For example, ones that implement these guidelines? https://madaidans-insecurities.github.io/guides/linux-hardening.html
Alternatively, packages for Fedora that would set this up automatically
The Rocky or Alma (red hat clones) installation provides a set of hardening options to make the system compliant with various published standards. https://www.cyberithub.com/step-by-step-guide-to-install-rocky-linux-8-4/#Step_13_Security_Policy
My first thought is tails.
Qubes OS is pretty secure, everything you do in it is in virtual machines. That includes putting wifi and usbs in separate virtual machines. The root virtual machine is completely separated from everything else so any attackers can’t get access to it. There are also temporary virtual machines that you can use for unsafe stuff.
You might want to look at Debian and install only minimal components, and then just read through the security guide. If you care about security, I am not sure automated is the way to go, or at least not without some personal knowledge and a personal audit of the supposedly secure system. There is also the question of hardened against what meaning one has to consider your threats.
I’ll assume that you intend to use it as a traditional daily driver, as such Tails and Whonix will not be taken into consideration. Qubes OS will also be dismissed as it’s technically not a Linux distro. Though, it’s simply the best if you take security seriously.
Within the space of traditional Linux distros, the closest one would probably be Kicksecure. Madaidan even works on the distro, so I’d say it’s fair to assume that it upholds some of the values that are mentioned in the article.
Alternatively, packages for Fedora that would set this up automatically
Hehe, wishful thinking 😂. Uhmm…, bummer, but such a thing simply does not exist. Best we’ve got would be relying on so-called hardening scripts made by people that you don’t know but somehow trust for hardening your system. Honestly, I’m also -to a degree- guilty of this as I one day hope to either adopt these scripts or rebase to one of these hardened ‘immutable’ Fedora images (when they’re ready); Madaidan’s guidelines have actually been an initial inspiration for the scripts found in the first link, so yeah 🙂. Until then, our best bet would probably be relying on hardening guides like this one; the guide has been carefully written (and is still getting regularly updated) with consideration for all the different major distros one might be using. Alternatively, you might try to implement Madaidan’s guidelines directly. But, my previous attempts on Fedora didn’t bear the best results. Though your mileage may vary. Special shout out to Brace as it’s the closest thing to a package that does the hardening for you and works on multiple distros including Fedora. It’s maintained by the same people that have brought us the excellent DivestOS, so it’s trustworthy.
Thanks for this comment. I had not come across that hardening guide. It is extremely well written, and it’s worth a read, even if you have no intention of trying to harden your system, just to see what’s out there.
I’d consider most of it overkill for my threat model, but there are some things I’ll probably implement or try out just because they look pretty neat.
