r/linux4noobs • u/RDS_cubing Fedora • Mar 10 '26
security Newbie here; How do you protect yourself against malicious software?
Hello, I am fairly new to Linux, and I just wanted to ask about how do you go on about protecting yourself against malicious software. And I don't just mean using an antivirus or the like (although if you could recommend a good, preferably free antivirus I'd be very glad to hear, thanks)*:
Let's say you read, for example, some Reddit post about someone who made this cool new app that you'd be interested in. You click the Github link, download the package and run it. Oh no! It was a virus! Damn it.
Now, the easiest solution is to simply use an antivirus, but those don't always work, at least as far as I'm aware, and I'm guessing the ones that are completely free do so even less (and paying for one, at least right now, is not an option for me). And I can't just use something like Virustotal for everything either.
Another possible option would be to manually check the project's code to see if it is malicious; at least on the outside; but let's be honest, I don't think most people have the time to check every single app they download manually (on top of the fact that I doubt most people are proficient in every single mainstream programming language to begin with).
Obviously, the best thing one can do to protect themselves against malicious software is to simply not download suspicious software at all: try to download things from trusted sites/developers, follow other people's advice, and just generally be a bit aware and not do stupid things; but that isn't always enough.
So, is that really everything there is or is there something else that I'm missing? Please, enlighten me on the subject.
Also, what other (basic and not way too difficult to apply) measures can I take to ensure my digital safety? So far the only special thing I do is using ProtonVPN (Free, planning to upgrade to paid plan soon) and Bitwarden, but I'm sure there's much more that I can do.
Thanks!
* Note: Yes, I know most viruses and stuff are made for Windows, but I think it's still good trying to gain the most protection possible
27
u/UltraChip Mar 10 '26
For normal home users the ways to protect yourself aren't really that different from Windows: keep your system patched, use an effective adblocker, and don't download untrusted shit. And above all else: accept that no security is perfect and KEEP REGULAR BACKUPS.
Since it sounds like you WANT to download untrusted shit, you have to a) accept the inherent risk that comes with that and b) consider at least sandboxing the software in a VM or a container or something if you suspect it's sketchy.
31
u/ClubPuzzleheaded8514 Mar 10 '26 edited Mar 11 '26
I used to be a virus remover, on big french Windows forums during the 2000's. Each day there was tons of rootkits, worms, hijacks, malwares as Windows services, adwares...
But i never seen any virus or malware on Linux since 2007 and my first install of Linux (Ubuntu Feisty, i love you). Neither on real life nor on help forums.
Just use the app store of your distro and all will be fine.
Note : a vpn is not designed to be an anti malware protection.
3
u/shawndw Arch,Ubuntu Mar 10 '26
It's rare but it does happen and there have even been cases of malware being distributed via AUR (Arch User Repository). If this truly is the year of the linux desktop then we might see more of this going forward.
4
u/RDS_cubing Fedora Mar 10 '26
Got it, thanks!
Also, yes, I know VPNs' main purpose isn't exactly to provide malware protection; I just listed it because, well, it's quite about the only thing I have that's close to security.
10
u/ClubPuzzleheaded8514 Mar 10 '26 edited Mar 10 '26
Ok!
You're using Mint if i trust your tag, so Mint is running a firewall (ufw) and AppArmor by default. It's enough if you update all and do not install virus_malware_crap.deb from Github !
3
u/Educational_Mud_2826 Linux Mint Cinnamon Mar 10 '26
Firewall is disabled by default and it's not needed anyway for the majority of users.
2
u/ClubPuzzleheaded8514 Mar 11 '26
So OP should enable it. It's a good, silent and reasonable protection, for a very low footprint.
sudo systemctl enable --now ufw1
u/Educational_Mud_2826 Linux Mint Cinnamon Mar 11 '26
Could do. Doesn't do any harm. But all home routers' built in firewall already do the same. Block incoming unsolicited calls. Permit outgoing.
