{"id":1460,"date":"2025-12-09T19:47:56","date_gmt":"2025-12-09T19:47:56","guid":{"rendered":"https:\/\/www.woodcentral.com\/-\/peter\/?p=1460"},"modified":"2026-06-05T09:47:51","modified_gmt":"2026-06-05T09:47:51","slug":"hardening-cachyos","status":"publish","type":"post","link":"https:\/\/www.woodcentral.com\/-\/peter\/hardening-cachyos\/","title":{"rendered":"Hardening CachyOS"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Here\u2019s a <strong>CachyOS minimal-hardening security script and checklist<\/strong> you can apply immediately. It\u2019s designed to keep the system fast, secure, and minimal, without installing unnecessary antivirus software. Either delete or use the comment character (#) to preface any lines you do not want to execute&#8211;similar to the existing comments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can save this as <code>cachyos-security.sh<\/code> and run it with <code>sudo bash cachyos-security.sh<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n# CachyOS Minimal Security Hardening Script\n# Applies firewall, service hardening, updates, and optional sandboxing\n# WARNING: Review before running; adjust services as needed.\n\necho \"=== CachyOS Security Hardening Script ===\"\n\n# -------------------------------\n# 1. Update system\n# -------------------------------\necho \"&#91;*] Updating CachyOS \/ Arch packages...\"\npacman -Syu --noconfirm\n\n# -------------------------------\n# 2. Install and configure firewall\n# -------------------------------\necho \"&#91;*] Installing UFW firewall...\"\npacman -S --noconfirm ufw\nsystemctl enable --now ufw\nufw default deny incoming\nufw default allow outgoing\nufw enable\n\n# -------------------------------\n# 3. Disable unnecessary services\n# -------------------------------\necho \"&#91;*] Disabling unused services...\"\nSERVICES=(\"bluetooth\" \"cups\" \"avahi-daemon\" \"ssh\") # adjust SSH if needed\nfor svc in \"${SERVICES&#91;@]}\"; do\n    systemctl disable --now $svc\ndone\n\n# -------------------------------\n# 4. Enable AppArmor (optional)\n# -------------------------------\necho \"&#91;*] Installing AppArmor...\"\npacman -S --noconfirm apparmor\nsystemctl enable --now apparmor\n\n# -------------------------------\n# 5. Browser advice (manual step)\n# -------------------------------\necho \"&#91;!] Recommended browser steps:\"\necho \"  - Firefox: uBlock Origin + HTTPS-Only Mode + Arkenfox user.js\"\necho \"  - Chromium: uBlock Origin, disable remote debugging, avoid unknown extensions\"\necho \"  - Avoid running random scripts from unknown websites\"\necho\n\n# -------------------------------\n# 6. SSH hardening (if used)\n# -------------------------------\nSSH_CONFIG=\"\/etc\/ssh\/sshd_config\"\nif systemctl is-active --quiet sshd; then\n    echo \"&#91;!] Hardening SSH...\"\n    sed -i 's\/^#PasswordAuthentication yes\/PasswordAuthentication no\/' $SSH_CONFIG\n    sed -i 's\/^#PermitRootLogin yes\/PermitRootLogin no\/' $SSH_CONFIG\n    systemctl restart sshd\n    echo \"  - SSH now key-only and root login disabled\"\nfi\n\n# -------------------------------\n# 7. Optional systemd sandboxing example\n# -------------------------------\necho \"&#91;!] Example sandboxing:\"\necho \"  systemd-run --user --property=PrivateNetwork=yes --property=ProtectHome=yes &lt;app&gt;\"\n\n# -------------------------------\n# 8. Cleanup\n# -------------------------------\necho \"&#91;*] Cleanup complete. Review browser, AUR, and manual steps.\"\necho \"&#91;*] Security hardening finished!\"\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Manual Checklist for CachyOS<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Firewall:<\/strong> Enabled (UFW) with default deny incoming.<\/li>\n\n\n\n<li><strong>Services:<\/strong> Disable Bluetooth, CUPS, Avahi, SSH (unless used).<\/li>\n\n\n\n<li><strong>AppArmor:<\/strong> Enabled for extra sandboxing.<\/li>\n\n\n\n<li><strong>Browser:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Firefox: uBlock Origin, HTTPS-Only, Arkenfox user.js<\/li>\n\n\n\n<li>Chromium: uBlock Origin, disable remote debugging<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>AUR:<\/strong> Only install trusted\/popular packages. Avoid random scripts.<\/li>\n\n\n\n<li><strong>Updates:<\/strong> Regular <code>sudo pacman -Syu<\/code>.<\/li>\n\n\n\n<li><strong>SSH:<\/strong> Use keys, no password login, disable root login.<\/li>\n\n\n\n<li><strong>Sandboxing optional:<\/strong> <code>systemd-run --property=...<\/code> for risky apps.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n","protected":false},"excerpt":{"rendered":"<p>Here\u2019s a CachyOS minimal-hardening security script and checklist you can apply immediately. It\u2019s designed to keep the system fast, secure, and minimal, without installing unnecessary antivirus software. Either delete or use the comment character (#) to preface any lines you do not want to execute&#8211;similar to the existing comments. You can save this as cachyos-security.sh &#8230; <a title=\"Hardening CachyOS\" class=\"read-more\" href=\"https:\/\/www.woodcentral.com\/-\/peter\/hardening-cachyos\/\" aria-label=\"Read more about Hardening CachyOS\">Read more<\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,2],"tags":[],"class_list":["post-1460","post","type-post","status-publish","format-standard","hentry","category-linux","category-technology"],"_links":{"self":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/1460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/comments?post=1460"}],"version-history":[{"count":0,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/1460\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/media?parent=1460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/categories?post=1460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/tags?post=1460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}