If you don’t need on-access scanning - and just want manual scanning of individual files that you’ve downloaded before you execute them, you can use Lenspect (available on flathub) which submits files to virustotal.com https://flathub.org/en/apps/io.github.vmkspv.lenspect
woodsb02
joined 1 year ago
#Vector.dev for collection. #VictoriaLogs for storage and searching.
I use Victoria Logs, with vector as the log forwarding agent
I agree - I don’t expose anything to the internet other than the WireGuard endpoint.
I’m only hosting services that my immediate family need to access, so I just set up WireGuard on their devices, and only expose the services on the LAN.
I used to expose services to the internet, until one of my #saltstack clients was exploited through a very recent vulnerability I hadn’t yet patched (only a week or so since it was announced). I was fortunate that the exploit failed due to the server running FreeBSD, so the crontab entry to download the next mailicious payload failed because wget wasn’t available on the server.
That’s when I realised - minimise the attack surface - if you’re not hosting services for anyone in the world to access, don’t expose them to everyone in the world to exploit.
For command line apps, I use paru for AUR. For desktop apps, if they’re available as a flatpak, I prefer that for the increased security provided by the sandbox. Otherwise I use Arch packages or AUR. I even uninstall GNOME apps (calendar, weather) from pacman, and install their flatpaks.