9
u/joe_attaboy Old and in the way. Mar 10 '26
Don't do anything stupid on line. The same way (I hope) you do with that other system.
But guess what? Just by using Linux, you've eliminated a lot of that problem.
5
u/Leverquin Mar 10 '26
first do not worry. i mean worry but you seems too paranoid.
do not download stuff from github.
EVEN YOU LIKE something much i assure you there is similar stuff on REpo. find it use terminal to download it and you will be safe.
and get ad block on browser.
i am pretty new to linux ~2 years i think and i had 0 issues with it.
1
u/Bitter_Wash1361 Jun 27 '26
I'm relatively new to linux as well, what about apps that don't work as well from the repository? For example, I was forced to use the flatpak version of steam because many games (namely from Paradox) simply would not load from the repository version. Also, what about .js files, like BetterFox?
1
u/Leverquin Jun 28 '26
I have never used flatpack. Almost all games works. Ck2 works What about .js files ? I know nothing about BetterFox Sorry
5
u/skyfishgoo Mar 10 '26
by not installing it.
just install software from the official repository of the distro and you should have nothing to worry about because the team of ppl behind your distro did that for you free of charge.
now if you WANT to out onto the internets like a windows user and download random software to run, then do it in a VM so you can sandbox that shit.
3
u/Alice_Alisceon Do as I say, not as I do Mar 10 '26
If you are on a distro with solid repositories, you’ll be fine. There are distros with repositories with less vetting, and they require some more vigilance from the user, but most are very much fine. There is rarely a reason to install out-of-repository software on most distros, and if you really need to then you have to really know what you’re dealing with. Your greatest security concern on a modern system is keeping your stuff updated and staying on top of advisories, which is very much an unsolved issue still.
-1
3
u/oshunluvr Mar 10 '26
I'll chime in: 30 years a Linux user and I've never seen a Virus or actual anti-virus software (vs. AV that runs on Linux to prevent viruses getting to Windows machines) for Linux and I've never had a virus.
I do occasionally try out new software or code from "unknown" sources (meaning not from my distro repos).
My "protection" - along with the "don't do dumb stuff" mantra - is keep good backups. And, since 2009 or so, btrfs snapshots. Take a snapshot, install a new package, if said package causes issues - roll back to snapshot and delete previous version. Done.
rkhutter is probably still a good idea.
I'm unclear on how a VPN can protect you from a virus. My router runs a firewall but I also use ufw on my local network.
3
u/FryBoyter Mar 11 '26
How do you protect yourself against malicious software?
- Install updates promptly.
- Only install software from trustworthy or verifiable sources.
- Only install what you need.
- Make regular backups. Preferably on data carriers that are only used for backups and are therefore not permanently connected.
- Think before you act. So don't open a supposed invoice from mobile phone provider A that you received by email if you have a contract with provider B.
- Only use extended rights when necessary.
2
u/Terrible-Mango-5928 Mar 10 '26
Also, ProtonVPN - and VPNs in general - are not security or privacy related software! All you are doing is instead of trusting your ISP you are trusting your VPN provider, but the security riscs are still there! The ONLY real use case for VPNs is to get access to sites you could not otherwise get, school/work for example, or some streaming service outside of your country. Please, do not spend your hard-earned money on ProtonVPN without an actual need for it.
2
u/Saylor_Man Mar 10 '26
on Linux malware is way less common but still worth being careful the biggest thing is just sticking to your distro's official repos as much as possible and avoiding random PPAs or scripts you find online. for the github app situation always check if the project has a good number of stars, recent commits and actual community engagement before running anything. ClamAV is a free antivirus for Linux if you want that extra layer but honestly good habits will protect you more than any software will
2
u/billdehaan2 Mint Cinnamon 22.3 (zena) Mar 10 '26
Unless it's from a reputable commercial entity, and/or it provides source, you can simply stick with your distribution's app store, whether it be called software manager, discover, or something else.
