I've used Linux for 30 years, and this free security suite does it all - almost perfectly
Follow ZDNET: Add us as a preferred source on Google.
ZDNET key takeaways
- BastionGuard promises serious security for Linux desktops.
- Scans, VPNs, backups, updates, a password manager, and more are available.
- Does this free platform live up to the promises, or does it need more time?
I've been using Linux for nearly 30 years, and I've only experienced a security breach once. That was after inheriting a misconfigured server with a rootkit. I never want to go through that again.
Over these three decades, I've seen more and more Linux vulnerabilities discovered, which is why I've been saying for some time now that if a computer -- or any device -- is connected to a network, it's vulnerable. With the advent of AI, vulnerabilities are easier to discover, which is a boon for both developers and hackers.
Consequently, I'm always looking for better ways to implement more robust security, especially security solutions for end users. Last week, I happened upon a tool called BastionGuard (Git repository here), described by its developer as "a Linux security platform designed for users who want deterministic behavior, explicit policies, and visible decisions -- not opaque 'trust us' protection."
Also: The third major Linux kernel flaw in two weeks has been found - thanks to AI
The BastionGuard platform includes BastionGuard Endpoint, BastionGuard Backup, BastionGuard Secure Connection, and BastionGuard Recovery Data.
BastionGuard 1.0 was released February 27, so having version 2.0 already is impressive. Over the past week, I've run this platform through its paces, and I can easily see it becoming a de facto standard for Linux desktop security over the coming years.
BastionGuard is not perfect yet. I ran into some issues that I couldn't resolve. But the developer is quite active, so I'm certain these problems will be fixed soon.
What does BastionGuard do?
Perhaps the easier question is: What does BastionGuard not do? BastionGuard provides real-time scanning, protects against ransomware, maintains an updated list of safe financial institutions to help protect against banking scams, and blocks potentially infected USB devices. It includes a phishing scanner, a password manager, backup (via snapshot management), a Samba scanner, WireGuard VPN, and ClamScam email scanning.
It's a security grab bag for the Linux desktop.
But does it work?
I ran several tests with the BastionGuard security features (I haven't yet tried the VPN, Backup, Samba, Banks, or USB tools) and found it did a good job of protecting me. I downloaded sample ransomware files (don't do this at home), and it detected them every time. However, I ran into a situation where, after one of the sample ransomware files was detected, I instructed BastionGuard to quarantine the file, and it quarantined the entire Downloads folder.
Also: Linux is getting a security wake-up call - why it was inevitable and I'm not worried
When that happened, I checked Security > Quarantine, only to find nothing listed. In other words, it seems that BastionGuard did something with my Downloads folder, and I cannot undo it. Good thing I was working in a virtual machine and not my actual desktop.
I eventually located my Downloads folder in ~/.local/share/BastionGuard/quarantine, which also contained all the malicious files I'd downloaded from the test site. The issue here is that the developer needs to fix the Security > Quarantine listing so it actually picks up the proper file; that way, users can actually see that something is happening (and can recover a file or folder if it is accidentally quarantined without having to do some sleuthing with the Linux CLI.
This issue must be resolved; otherwise, the application could go south very quickly.
Also: New to Linux? This 10-day checklist will help you settle in nice and easy
I also tested the anti-phishing tool and found it spot-on. All you do is type a web address into the Phishing Scanner, hit enter on your keyboard, and wait for the results. I ran through several known phishing sites, and it caught every one.
To use the Identity Leak Monitoring tool, you'll need an HIBP and LeakCheck API key, so I wasn't able to test that functionality.
The password manager is basic, but it works well and allows you to import vaults from CSV files. The WireGuard VPN required that I install the wireguard-tools package, which was simply a matter of running sudo apt-get install wireguard-tools on a Ubuntu-based system. Once I did that, I was able to easily connect to the WireGuard server on my LAN.
My final observation
BastionGuard is a massive platform that offers to take care of a lot of security for your Linux desktops. Although it might seem overkill for some, for those looking to add security to nearly every aspect of their desktops, this could be a brilliant option.
Also: How a virtual LAN can better protect your home network
Yes, BastionGuard has some issues, and I certainly hope the developer addresses them promptly so this tool can become more widespread on the Linux desktop. As AI continues to help both white-hat and black-hat hackers, the need for stronger security on Linux will continue to grow.
I plan to keep an eye on BastionGuard (and further test its other tools) to see what happens in future releases. In the meantime, it's free to try and use BastionGuard. You can download installers (for free) for Ubuntu-, Fedora-, Arch-, and openSUSE-based distributions from the official BastionGuard download page.