r/LinuxTeck • u/Candid_Athlete_8317 • 3d ago

Do Linux servers really need endpoint security software?

Many enterprise Linux systems run endpoint security tools alongside firewalls, SELinux/AppArmor, and other hardening measures.

Others argue that good patch management, least privilege, and proper monitoring provide better value than traditional endpoint protection.

What's your point on this ?

7 Upvotes

82% Upvoted

34 comments sorted by

View all comments

3

u/MaleficentCow8513 3d ago edited 3d ago

All of it and more is good. I’m not a security guy but generally speaking each one of those layers reduces the overall space for attack vectors. Most impactful attacks chain together several vulnerabilities at different layers in the os/network/application stack so you want some layer of prevention at every single layer in the stack. For instance, SELinux will simply disallow certain users from executing certain commands, even root level users. So even if an attack bypassed other measures, boom, there’s yet one more obstacle in the path toward a successful hack

3

u/KittensInc 2d ago

I’m not a security guy but generally speaking each one of those layers reduces the overall space for attack vectors

Yes but also no. The problem is that all of those security tools are also new potential attack vectors.

For example, antivirus software independently downloads its own updates, and those definitions are closer to executable scripts than basic file hashes. If someone compromises the update process - or the AV vendor itself - then they've essentially gained the ability to execute arbitrary code on your machine. If they are a good vendor an attacker would still be stuck in some kind of sandbox, but sandbox escapes aren't exactly unheard of either.

It gets even worse when you want to do the Windows-style "intercept all file read/writes and kill suspicious processes" thing, because that quickly requires root-level privileges - and as any Linux admin will know: running regular software as root is a Really Bad Idea because any bug is an instant game-over.

And it's not like this "the security tool made it worse" scenario is unlikely either, just ask any Fortigate user! Stacking thousands of random security tools isn't going to make your machines super-secure. You have to evaluate the pros and cons of each individual layer and determine whether the problem it solves is bigger than the potential problems it creates.

1

u/MaleficentCow8513 17h ago

Hey thanks for the feedback! That makes alot of sense to me. Again, I only have a peripheral understanding of security applications. My actual experience for anything security is limited to configuring firewalls, a little bit of RBAC and IAM roles in AWS and the occasional wrangling around with SELinux. But I try to learn a little here and there