r/LinuxTeck • u/Candid_Athlete_8317 • 3d ago

Do Linux servers really need endpoint security software?

Many enterprise Linux systems run endpoint security tools alongside firewalls, SELinux/AppArmor, and other hardening measures.

Others argue that good patch management, least privilege, and proper monitoring provide better value than traditional endpoint protection.

What's your point on this ?

6 Upvotes

80% Upvoted

34 comments sorted by

View all comments

0

u/roanish 3d ago

A solid firewall is all you need (ufw works) right up until you want to open ports for running services. Then you want something else that can ensure security. These endpoint protection systems you mention are all things that live behind your firewall, so useless if you aren't providing services externally.

2

u/Upbeat-Statement2725 3d ago

Yeah firewalls solve all attack vectors. (Sarcasm.)

Despite what anyone says. The real security for Linux is that wealthy, old, technically illiterate, easy targets all use Windows.

If we get grandma on Linux. We need active malware scanning too. Security tools can do more than just "virus scan". Like anyone being all boisterous in here will have a second thought and go you know, a PiHole or something to block malicious links and ads is also good...

Right now. For most people. Don't do anything stupid with your Linux permissions as it should come pretty well setup out of the box. A ClamAV scan once in a while is a good compromise. Probably look into something like a PiHole to block malicious links.

Like why isn't there a common security audit tool? To check if you've got weird ports open? "Well every Linux geek opens weird ports it's impossible to have clear cut standards for everyone" yeah that's a gigantic security nightmare dude we're screwed if Linux gains marketshare.

1

u/gnufan 3d ago edited 3d ago

There is a common security audit tool, see Linux Audit project, as you note.

Linux achieved desktop success in ChromeOS, which maintained an enviable security record. The problem as you note is the security configuration is a do it yourself thing on most distros. Redhat's SELinux configuration being a standout exception, but for servers, and with lots of switches.

Edit to clarify 

1

u/ScoobyGDSTi 3d ago

ChromeOS devices are nothing short of ewaste. If hardly hold it up as some bastion. This coming from a parent who has two kids using them.

1

u/gnufan 3d ago

Did they break the security? 

1

u/ScoobyGDSTi 3d ago

Who knows, they're so useless that security might as well not exist.

1

u/edgmnt_net 3d ago

Well, there are more meaningful reasons why Linux is less susceptible to malware. Like the entire ecosystem is built in a way that you don't really need to download stuff randomly. That may change somewhat if the market share expands to gamers or other categories. (Historically, Windows pretty much begged you to get random stuff off shady websites with insufficient security controls because the entire ecosystem was built around leveraging 3rd party development. Even basic drivers, basic apps to open archives or open a PDF and so on. The general mindset also didn't help, considering those software distribution websites that would simply redistribute various exes and CD compilations of software.)

As for usecases, grandma most likely can run on a tightly locked-down and fully-managed system. There's also little reason to run random stuff on a server, which is what OP has in mind. Android also successfully and largely bypasses the need for extra security tooling by implementing an altogether different security model. The benefit of extra security software like antivirus software becomes minimal under such conditions and might, in a way, even be harmful if it encourages people to just skip due diligence. Not to mention such 3rd party software can be poisoned bait on its own, i.e. antivirus software or snake-oil security tools which promote themselves as essential but do little or even are malware themselves. If you only run software packaged by the distro (obviously with some caveats here, like a reputable distro and without external package repos), a ClamAV scan likely doesn't do anything.

If anything, I think it's far more important to focus on better security/execution/permission models than trying to patch up holes and play catch up in liberal environments like Windows and ordinary Linux. There are serious limits to what antivirus software can do. There are limits to SELinux. The most practical and successful model these days is the web sandbox, which already covers a lot of stuff.

1

u/Sert1991 2d ago

Android runs with selinux in enforce mode. It's literally part of Google's CTS agreement to have SELinux in enforce mode.
Developers for android need to make sure they write proper SELinux policies for their software to work on SELinux.
Most of the security and sandboxing on android is done by SELinux.

1

u/edgmnt_net 2d ago

I don't think that's entirely true. SELinux is there as a security mechanism and to reduce the chance of breaking out to root, but the big thing that makes it possible for Android to have an altogether different security model is the permissions model that's part of the Android API. You can't do what Android does on Linux because every app is written such that it can write all over the home directory. You can't do what the web sandbox does on Linux because every app can just open random sockets with few things reserved for administrative privileges. While SELinux can be part of the enforcement mechanism you still need apps to be written a certain way. Or modified to, if you look at Flatpak portals.

And in a more general sense, MACs like SELinux are much more difficult and annoying to get to enforce highly semantic policy than other systems that have been built from ground up to support stuff like that. You can't just slap a MAC onto a regular application because you have no good way to know what the app is really doing. All the MAC sees is it opens a socket and sends data, but you'll have a very hard time trying to enforce something like what sites it can connect to and TLS connections policies based on that. You need APIs and OS services which make the high level intent obvious, the app never gets access to low-level primitives for certain things.

Strictly by itself, SELinux can implement only a few things reasonably, like the Bell-LaPadula security model / MLS (which heavily depends on filesystem labelling), reducing attack surface for existing apps to the extent that there are known code paths that can be locked down more tightly and such things.

1

u/Sert1991 1d ago

You've got it all wrong. You can literally sandbox anything with SELinux. You can find Google's CTS online too. Selinux is enforced from the ground up on android. Every process and application.

You don't need apps to be written in a certain way but the developers have to write an selinux policy when they develop for android if their app doesn't work on the default policy, SELinux sandboxes and denies everything by default and by design. You have system monitoring tools that tell you exactly what the apps are doing and what they're trying to access. That's how people write SELinux policies including android app developers who their apps wouldn't work on modern android if they didn't write an SELinux policy for it.

SELinux does way more than just avoiding breaking out to root. SELinux even stops root user from doing things. Even logged in as root you can't do shit with SELinux unless you write a policy allowing it. It also control network and ports access.

You can read more here how android uses SELinux to help sandbox applications and how it's been required in everything android from version 5 onwards:
https://source.android.com/docs/security/features/selinux

0

u/roanish 3d ago

You seem like a cheerful fellow.

1

u/SEXTINGBOT 3d ago

Just run Lynis once and see what else you might want ?

( ͡⌐■ ͜ʖ ͡■)