Security

Security in Soplos Linux

Soplos Linux inherits the robustness and security of Debian. However, it is always recommended to take additional measures to protect your equipment, especially if you connect to public networks.

This guide will help you implement multiple layers of security to protect your system against common threats and vulnerabilities.

Soplos Welcome — Security Tab

Soplos Welcome includes a dedicated Security tab that lets you install and manage the most important security tools with a single click. No terminal required.

Open Soplos Welcome from the application menu and navigate to the Security tab. The following tool groups are available:

• System Backups: Timeshift, Grub BTRFS, Deja Dup, BTRFS Assistant
• Firewall: UFW (command-line) and GUFW (graphical interface)
• VPN: ProtonVPN, Surfshark, Mozilla VPN
• System Cleaning: BleachBit, Stacer, Soplos Sys Cleaner
• Antivirus: ClamTK, ClamUI, rkhunter

Security Fundamentals

Why Security Matters

Even though Linux systems are generally more secure than other operating systems, no system is completely immune to threats. Security is essential to:

• Protect your personal data and privacy
• Prevent unauthorized access to your system
• Avoid malware and exploitation
• Maintain system integrity and stability

Debian's Security Model

Soplos Linux benefits from Debian's strong security foundation:

• Security updates: Regular patches for vulnerabilities
• Package verification: All packages are cryptographically signed
• Minimal default installation: Only essential services enabled
• Strong permissions model: Proper file and user permissions by default

Defense in Depth

Security is not a single solution but multiple layers of protection:

1. Physical security: Protect hardware access
2. User security: Strong passwords and account policies
3. Network security: Firewall and encrypted connections
4. Application security: Keep software updated
5. Data security: Encryption and backups

Firewall (UFW)

Soplos Linux comes with UFW (Uncomplicated Firewall) installed by default, but inactive to avoid initial conflicts with user network services.

Basic UFW Commands

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status

# Check detailed status with numbered rules
sudo ufw status numbered

# Disable firewall
sudo ufw disable

Managing Rules

Allow Connections

# Allow specific port
sudo ufw allow 22/tcp        # SSH
sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS

# Allow port range
sudo ufw allow 6000:6007/tcp

# Allow from specific IP
sudo ufw allow from 192.168.1.100

# Allow specific IP to specific port
sudo ufw allow from 192.168.1.100 to any port 22

Deny Connections

# Deny specific port
sudo ufw deny 23/tcp         # Telnet

# Deny from specific IP
sudo ufw deny from 192.168.1.50

Delete Rules

# Delete by rule number
sudo ufw status numbered
sudo ufw delete 3

# Delete by specification
sudo ufw delete allow 80/tcp

Application Profiles

UFW includes predefined profiles for common applications:

# List available application profiles
sudo ufw app list

# Allow application
sudo ufw allow 'OpenSSH'
sudo ufw allow 'Apache Full'

# View application info
sudo ufw app info 'OpenSSH'

Default Policies

# Set default policies (recommended)
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow routed packets (for router/gateway)
sudo ufw default deny routed

Logging

# Enable logging
sudo ufw logging on

# Set log level (low, medium, high, full)
sudo ufw logging medium

# View firewall logs
sudo tail -f /var/log/ufw.log

Graphical Management: GUFW

If you prefer not to use the terminal, Soplos Linux makes it easy to install GUFW, a simple graphical interface to control the firewall.

With this, your system will block unsolicited incoming connections by default, significantly improving your security.

Portmaster is an application-level firewall that monitors and controls network connections per application. Unlike UFW which filters ports, Portmaster lets you allow or block internet access for each individual application.

Install from Soplos Welcome → Security → Firewall → Portmaster, or manually:

VERSION=$(curl -s https://updates.safing.io/stable.v3.json | python3 -c "import json,sys; print(json.load(sys.stdin)['Version'])")
wget -O /tmp/portmaster.deb "https://updates.safing.io/latest/linux_amd64/packages/Portmaster_${VERSION}_amd64.deb"
sudo apt install /tmp/portmaster.deb

VPN

A VPN (Virtual Private Network) encrypts your internet traffic and hides your IP address. It is especially recommended when using public Wi-Fi or when you want to protect your privacy online.

All three VPN clients below can be installed directly from Soplos Welcome → Security → VPN:

Privacy-focused VPN from the team behind ProtonMail. Offers a free tier with unlimited bandwidth, a strict no-logs policy, and open-source clients. Installed via the official ProtonVPN repository.

# Install ProtonVPN CLI
wget -q -O - https://repo.protonvpn.com/debian/public_key.asc | sudo gpg --dearmor -o /usr/share/keyrings/protonvpn-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/protonvpn-archive-keyring.gpg] https://repo.protonvpn.com/debian stable main" | sudo tee /etc/apt/sources.list.d/protonvpn.list
sudo apt update
sudo apt install proton-vpn-gnome-desktop

Fast and affordable VPN with unlimited simultaneous connections, no-logs policy, and a built-in ad and malware blocker (CleanWeb). Installed via the official Surfshark repository.

