18 KiB
title, icon, description
| title | icon | description |
|---|---|---|
| Linux Overview | simple/linux | Linux 是一种开源的、注重隐私的桌面系统替代方案，但不是所有发行版都一样。 |
Linux is an open-source, privacy-focused desktop operating system alternative. In the face of pervasive telemetry and other privacy-encroaching technologies in mainstream operating systems, desktop Linux has remained the clear choice for people looking for total control over their computers from the ground up.
Our website generally uses the term “Linux” to describe desktop Linux distributions. Other operating systems which also use the Linux kernel such as ChromeOS, Android, and Qubes OS are not discussed on this page.
我们的Linux推荐 :material-arrow-right-drop-circle:{.md-button}
Security Notes
There are some notable security concerns with Linux which you should be aware of. Despite these drawbacks, desktop Linux distributions are still great for most people who want to:
- 避免专有操作系统中经常出现的遥测现象
- Maintain software freedom
- Use privacy-focused systems such as Whonix or Tails
Open-Source Security
It is a common misconception that Linux and other open-source software are inherently secure simply because the source code is available. There is an expectation that community verification occurs regularly, but this isn’t always the case.
In reality, distro security depends on a number of factors, such as project activity, developer experience, the level of rigor applied to code reviews, and how often attention is given to specific parts of the codebase that may go untouched for years.
Missing Security Features
At the moment, desktop Linux falls behind alternatives like macOS or Android when it comes to certain security features. We hope to see improvements in these areas in the future.
-
Verified boot on Linux is not as robust as alternatives such as Apple’s Secure Boot or Android’s Verified Boot. Verified boot prevents persistent tampering by malware and evil maid attacks, but is still largely unavailable on even the most advanced distributions.
-
Strong sandboxing for apps on Linux is severely lacking, even with containerized apps like Flatpaks or sandboxing solutions like Firejail. Flatpak is the most promising sandboxing utility for Linux thus far, but is still deficient in many areas and allows for unsafe defaults which permit most apps to trivially bypass their sandbox.
Additionally, Linux falls behind in implementing exploit mitigations which are now standard on other operating systems, such as Arbitrary Code Guard on Windows or Hardened Runtime on macOS. Also, most Linux programs and Linux itself are coded in memory-unsafe languages. Memory corruption bugs are responsible for the majority of vulnerabilities fixed and assigned a CVE. While this is also true for Windows and macOS, they are quickly making progress on adopting memory-safe languages such as Rust and Swift, respectively.
选择您的发行版
并非所有的 Linux 发行版都是相同的。 Our Linux recommendation page is not meant to be an authoritative source on which distribution you should use, but our recommendations are aligned with the following guidelines. These are a few things you should keep in mind when choosing a distribution:
发布周期
我们强烈建议你选择与稳定的上游软件版本接近的发行版，通常被称为滚动发行版。这是因为冻结发布周期的发行版往往不更新软件包版本，并且在安全更新方面落后。
For frozen distributions such as Debian, package maintainers are expected to backport patches to fix vulnerabilities rather than bump the software to the “next version” released by the upstream developer. Some security fixes (particularly for less popular software) do not receive a CVE ID at all and therefore do not make it into the distribution with this patching model. As a result, minor security fixes are sometimes held back until the next major release.
我们不认为保留软件包和应用临时补丁是一个好主意，因为它偏离了开发者可能打算让软件工作的方式。 Richard Brown has a presentation about this:
Traditional vs Atomic Updates
传统上，Linux发行版的更新方式是依次更新所需的软件包。 Traditional updates such as those used in Fedora, Arch Linux, and Debian-based distributions can be less reliable if an error occurs while updating.
Distros which use atomic updates, on the other hand, apply updates in full or not at all. On an atomic distribution, if an error occurs while updating (perhaps due to a power failure), nothing is changed on the system.
