I want to make Linux my main OS. I’ve used Windows for decades. Since Vista or 7, the Windows security model is this, from what I understand:
- unprivileged programs have limited/no ability to do scary things to your computer. they might be able to read some data, but it’s not going to implant malware in the boot sequence for Windows.
- if a program wants escalation, it triggers a UAC popup and the user has to accept it. Remote programs cannot accept UAC on a physical person’s behalf. Escalated programs have admin level control and can do the scary things.
- As with any OS, there may be privilege escalation vulnerabilities that escalate (1) into (2).
I’ve only had Windows malware a few times since Win7, and the entry point was fairly avoidable. (Running a sketchy EXE, and a possible drive-by malware install via an advertisement. I could never prove the latter.)
I have never run a password on my Windows machines.
On any system, physical access is game over.
On Linux, the password is paramount. I’ve tried to understand the security model and I keep failing. Synthesizing from arch wiki
SSH
Equivalent to local physical access as the user. If it’s a sudoers or root account, it can do scary things. Not a threat if ssh is disabled or well secured (password or key pairs).
If a network has a well configured firewall (on the router), it should block ssh requests from outside the network unless the admin specifically wants SSH outside the network.
As with any OS, there may be bugs that allow remote access outside of SSH.
Local login / password prompts to physical users
Without a password, you can’t escalate to root and install new software. Some software, often dealing with hardware (smartctl) requires sudo/root to run.
Encrypted drives
Passwords can decrypt drives if they are encrypted.
Keyrings
Some DEs (KDE) offer a ‘keyring’ that stores passwords. It’s locked/encrypted with a password, usually the same as the login password.
So what am I missing? Is Windows + UAC + no password secure? What is Linux protecting us from by using passwords?
I would say the challenge is not in the architecture, but in the general fragmentation of the ecosystem. PolicyKit is basically an equivalent to UAC, but it’s not used universally by everything that needs elevated access.
Technically polkit now, after the breaking change. It’s really not equivalent to UAC, because UAC does this “secure desktop” thing. Y’know how it becomes just the UAC prompt and a background sometimes? With no taskbar or other programs? It does that to restrict access to UAC.
With polkit prompts, there’s nothing stopping a mouse automation tool from accepting the polkit elevation request, so passwordless would be a guaranteed escalation attack, I tested software clicking the polkit buttons. A tool can’t do that now only because it doesn’t now your password. Implementing a “secure desktop” in polkit would be a big change in the architecture of security for Linux.
Yeah, you’re not wrong. What I meant was that polkit is conceptually equivalent to UAC (at least it is supposed to solve the same problem). However it’s not really a fair comparison, as “polkit on Linux” isn’t one concrete thing you can analyse, it’s more of a pile of Lego blocks, which you could assemble any which way. In theory, with Wayland you could build a secure polkit agent that would not allow the malware to interact with it.
In reality this is a moot point, as most privilege elevation is still done via sudo anyway.
I use run0 and pkexec in the Terminal! Only sometimes though.