# Install Surfshark
curl -f https://downloads.surfshark.com/linux/debian-install.sh | sudo sh

VPN service from Mozilla built on the WireGuard protocol. Subscription-based, no-logs policy, and backed by Mozilla's privacy standards. Installed as a Flatpak from Flathub.

# Install Mozilla VPN (Flatpak)
flatpak install flathub org.mozilla.vpn

Antivirus

Linux systems are significantly less susceptible to viruses than Windows, but antivirus software remains useful for scanning files shared with Windows users, checking email attachments, and auditing servers.

ClamAV is the standard open-source antivirus engine for Linux. Soplos Welcome installs one of two graphical frontends:

• ClamTK: graphical interface for ClamAV (GTK). Installs clamav + clamtk, includes a virus definition updater. Available in all three distros.
• ClamUI: modern Flatpak graphical interface for ClamAV (io.github.linx_systems.ClamUI). Alternative to ClamTK with a cleaner layout.

# Install ClamAV and ClamTK
sudo apt install clamav clamtk

# Update virus database
sudo freshclam

# Scan a directory
clamscan -r ~/Downloads

# Scan and remove infected files
clamscan -r --remove ~/Downloads

System Backups

Creating regular system snapshots is one of the most effective protection measures — it lets you restore a working state after a bad update, configuration mistake, or ransomware attack.

All backup tools can be installed from Soplos Welcome → Security → System Backups. For detailed configuration see the Backup wiki page.

• Timeshift — creates automatic BTRFS or rsync snapshots of the system. Strongly recommended as the first thing to install after a fresh install.
• Grub BTRFS — integrates BTRFS snapshots into the GRUB boot menu, allowing you to boot directly into a snapshot without entering the desktop. Requires BTRFS filesystem.
• BTRFS Assistant — graphical tool for managing BTRFS subvolumes and snapshots. Requires BTRFS filesystem.
• Deja Dup — simple personal file backups with encryption support, suitable for backing up home folder to an external drive or cloud storage.

System Cleaning

Removing unnecessary files, logs, and package cache reduces disk usage and can eliminate traces of sensitive data. All tools below can be installed from Soplos Welcome → Security → System Cleaning.

• BleachBit — frees disk space and protects privacy. Cleans cache, cookies, temporary files, and browser data across many applications. sudo apt install bleachbit
• Soplos Sys Cleaner — Soplos-native system optimizer. Scans APT cache, old kernels, Flatpak revisions, logs, and unused locales, showing exactly how much space is recoverable per category before touching anything. Also includes hardware detection and firmware management.
• Stacer — modern system optimizer with resource monitoring, startup app manager, and cache cleaner. Installed as AppImage from ~/AppImages/Stacer.AppImage.
• Sweeper — simple KDE tool to clean temporary files and browsing history. sudo apt install sweeper

User Account Security

Strong Passwords

Use strong, unique passwords for all accounts:

• At least 12 characters long
• Mix of uppercase, lowercase, numbers, and symbols
• Avoid dictionary words and personal information
• Never reuse passwords across different accounts

Password Managers

Consider using a password manager to generate and store secure passwords:

• KeePassXC: Open-source, offline password manager
• Bitwarden: Open-source, cloud-based option
• pass: Command-line password manager

# Install KeePassXC
sudo apt install keepassxc

# Install Bitwarden (Flatpak)
flatpak install flathub com.bitwarden.desktop

sudo vs root

Soplos Linux follows Debian's approach:

• Don't use root account: The root account is disabled by default
• Use sudo: Run administrative commands with sudo
• Audit sudo access: Only trusted users should have sudo privileges

# View users with sudo access
grep '^sudo:' /etc/group

# Add user to sudo group
sudo usermod -aG sudo username

Account Lockout

Protect against brute-force attacks:

# Install fail2ban
sudo apt install fail2ban

# Check status
sudo systemctl status fail2ban

# View banned IPs
sudo fail2ban-client status sshd

SSH Security

If you use SSH for remote access, securing it is critical:

Key-Based Authentication

SSH keys are more secure than passwords:

# Generate SSH key (ED25519 is recommended)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Copy key to server
ssh-copy-id user@server_ip

# Test connection
ssh user@server_ip

SSH Configuration

Harden your SSH server configuration:

# Edit SSH config
sudo nano /etc/ssh/sshd_config

Recommended settings:

# Disable root login
PermitRootLogin no

# Disable password authentication (use keys only)
PasswordAuthentication no
ChallengeResponseAuthentication no

# Change default port (optional but adds security through obscurity)
Port 2222

# Allow only specific users
AllowUsers your_username

# Use Protocol 2 only
Protocol 2

# Restart SSH service
sudo systemctl restart sshd

# Check SSH status
sudo systemctl status sshd

Fail2ban for SSH

Fail2ban automatically bans IPs with too many failed login attempts:

# Install fail2ban
sudo apt install fail2ban

# Create local config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit configuration
sudo nano /etc/fail2ban/jail.local

Basic SSH jail configuration:

[sshd]
enabled = true
port = 22  # Change if you changed SSH port
maxretry = 3
bantime = 3600  # Ban for 1 hour
findtime = 600  # 10 minutes window

Automatic Updates

Keep your system secure by updating manually on a regular basis. See the System Updates guide for the recommended workflow.

