Add optional "system hardening" toggle in the installer

spotlesscoder commented 1 year ago

Problem

Despite the fact the elementaryOS is primarily designed to be used by people that don't necessarily have a background in working in IT, privacy becomes more and more important.

I would love when elementaryOS also supports inexperienced / uneducated PC users to put in place commonly recommended security measures.

Proposal

The installer should have an optional "Enhanced security" checkbox on one of the pages (probably the best place would be the wizard step where the user can choose to either try elementaryOS or install it. When the user chooses the install process as option, he should be asked whether enhanced security features should be enabled (yes/no dialog?)

Things that could be configured in the background if "yes" is chosen:

the disk encryption should be enabled, e.g. the user should be asked to enter a disk encryption password in the step where at the moment, he is asked to choose whether disk encryption should be user or not. In other words: if "yes" is chosen, the password prompt for disk encryption should be the next screen after selecting the target hard drive (user should still be able to change his decision in that step by having a button "Don't encrypt" left to the "Next" button in that screen.
Default firewall rules should be set up (probably ufw should be used for that)
- DENY all INCOMING on all interfaces (except related, established)
A hosts file that blocks known malicious IP addresses by setting the IP for the malicious hostname to 0.0.0.0 in the hosts file could be enabled. There is a Github project https://github.com/StevenBlack/hosts that allows generating host file entries based on categories like "adware", "malware" etc., integrating different blocklists with a simple to use cli. That could be used by elementary under the hood. Automatic updating of theses should of course also be set up automatically. Furthermore, the user could be offered to choose more categories from that project like "adult", "gambling" etc. which could then later also automatically be added to the parental controls setting.
unattended-upgrades could be autoconfigured then.

Prior Art (Optional)

No response

spotlesscoder commented 1 year ago

Further security improvements might could be derived from running a report with https://github.com/CISOfy/lynis on a fresh elementaryOS install with default system settings

janxkoci commented 1 year ago

FYI the disk encryption is already in the installer. Your proposed changes could be shown at the same page.

spotlesscoder commented 1 year ago

Good idea :)

In my opinion the enhanced security should be added by default. It should be an active decision to not implement security measures like disk encryption, firewall, etc.

janxkoci commented 1 year ago

In my opinion the enhanced security should be added by default. It should be an active decision to not implement security measures like disk encryption, firewall, etc.

My dad doesn't even have a password on his laptop (he asked me to remove it), let alone a second password for encrypted drive :)

Anyway, lot of the ideas will require a lot of testing, so it's probably a long shot...

danirabbit commented 11 months ago

Moving to initial setup since these seem to be end user choices and not OEM choices

danirabbit commented 11 months ago

As written, this issue report feels invalidly formatted imo. It would be better to file separate issue reports for these features so that they can be tracked effectively.

[x] Disk encryption is already implemented in the installer
[x] Automatic updates is already implemented in Onboarding
[ ] Adding some kind of presets for Firewall rules seems like it might better be handled in System Settings itself since that sounds rather complicated

I don't think it really makes sense to have some single option "Advanced security". If there were things we can do by default with no downsides, we should just do those things without having to ask. If we have to ask, then there should be a much more thorough informed consent and we should make sure we're prompting for things at an appropriate time and making sure we're asking the right person, the OEM/Installer, the primary user/admin, or each user in their individual session

spotlesscoder commented 11 months ago

As written, this issue report feels invalidly formatted imo. It would be better to file separate issue reports for these features so that they can be tracked effectively.
* [x]  Disk encryption is already implemented in the installer

Maybe it would be another possible solution to highlight the importance of disk encryption by displaying an additional message window with a small text pointing out the risks right before actual installation starts when the user chose not to enable disk encryption?

* [x]  Automatic updates is already implemented in Onboarding

I should have been more specific here: What I meant is the activation of "unattended-upgrades" package.

* [ ]  Adding some kind of presets for Firewall rules seems like it might better be handled in System Settings itself since that sounds rather complicated

I agree that this should be handled in the system settings, but there should be a simple switch that sets up minimal default:

sudo ufw enable sudo ufw default deny incoming sudo ufw default allow outgoing

I don't think it really makes sense to have some single option "Advanced security". If there were things we can do by default with no downsides, we should just do those things without having to ask. If we have to ask, then there should be a much more thorough informed consent and we should make sure we're prompting for things at an appropriate time and making sure we're asking the right person, the OEM/Installer, the primary user/admin, or each user in their individual session

I totally agree :)

danirabbit commented 11 months ago

Alright, so gonna close this one but please feel free to reopen separate more specific issue reports so they can be tracked and evaluated individually

elementary / initial-setup