The atomic update method can achieve reliability with this model and is used for distributions like Silverblue and NixOS. Adam Šamalík provides a presentation on how rpm-ostree works with Silverblue:
“以安全为重点”的分发
通常在“以安全为中心”的发行版和“渗透测试”发行版之间存在一些混淆。 A quick search for “the most secure Linux distribution” will often give results like Kali Linux, Black Arch, or Parrot OS. 这些发行版是攻击性的渗透测试发行版，捆绑了测试其他系统的工具。它们不包括任何 "额外的安全 "或用于常规使用的防御性缓解措施。
基于Arch的发行版
Arch and Arch-based distributions are not recommended for those new to Linux (regardless of distribution) as they require regular system maintenance. Arch does not have a distribution update mechanism for the underlying software choices. As a result you have to stay aware with current trends and adopt technologies on your own as they supersede older practices.
For a secure system, you are also expected to have sufficient Linux knowledge to properly set up security for their system such as adopting a mandatory access control system, setting up kernel module blacklists, hardening boot parameters, manipulating sysctl parameters, and knowing what components they need such as Polkit.
Arch-based derivatives designed to make Arch "easier to use" are not recommended, as they frequently encourage poor security practices while weakening the base system. These practices include bundling outdated packages in downstream repositories that are updated less frequently than Arch's official channels. Furthermore, these distributions usually fail to properly educate users on the risks associated with the Arch User Repository (AUR).
Anyone using the Arch User Repository (AUR) must be comfortable auditing PKGBUILDs (the recipes that build packages) that they download from that service. AUR packages are community-produced content and are not vetted in any way, and therefore are vulnerable to software :material-package-variant-closed-remove: Supply Chain Attacks{.pg-viridian}, which has in fact happened in the past and more recently when 1500 packages were compromised.
The AUR should always be used sparingly, and often there is a lot of bad advice on various pages which direct people to blindly use AUR helpers without sufficient warning. Similar warnings apply to the use of third-party Personal Package Archives (PPAs) on Debian-based distributions or Community Projects (COPR) on Fedora.
If you are experienced with Linux and wish to use an Arch-based distribution, mainline Arch Linux is the only recommended option.
Linux-libre内核和“Libre”发行版
We recommend against using the Linux-libre kernel, since it removes security mitigations and suppresses kernel warnings about vulnerable microcode.
Mandatory access control
Mandatory access control is a set of additional security controls which help to confine parts of the system such as apps and system services. The two common forms of mandatory access control found in Linux distributions are SELinux and AppArmor. Fedora and Tumbleweed use SELinux by default, with Tumbleweed offering an option in its installer to choose AppArmor instead.
SELinux on Fedora confines Linux containers, virtual machines, and service daemons by default. AppArmor is used by the snap daemon for sandboxing snaps which have strict confinement such as Firefox. There is a community effort to confine more parts of the system in Fedora with the ConfinedUsers special interest group.
一般建议
驱动器加密
大多数Linux发行版在其安装程序中都有一个选项用于启用 LUKS FDE。 If this option isn’t set at installation time, you will have to back up your data and re-install, as encryption is applied after disk partitioning, but before file systems are formatted. 我们还建议安全地删除你的存储设备。
Swap
Consider using ZRAM instead of a traditional swap file or partition to avoid writing potentially sensitive memory data to persistent storage (and improve performance). Fedora-based distributions use ZRAM by default.
If you require suspend-to-disk (hibernation) functionality, you will still need to use a traditional swap file or partition. Make sure that any swap space you do have on a persistent storage device is encrypted at a minimum to mitigate some of these threats.
专有固件(Microcode更新)
Some Linux distributions (such as Linux-libre-based or DIY distros) don’t come with the proprietary microcode updates which patch critical security vulnerabilities. Some notable examples of these vulnerabilities include Spectre, Meltdown, SSB, Foreshadow, MDS, SWAPGS, and other hardware vulnerabilities.
We highly recommend that you install microcode updates, as they contain important security patches for the CPU which can not be fully mitigated in software alone. Fedora and openSUSE both apply microcode updates by default.
