this post was submitted on 27 Nov 2024
130 points (96.4% liked)

Linux

48376 readers
1007 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

Hi all, we are hiring a remote worker and will be supplying a laptop to them. The laptop will be running a Debian variant of Linux on it.

We are a small shop and this is the first time we have entrusted somebody outside of our small pool of trusted employees.

We have sensitive client data on the laptop that they need to access for their day-to-day work.

However, if something goes wrong, and they do the wrong thing, we want to be able to send out some kind of command or similar, that will completely lock, block, or wipe the sensitive data.

We don't want any form of spying or tracking. We are not interested in seeing how they use the computer, or any of the logs. We just want to be able to delete that data, or block access, if they don't return the laptop when they leave, or if they steal the laptop, or if they do the wrong thing.

What systems are in place in the world of Linux that could do this?

Any advice or suggestions are greatly appreciated? Thank you.

you are viewing a single comment's thread
view the rest of the comments
[–] dan@upvote.au 25 points 19 hours ago (1 children)

As someone else said, I'd go with an MDM vendor instead of trying to build something yourself.

The most secure thing would be to have the person connect to a remote server and do all their work on the remote server, essentially just using the laptop like a thin client.

[–] mub@lemmy.ml 4 points 15 hours ago* (last edited 15 hours ago) (2 children)

This is the only reliable solution. To expand:

  1. Provide a Laptop with Windows on it, because that is easier to lockdown.
  2. apply desirable OS lock downs like blocking usb ports prevent storage devices, don't give the user admin rights, etc.
  3. Setup a VPN server (openvpn should do) and configure the laptop with a VPN client. Configure the client so it blocks network connections that don't go via the VPN. If you want to give them internet access you'll need a proxy and firewall and DLP solution. At this point it all gets very complex and expensive.

The real answer is you are probably screwed without investing a bunch of time, effort, and cost.

You might get away with more basic security measures if the user has very limited IT knowledge.

I suggest getting legal advice before you give the user access to your data in the manner you intend.

[–] horse_battery_staple@lemmy.world 1 points 4 hours ago (1 children)

Windows is absolutely more difficult to secure than linux. I can restrict access down to the kernel level in linux. Windows has no such granularity

[–] mub@lemmy.ml 1 points 51 minutes ago (1 children)

"Easy" from the point of view there a lots of off the shelf tools to help you do it that are easy to understand.

[–] horse_battery_staple@lemmy.world 1 points 6 minutes ago

That Crowd strike outage was pretty evident of how easy windows is to secure. Linux had the same failure but since admins are able to secure the OS in a more granular way and can update packages in situ without touching the registry, Linux users could still boot into their OS and patch the broken file. No such luck in Windows.

[–] sudneo@lemm.ee 2 points 7 hours ago (1 children)

DLP solutions are honestly a joke. 99% of the case they only cost you a fortune and prevent nothing. DLP is literally a corporate religion.

What you mentioned also makes sense if you are windows shop running AD. If you are not, setting it up to lock 1 workstation is insane.

Also, the moment the data gets put on the workstation you failed. Blocking USB is still a good idea, but does very little (network exfiltration is trivial, including with DLP solutions). So the idea to use remotely a machine is a decent control, and all efforts and resources should be put in place to prevent data leaving that machine. Obviously even this is imperfect, because if I can see the data on my screen I can take a picture and OCR it. So the effort needs to go in ensuring the data is accessed on a need basis.

[–] mub@lemmy.ml 1 points 31 minutes ago* (last edited 28 minutes ago)

That was kinda my point. Securing a laptop that will have access to data you want to protect from loss is a near bottomless pit of issues. There comes a point you have to do a risk assessment and apply a level of security that meets your legal requirements and contractual obligations. I'm sure this is all doable on Linux as well but the low cost / easily available tools are mostly for Windows.

I suspect that taking the "secured remote session" approach is probably good enough for their needs. It just needs a client app you can trust to respect the security rules they want to enforce (no screen shots, no screen recording, no data transfers for any sort, etc).

OCRing what is on screen is not really stoppable unless you force them to keep their camera on so you can monitor them 24/7. But if you try hard enough there is usually a way around most security measures.

Either way, they need to decide what the risk impact vs likelihood profile is, and what the business can tolerate. They'll need to discuss it with legal and data protection folks to assess that.

One tip is to embed records and values that look meaningful, but are unique, into the copy of the data given to the specific employee. This can be used to potentially prove that a data breach was a result of something that employee did. We like to put QUID's as invisible watermarks in document headers. These trigger our DLP systems which is always funny cos its usually an employee who is leaving and wants to keep something. I love those conversions.