System Hardening

Disable Unnecessary Services

Reduce attack surface by disabling unused services:

# List all running services
systemctl list-units --type=service --state=running

# Disable unnecessary service
sudo systemctl disable service-name
sudo systemctl stop service-name

# Check service status
sudo systemctl status service-name

File Permissions

Protect sensitive files:

# Secure home directory
chmod 750 ~/

# Find files with world-writable permissions
find / -perm -002 -type f -ls 2>/dev/null

# Find SUID files (potential security risk)
find / -perm /4000 2>/dev/null

AppArmor

Soplos Linux includes AppArmor for mandatory access control:

# Check AppArmor status
sudo aa-status

# List profiles
sudo aa-status --verbose

# Install AppArmor utilities
sudo apt install apparmor-utils

Encryption

Full Disk Encryption (LUKS)

LUKS encryption is best set up during installation, but can encrypt additional partitions:

File Encryption with GPG

Encrypt individual files or directories:

# Install GPG (usually pre-installed)
sudo apt install gnupg

# Encrypt a file
gpg -c sensitive_file.txt

# Decrypt a file
gpg sensitive_file.txt.gpg

# Encrypt with your GPG key
gpg -e -r your_email@example.com file.txt

Password-Protected Archives

# Create encrypted zip
zip -e archive.zip file1 file2

# Create encrypted 7z (stronger encryption)
7z a -p -mhe=on archive.7z files/

Privacy & Browsing Security

Browser Security

Essential browser security practices:

• Keep browser updated
• Use HTTPS Everywhere extension
• Install uBlock Origin for ad/tracker blocking
• Clear cookies regularly
• Avoid saving passwords in browser (use password manager)

Privacy-Focused Browsers

All browsers below are available in Soplos Welcome → Software:

• LibreWolf: Firefox fork hardened for privacy and security. No telemetry, stricter defaults than Firefox. Available as Flatpak (io.gitlab.librewolf-community).
• Helium: Chromium-based browser focused on privacy, with YouTube integration. Installed via .deb from the official GitHub releases.
• Brave Origin: privacy-focused browser by Brave with integrated AI assistant. Installed via the official Brave script.

# Install LibreWolf (Flatpak)
flatpak install flathub io.gitlab.librewolf-community

# Install Brave Origin
curl -fsS https://dl.brave.com/install.sh | FLAVOR=origin sh

DNS over HTTPS

Encrypt DNS queries to prevent monitoring:

# In Firefox settings:
# Privacy & Security > DNS over HTTPS > Enable
# Choose provider: Cloudflare or Next DNS

Physical Security

BIOS/UEFI Password

Set a BIOS password to prevent unauthorized changes:

• Access BIOS/UEFI setup (usually F2, F10, or DEL at boot)
• Set supervisor/administrator password
• Disable booting from USB/CD without password

Screen Lock

Configure automatic screen locking:

Quick lock shortcuts:

• XFCE: Ctrl+Alt+L
• Plasma: Ctrl+Alt+L or Meta+L
• GNOME: Super+L

USB Security

Monitoring & Auditing

System Logs

Regularly check system logs for suspicious activity:

# View authentication logs
sudo journalctl -u ssh -f

# Check failed login attempts
sudo journalctl _SYSTEMD_UNIT=sshd.service | grep "Failed"

# View all logs from today
sudo journalctl --since today

# Check kernel messages
sudo dmesg | tail

Rootkit Detection

Scan for rootkits and malware:

# Install rkhunter
sudo apt install rkhunter

# Update database
sudo rkhunter --update

# Run scan
sudo rkhunter --check

# Install chkrootkit
sudo apt install chkrootkit
sudo chkrootkit

Active Connections

# List active network connections
sudo ss -tulpn

# Check listening ports
sudo netstat -tulpn | grep LISTEN

# Show all active connections
sudo lsof -i

Common Threats & Protection

Phishing

Recognize and avoid phishing attempts:

• Verify sender email addresses carefully
• Don't click links in suspicious emails
• Check URLs before entering credentials
• Enable 2FA on important accounts

Malware on Linux

While less common than on Windows, Linux malware exists:

• Only install software from trusted repositories
• Avoid running scripts from unknown sources
• Never use curl | bash installation methods
• Check file permissions before executing

Social Engineering

The biggest security vulnerability is often human:

• Be skeptical of unexpected requests
• Verify identities through known channels
• Don't share sensitive information over phone/email
• Question urgency in requests

Security Best Practices Checklist

Daily Tasks

• Lock screen when away from computer
• Be cautious with email attachments and links
• Use VPN on public WiFi

Weekly Tasks

• Check for system updates: sudo apt update && sudo apt upgrade
• Review active network connections
• Check firewall status

Monthly Tasks

• Review installed packages and remove unused ones
• Check system logs for anomalies
• Update passwords for critical accounts
• Run rootkit scanner
• Verify backup integrity

Security Audit Checklist

Incident Response

If you suspect a security breach: