Hardening Linux (Ubuntu, Debian, etc) OPSec

[TheVikingsofDW]

1. Erasing Terminal History: This step is so important for OPSec. Running the commands below will erase your terminal history and everytime will be fresh:

Code: Select all

unset HISTFILE
unset SAVEFILE
rm ~/.bash_history
ln -s /dev/null ~/.bash_history
export HISTFILESIZE=0
export HISTSIZE=0
export HISTFILE=/dev/null
export SAVEFILE=/dev/null

Kali

Code: Select all

rm ~/.zsh_history

Kali

Code: Select all

ln -s /dev/null ~/.zsh_history

2. Apply updates each boot up: In terminal put

Code: Select all

sudo apt update && sudo apt upgrade -y

3. System Cleaner: We'll use BleachBit, the same program as Windows 10/11. You gotta launch this every shutdown before.
Installation:

Code: Select all

sudo apt install bleachbit -y

Select every option besides "Free disk space" and clean it.

4. Remove snooping packages: Open terminal and type

Code: Select all

sudo apt purge apport popularity-contest -y
sudo apt autoremove

5. Install an Anti-Virus: Open terminal and type

Code: Select all

sudo apt update
sudo apt install clamav clamav-daemon -y

Later, you gotta update ClamAV virus definations and this should be ran before each scan to ensure the latest updates, for this, type in terminal:

Code: Select all

sudo service clamav-freshclam stop
sudo freshclam

For produce a scan summary:

Code: Select all

clamscan -r -i

And, type this for remove any malicious files:

Code: Select all

clamscan -r -i --remove=yes /

6. Turn off some default annoyed settings:
Launch settings, then privacy and change "Location Services" to OFF.
Click on "File History & Trash" and disable "File History".
Finally, click on "Diagnostics" and change to "Never".

Summary for hardening Linux:
- Always, keep your OS updated and apply all new updates.
- Save everything to an encrypted USB and avoid writing to the main HD.
- Disable Bluetooth.
- Install Anti-Virus/Anti-Malware.
- Setup a BIOS password and disable booting from USB on start-up (obviously, if you're not booting an OS from USB).
- Run BleachBit as an Admin before each shutdown.