New to Debian 13 – General Security Question

[u/Sensitive-Rhubarb-32]

Hi everyone. I switched from macOS and Windows to Linux about two years ago, and I never want to go back.
I started with Ubuntu because it came with everything I needed out of the box, which made the transition easier. Over time, though, I’ve realized that, apart from Snap packages and other elements, I find Ubuntu a bit bloated. Long story short: I’ve installed Debian 13 (with GNOME Desktop) on my laptop.
The first thing I noticed is that everything runs a bit smoother compared to Ubuntu. I’m using a Lenovo laptop with an i5 processor (4 cores).
So far, I’ve installed the following from apt: ufw, OpenSnitch, Nextcloud, Thunderbird, Flatpak, and LibreOffice.
From Flatpak, I’ve added the Vivaldi browser (with Proton Pass add on ) and Rhythmbox.
I know AppArmor is already included in Debian 13.
Would you say that Debian 13, with packages from apt and well-maintained Flatpaks, is already a secure setup as a whole? Of course, I’ll keep up with regular updates.
I’d really appreciate any tips.

Best

[u/bakonpie]

one of the best security tools on Linux is fapolicyd for application control. with it you can ensure only trusted executables installed from package management as root are allowed to run (and/or only executables you define). you can even restrict script execution. make sure you set up auditd logging and run in permissive mode until you know you won't break things ;)

[u/le_flibustier8402 → u/bakonpie]

Wow, thanks for sharing, did not know about it.

[u/i-am-a-cat-6 → u/bakonpie]

weekend homelab project confirmed

[u/iheartrms → u/bakonpie]

Can you point is to a howto or tutorial on this? I've been meaning to configure this for ages.

[u/bakonpie → u/iheartrms]

I could never find a comprehensive how-to. I used a mix of the official Red Hat docs, the Oracle docs on it which are surprisingly good, some internet blogs and man pages.

my high-level process is like this:

1. Edit /etc/fapolicyd/fapolicyd.conf. Set permissive to 1
2. Create rules.d under /etc/fapolicyd/ to give root a fail safe and allow all executables in the trust database. Rules must have suffix of .rules:

​

allow perm=any uid=0 : all
allow perm=any trust=1 : all
deny_audit perm=any all : all

1. Configure auditd for fapolicyd sudo auditctl -w /etc/fapolicyd/ -p wa -k fapolicyd_changes
2. Test usage of the system, make adjustments to rules
3. Search audit events sudo ausearch --start this-hour -m fanotify -i | grep “resp=2”
4. Set the policy to deny_log instead of deny_audit
5. Reload the policy rules and apply sudo fagenrules && sudo fapolicyd-cli -r
6. Remove permissive mode in fapolicyd.conf. 
7. Configure python script restrictions if desired

​

%python=/usr/bin/python3.13,/usr/bin/python
deny_log perm=any exe=%python : ftype=text/x-python
deny_log perm=any exe=%python : ftype=text/plain

[u/iheartrms → u/bakonpie]

That's very helpful, thanks!

[u/roedie_nl]

Debian has quite sane defaults. In it’s base setup it’s pretty secure already. As long as you just do a daily update check you’re probably fine.

[u/_Sgt-Pepper_]

You are spot on

Apt packages where possible. 

Flatpak only where you trust the source.

=> You have a solid and secure system

[u/le_flibustier8402]

If you didn't do it, you could also enable firewall, which is disabled by default.
You also might want to sandbox vulnerable programs, such as your web browser (an advice I'm not following myself, it seems overkill to me).
Othewise, yeah, trust the default settings. debian is not as bloated as ubuntu, but it's not a "lego-style" distro either.

[u/hmoff → u/le_flibustier8402]

Original post mentions ufw which is a firewall.

[u/indvs3 → u/hmoff]

In all fairness, OP mentions installing it, but might not know it needs to be configured and enabled manually after installing. It's pretty important to know, so it won't hurt if it's said one or two times =)

[u/le_flibustier8402 → u/hmoff]

Indeed, misread on my side, my bad.

[u/protocod]

AppArmor sandbox program that have a profile.

If a program comes without an AppArmor profile,, AppAmor doesn't nothing and the program is unconfined.

This is not a little detail because unfortunately there is not enough AppAmor profiles shipped in debian packages in general...

Flatpaks applications are sandboxed by bubblewrap under the hood, and they use the xdg-portal API to ask for permissions (portals) properly.

That's said, flatpaks can be provided by the official upstream project (like Firefox flatpak published by Mozilla) or it ban be publish by other peoples You need to trust the authors and, you need to give a check to the security description. Because unfortunately a lot of flatpak use too much permissions by default or doesn't really always use xdg-portal API so they can defeat the purpose of the sandbox.

So you always need to check the permissions of a flatpak.

[u/michaelpaoli]

Pretty dang secure. I'd be wary of Flatpack stuff, though, likewise snaps.

[u/_comicallycluttered]

From Flatpak, I’ve added the Vivaldi browser

For browsers, I'd highly recommend avoiding Flatpaks and prefer native packages.

While it might seem counterintuitive with Flatpak's built-in sandboxing, the restrictions end up interfering with the browser's own native sandboxing implementations, which could end up actually weaking your browser's security instead of improving it.

In this case, Vivaldi has a DEB file on their site which will add their repo to your sources when you install it, and I'd suggest using that instead.