The responses don’t have to be strictly NixOS or Linux specific as I expect the general process to be very similar.
I never hardened a system before so I’m not sure what things I should be focusing on and what solutions are out there. I’m hearing a lot good on SELinux and apparmour but but those sadly aren’t supported on NixOS. Recently I set up adguard home with somewhat strict blocklists and SearxNG to take control over my web searches. In the coming days I intend to set up wireguard and a VPN in my config and I also have some firefox extensions for blocking ads, trackers, JS, port scanning, etc. but it all feels surface level and I don’t know where to take things from there. What are you guys doing with your setups?
Usually I prefer to never ask questions and look things up myself but reddit will soon block everything with a login wall and that’s where I get most info from so I’m finally giving it a shot. :p
Reboot them once in a while
Switched to stable to get my system to fucking build and boot again, so I can get all the fixes
I don’t need to tell you this, but Nix is pretty good:
- NixOS configurations force you to declare attack surfaces (user groups, open ports) explicitly
- Nixpkgs is the largest package repository ever, so you rarely have to rely on 3rd-party packages
- Nixpkgs tends to ship security fixes quickly
- NixOS and many of its packages are open source
But it comes with a few pitfalls:
- Only import Flakes or modules from trusted authors. I would avoid the NUR completely, because it incentivizes the opposite
- Some far-reaching security fixes (such as the recent one for PHP) trigger long rebuilds before they reach the main
nixoschannels. Usenixos-unstable-smallto override vulnerable packages in the meantime
I use LUKS disk encryption and Lanzabote secure boot to secure my data at rest. Not because I’m scared of anyone breaking into my house, but for the peace of mind that the data is gone once I erase the encryption key.
For privacy, I use LibreWolf with default security settings and a VPN.
Other than that, I don’t feel the need to harden my personal computer. That is of course a different story for servers with open ports. The NixOS wiki entry for Security also contains some useful links.
i love that, for homelabbing, NixOS does a lot of secure things by default. firewall ports are opened explicitly and declaratively and services run under their own user with their own data directory. everything, even on the same local machine, communicates over HTTPS.
also, IMO the way people should have been running agents from the beginning: agents get their own user and a pared down list of tools and specific directories with specific read/write access and their own git clone of whatever code i’m working on (i hate working on the same files as an agent). (running a local Qwen 27B with Hermes)
other than that the normal stuff like
fail2ban, random SSH port, VPN for remote access, Adguard, etc.deleted by creator
Edit: sorry I didn’t link. It has been an incredible overnight upgrade to security for me. I have all of my stateful directories LUKS encrypted and copying on write to a btrfs subvolume that gets cloned over at boot to each time and as a result, I have a minuscule attack surface. On top of that, all of the machines on my network are fully impermanent and write their state to a local NAS. It’s pretty elegant. I highly recommend rehearsing the switch to impermanent via a QEMU VM and not fully making the switch until your data is backed up.
I did a rehearsal on my home directory that took a few iterations to catch all of the files I needed to declare. A diff on the two btrfs directories each reboot made that fairly easy. I wish I could share the config but it would dox the shit out of me!
Mind expending on that a bit, even if just a link to more info?
https://github.com/nix-community/impermanence
Your root directory is mounted as a tmpfs which means it gets cleared every startup. The only way to persist config or data is to have it in your Nix config or use impermanence to bind mount a folder to a persisted directly.
I use it on my servers. I have Impermanence + LUKS with remote unlocking on my servers
Sorry about that. I was in a rush. :)
Appreciate the update!
I am also interested in this. I like that the execution of binaries is tied to the nix-store, but I am sure there are some things to be done to harden it further.