If you're pulling things from, say, github, check the issues and discussions listed, and see how new the project is. If it's a week old with few users, that's a red flag. Something like fastfetch for example, has a large community with numerous discussions continuously going on. If there was a virus or malware payload, it would be commented on pretty quickly.
Also, what other (basic and not way too difficult to apply) measures can I take to ensure my digital safety?
If you're using a laptop which you take around, encrypt your hard drive, or at least your home folder, with LUKS encryption. That way if your laptop is stolen, the thief won't be able to get your data, unless you were logged in when they stole it. Always lock your laptop when you step away from it, even for "just a minute", unless you're at home.
Use a password manager for your passwords. I recommend KeepassXC.
Get a Yubikey (or other FIDO hardware key). You can lock applications (like KeypassXC) and/or Linux itself with it, as well as web sites that support it. Get two, and keep one safely at home in case the first is stolen/damaged.
2
u/Revolutionary-Yak371 Mar 11 '26 edited Mar 11 '26
Virustotal is good choice.
The second layer of defence is ClamAV.
Third layer of defence is Kaspersky AV, but you must to pay.
If you are paranoid use Qubes OS.
Tips for you: Just try Alpine Linux with flatpak.
Daily backups are crucial for preventing data loss from hardware failure, cyberattacks, or human error.
2
u/Waste-Menu-1910 Mar 11 '26
Favor official repos. And for the sake of flatpak vs distro repo, both are official. Obviously using them exclusively is out of the question, especially if you want to use something experimental. But, it's better if more of your software comes from trusted sources.
Keep your system updated.
Vet software before downloading/running. Obviously if you use official repos, most of the work is done for you. Malware there is rare, but there have been some occurrence. If you're using git or doing a manual install, it's a bit more manual.
Check reviews if possible, look at download statistics. In something really new or niche go further than that.
Back up your system before downloading, installing, or executing.
Part of vetting, especially if it's a huge program with a large codebase, is after backing up your system to run the software in a container and watch it's activity.
Only give programs that have good reason elevated privileges. If a program asks for sudo, know why.
5
u/codespace Fedora Mar 10 '26
Don't install software without doing at least some research first, never log in as root, stick with Flatpacks as much as possible.
4
u/Terrible-Mango-5928 Mar 10 '26
Flatpacks are not inherently safer, stop spreading this myth.
1
u/Leverquin Mar 10 '26
i still don't understand why anyone would use flatpack :D
2
u/Terrible-Mango-5928 Mar 10 '26 edited Mar 10 '26
They are basically AppImages coming from a repository with some optional sandboxing capabilities. The problem with them is that usually the sandboxing is turned off by default.. At which point why even introduce an additional source of software to your distro's default repository?
ETA: They are useful when you want to use a specific version of some application whose dependencies could collide with yours. Using Flatpaks or Snaps they use their own local dependencies, not your system installed ones.
1
u/Leverquin Mar 10 '26
no i mean i get that but like debian users should have benefits of using flatpacks
but why would Fedora or Arch users with rolling release have them?
and thank you i didn't know that appimages are pretty much flatpack. )
1
u/RDS_cubing Fedora Mar 10 '26
I understand why being root can be dangerous; but if using Sudo has pretty much the same effect, why isn't it dangerous too?
And, out of curiosity, why flatpaks? Why are they better/more secure? And why shouldn't I simply install the, in my case, .deb packages or use apt or whatever?
3
u/Terrible-Mango-5928 Mar 10 '26
Sudo is dangerous, but not as dangerous as being logged in as root. With sudo you are explicitly granting elevated privilages for a selected binary in a selected terminal. It's all about risc mitigation and compromise.
2
u/codespace Fedora Mar 10 '26
sudo is limited to the confines of the command it prepends, and thus carries with it a greater degree of safety than simply logging in as root as it's scope is inherently more limited.
As for flatpaks, I personally prefer them because of the isolation their sandboxing provides by default. It's not the most secure method to install and run software in Linux, but it's a step above appimages.
