🐧 Linux Security Guide

This guide assumes a persistent Linux install rather than Tails or Whonix — a reasonable choice if you understand the trade-off: no automatic amnesia between sessions, so the hardening has to be maintained by you, not baked into the OS's design the way it is with a live system. Start with the basics that matter more than they sound: keep the system updated (sudo apt update && sudo apt upgrade), and disable any service you're not actively using (sudo systemctl disable [service]) — every running service is attack surface whether or not you ever touch it. Lock down file permissions so your home directory isn't world-readable (chmod 700), and enable AppArmor or SELinux for mandatory access control, which constrains what a compromised application can reach even if it does get code execution. If SSH is enabled at all, disable root login over it and require key-based authentication only — password-based SSH is one of the most commonly brute-forced services on the internet, and fail2ban on top of that automatically blocks IPs making repeated failed attempts.

Set UFW to deny all incoming connections by default and allow outgoing: sudo ufw default deny incoming followed by sudo ufw default allow outgoing, then sudo ufw enable. Only open a port when something specific genuinely needs it — Tor itself requires no incoming ports at all for outbound browsing, so a default-deny stance costs you nothing for standard usage. For a meaningfully stronger setup, advanced users can configure iptables as a transparent proxy that forces all outbound traffic through Tor at the network level, regardless of whether any individual application remembered to route through it — the same principle behind Whonix's Gateway design, applied to a single machine instead of two separate VMs. That configuration is unforgiving of mistakes, so test it carefully before relying on it; a transparent-proxy rule with a gap in it can create a false sense of protection that's worse than knowing you have none.

BleachBit handles routine cleanup — temporary files, browser history, application caches — that otherwise accumulates quietly in the background of a persistent install in a way it never would on Tails. For anything more sensitive that needs to be actually gone, not just deleted, shred -vfz -n 5 filename overwrites the file's contents multiple times before removal, since a normal delete on most filesystems just removes the pointer to the data, leaving the underlying bytes recoverable until something else happens to overwrite that same disk space. None of that matters as much as full-disk encryption (LUKS), set up at install time — it's the single control that protects everything on the drive if the device itself is ever seized or stolen, and it's far easier to enable during installation than to retrofit afterward. A separate encrypted partition specifically for darknet-related files adds a second layer on top of that. Periodically audit installed packages and remove what you don't use (sudo apt autoremove) — every unused package is one more thing that could eventually carry a vulnerability you have no reason to be exposed to.