更新
大多数Linux发行版会自动安装更新或提醒你这样做。重要的是保持你的操作系统是最新的，这样当发现漏洞时，你的软件就会打上补丁。
Some distributions (particularly those aimed at advanced users) are more bare bones and expect you to do things yourself (e.g. Arch or Debian). 这些将需要手动运行 "软件包管理器" (apt, pacman, dnf, 等等)，以便接收重要的安全更新。
此外，一些发行版将不会自动下载固件更新。 For that, you will need to install fwupd.
Permission Controls
Desktop environments that support the Wayland display protocol are more secure than those that only support X11. Moreover, we generally recommend installing and using applications which are sandboxed such as those obtained via Flatpak. Flatpak supports the security-context-v1 protocol and the ability to filter D-Bus protocols, which allow Flatpak to properly identify apps for the purpose of sandboxing them through permission controls.1 Conversely, applications outside sandboxes are free to perform privileged actions such as capturing your screen, either by overwriting the portal permission store, or making use of privileged Wayland protocols.
隐私调整
MAC地址随机化
Many desktop Linux distributions (Fedora, openSUSE, etc.) come with NetworkManager to configure Ethernet and Wi-Fi settings.
It is possible to randomize the MAC address when using NetworkManager. 这在Wi-Fi网络上提供了更多的隐私，因为它使你更难追踪你所连接的网络上的特定设备。它并不是 **** 让你匿名。
In the terminal, create a new file /etc/NetworkManager/conf.d/00-macrandomize.conf and add the following to it:
[device]
wifi.scan-rand-mac-address=yes
[connection]
wifi.cloned-mac-address=random
ethernet.cloned-mac-address=random
Then, restart NetworkManager:
systemctl restart NetworkManager
Optionally, changing the connection parameter from random to stable will give you a random MAC address per network, but keep it stable for that network when you reconnect to it later. Using random will give you a random MAC address per connection. This may be desirable for networks with captive portals or where you have a static DHCP assignment, at the expense of making you more identifiable by a single network operator you connect to multiple times.
If you are using systemd-networkd, you will need to set MACAddressPolicy=random which will enable RFC 7844 (Anonymity Profiles for DHCP Clients).
MAC address randomization is primarily beneficial for Wi-Fi connections. For Ethernet connections, randomizing your MAC address provides little (if any) benefit, because a network administrator can trivially identify your device by other means (such as inspecting the port you are connected to on the network switch). 随机化Wi-Fi MAC地址取决于Wi-Fi固件的支持。
其他标识符
还有一些其他的系统标识符，你可能要小心对待。你应该考虑一下，看看它是否适用于你的 威胁模型。
- 主机名。 你的系统的主机名是与你所连接的网络共享的。你应该避免在你的主机名中包括像你的名字或操作系统这样的识别术语，而是坚持使用通用术语或随机字符串。
- 用户名。 同样地，你的用户名在你的系统中以各种方式使用。考虑使用 "用户 "这样的通用术语，而不是你的真实姓名。
系统计数
Fedora 项目 [通过使用一个 countme 变量而不是唯一的 ID 来计算](https://fedoraproject.org/wiki/Changes/DNF_Better_Counting) 有多少独特的系统访问它的镜像。 Fedora这样做是为了确定负载并在必要时为更新提供更好的服务器。
这个 选项 ，目前默认是关闭的。我们建议将 countme=false 添加到 /etc/dnf/dnf.conf ，以备将来启用它。 On systems that use rpm-ostree such as Silverblue, the countme option is disabled by masking the rpm-ostree-countme timer.
openSUSE also uses a unique ID to count systems, which can be disabled by emptying the /var/lib/zypp/AnonymousUniqueId file.
-
This exposes a reliable way for Wayland compositors to get identifying information about a client. Compositors can then apply security policies if desirable. https://github.com/flatpak/flatpak/commit/f0e626a4b60439f211f06d35df74b675a9ef42f4 ↩︎