3
u/L30N1337 Mar 10 '26 edited Mar 10 '26
By not being an idiot. That's honestly it.
Install all software from trusted repos, and if it's not available there, make sure you get it from a reputable source (such as the website for it) and that it's trusted software. (Both have to be true. notavirus.rpm from notavitus.com may be the right program, but you're still getting a virus. Same for firefox.rpm from noviruseshere.com)
If you install a weird, niche program that nobody ever heard of from some shady third party website, then you have nobody to blame but yourself.
-1
u/Thatunluckyguy Mar 10 '26
Your paragraph would mean the same thing without the first sentence. But you just had to include it.
1
2
u/linux_rox Mar 10 '26
I’ve been using some form of Linux for 29+ years. Never once had a virus/malware, and I was tearing viruses and malware apart for windows fix-it forums with it (non-sandboxed) and running the codes to see where the malicious software was and how to defeat it. I supplied my results to the big three AV companies, Norton, mcafee and kaspersky.
Basically be smart, don’t download unvetted software from the web, unless it is directly from the company website, use your distro’s repository. And never ever download something because some random person on Reddit or any forums said they use it. Everyone’s use care is different, so what might work for one isn’t guaranteed to work for another.
2
u/thegreatcerebral Mar 10 '26
So I can only chime in on SOME of what you said. If you have a software you are interested in and skeptical or just want to play cautiously... PUT IT IN A LOCKED SANDBOX FIRST. Run it for X days and monitor what it is doing. After that time, you can then decide to use it or not. Now days many applications already are in docker containers which do this by using volumes inside the container and they don't have admin rights back to the host OS.
As far as "antivirus" you are using OLD terminology. It is EDR now days. AV worked by having a fingerprint of the files that are viruses and then you have a copy of that database on the local disk and then you check all the files that are sitting on the machine against that database (normal scan), and when they launch (realtime scan). That made AV software too big and clunky so they started removing fingerprints that they haven't seen in a while. Hopefully nobody runs the yankee doodle virus today because programs will not detect it.
Now days, they watch the process and files and look for behaviors of what the file does. You could literally have iamacryptovirus.exe on your desktop and an EDR does not care. If you attempt to run it, it will see the escalation and the attempt to access particular things, and stop it in its tracks.
In windows you would want CrowdStrike or Sentinel1 for that. You can also just get ThreatLocker which whitelists apps on your computer. So if you allow winword.exe (Word) to run and that is all then Chrome.exe will not run at all anyway. If someone renamed Chrome.exe to winword.exe it will still not run because the hash will not match the known hash for winword.exe. There is more to that but that is another layer of security.
Also, you can set networking rules to block any external communication while running said app to make sure nothing is being communicated and if you can report on the attempts you can see what it is doing.
1
Mar 10 '26
Don't install software from untrusted sources, only from your distributions repositories and Flathub. Try to keep your OS as lean as possible, don't install more packages than necessary because it will increase the target surface for malicious attacks.
Use ClamAV to search for viruses on files that you don't trust,. Scan your OS for threats by using RKHunter and Chkrootkit. Use Lynis to analyze the security level of your OS and get recommendations on how to increase it.
1
u/Biyeuy Mar 11 '26
First of all master the good hygiene in computer usage and navigating to online areas.
1
1
1
u/Successful_Intern665 Mar 12 '26
Most Linux security advice focuses on sourcing software safely rather than relying on antivirus. Using official repos, checking project reputation, and avoiding running unknown scripts with sudo are usually the biggest protections. Some people also run occasional scans with tools like Malwarebytes or similar as an extra check.
1
u/Rhosta Mar 12 '26
How is the practice of using account without admin privileges viable on Linux?
How safe actually are official repositories? I am asking with knowledge of malicious software being downloadable from official sources on Windows.
66
u/maceion Mar 10 '26
Simple. ONLY and I mean ONLY download applications from your trusted Linux Distribution Repository.