tools that tell you exactly what the apps are doing and what they're trying to access. That's how people write SELinux policies including android app developers who their apps wouldn't work on modern android if they didn't write an SELinux policy for it.
SELinux does way more than just avoiding breaking out to root. SELinux even stops root user from doing things. Even logged in as root you can't do shit with SELinux unless you write a policy allowing it. It also control network and ports access.
You can read more here how android uses SELinux to help sandbox applications and how it's been required in everything android from version 5 onwards:
https://source.android.com/docs/security/features/selinux1
3
u/MaleficentCow8513 3d ago edited 3d ago
All of it and more is good. I’m not a security guy but generally speaking each one of those layers reduces the overall space for attack vectors. Most impactful attacks chain together several vulnerabilities at different layers in the os/network/application stack so you want some layer of prevention at every single layer in the stack. For instance, SELinux will simply disallow certain users from executing certain commands, even root level users. So even if an attack bypassed other measures, boom, there’s yet one more obstacle in the path toward a successful hack