The article discusses mainly SELinux vs AppArmor, but it also touches on Debian’s AppArmor configuration deficienies.
The ugly truth is that security is hard. It’s tedious. Unpleasant. And requires a lot of work to get right. Debian does not do enough here to protect users.
Debian’s security is good that as far as I know it isn’t designed to spy on or betray users, but out-of-the-box Debian has too many insecurities. Debian users need to do an extreme amount of hardening (days of effort) to make it anywhere near secure. For this reason I cannot recommend vanilla Debian to most people.
With the caveat that not all of below are always sensible, examples of insecure defaults:
- The volume of installed packages is far larger than needed.
- Networking, Firewire, Bluetooth etc are enabled at boot.
- Anyone can gain root privileges using
su. - The firewall accepts all network traffic.
- IPv6 leaks network interfaces’ MAC addresses.
- MAC addresses are not randomised.
- Various insecure kernel parameter settings are in effect.
- Debian’s APT repositories are not bound to a signing OpenPGP key.
- System logs, temp files and caches persist for far longer than needed.
- Recently used files, shell commands and other history are logged.
Maybe Debian can be secure when configured properly. Are there any Debian derivatives that have extreme security hardening? Tails exists, but I don’t know to what extent it has been hardened.