7

I used ZoneAlarm and a few other programs for a long time on Windows, just because I could control anything from system services to any software connecting to any IP address. I don't find the idea of info about my PC being sent to anyone, unless I explicitly say yes to it, and 99% of the time, I say no. I'm pretty sure it's the same (although less bad) on Linux, unless you use only a couple of the most simple programs (even browsers phone in your system info).

Now I'd like to switch to Linux, but I've spent the last 20 hours looking for a way to do it, and I couldn't find one.

I even thought of limiting networking on host OS, and use VirtualBox machine, but then I still have the same problem. I could use Windows on it, but then I could just use Windows anyway, as I don't think it phones back to Microsoft if I can block any Windows service using a program such as ZoneAlarm (for example).

TLTR: Is there a program on Linux that will give me a popup and save rules, like for example ZoneAlarm on Windows does?

EDIT, EXTRA INFO: My goal is to have a popup every time anything is trying to connect to my system or from my system to anything (local or not), asking me whether or not I want to allow it, and just for that time or if I want to save the rule. The reason is that I like to be in control of the data that applications send out about my system.

My use scenario is that I mainly do browsing, light programming and gaming (on Steam, therefore it would be VirtualBox and Windows), and use FOSS audio/video/photo editors. At this point, I'm wondering if it's worth using Linux at all, as I cannot find such an application, and on Windows I have full control of what is sent where on-the-fly. (I know it's not relevant to the question, but perhaps it will help someone help me, but if it's not appropriate, please tell me and I'll delete this bit)

Jack
  • 243
  • 3
  • 10
  • Unrelated, but I'm pretty sure Windows phones home before ZoneAlarm has a chance to start. – Panki Jan 08 '20 at 09:51
  • @Panki You can disconnect the ethernet cable until the PC boots up though. – Jack Jan 08 '20 at 09:54
  • 1
    https://linuxsecurity.expert/compare/tools/linux-application-firewalls/ (check if they are maintained, they might be half-abandoned). As for the reason it's not that popular on a classic Linux system, my opinion is it's because one doesn't install random unknown software – A.B Jan 08 '20 at 10:15
  • @A.B Thanks! I just checked out all the apps, and I only got one of them working, but unfortunately it only gives popups for a program, not per IP/port basis, which is better than nothing, but certainly not good enough. The amount of control I want is to choose whether I want program A to connect to IP Y. The reason is, for example, I don't want Firefox collecting info on my PC, or Brave, or Steam, or any other app. I think maybe Linux isn't good for general daily PC use in my case, it's great only for strict impersonal work. – Jack Jan 08 '20 at 11:06
  • 2
    Please erata (edits) into the question, so that some one new to the question sees it (without having to read all the comments). – ctrl-alt-delor Jan 08 '20 at 11:35
  • How are you installing programs? – ctrl-alt-delor Jan 08 '20 at 11:36
  • @ctrl-alt-delor I have edited the question, I hope it's not too much info, as I know that StackExchange has pretty strict rules about it! :) I would love to talk to someone who has been using Linux for a long time, just to have a discussion and ask a few questions for my specific use scenario. Right now I just feel rather confused about whether or not I should keep looking into Linux or just drop the whole project. – Jack Jan 08 '20 at 14:22
  • 1
    @ctrl-alt-delor I'm installing apps per apt-get, as I'm using Parrot OS (which already has App Armour by the way). I'm installing a test VirtualBox machine as well, and installed Wine (which is not so useful to be honest), and I'll be testing how programs run on that. – Jack Jan 08 '20 at 14:23
  • 1
    For the to much info problem. Always start with the most important bits: leave detail until latter. As for Gnu/Linux or not. Remember it is not MS-Windows. Some things are done differently. Different is not worse. It is just different. If you don't like learning new things then you should stick with it (Since 1990 my MS-Windows friends have had to start over with their learning 3 or 4 times: Win 3, 95, XP, 8 ). What I have learnt has not changed much. New stuff is added, but the old remains. – ctrl-alt-delor Jan 08 '20 at 17:43
  • @ctrl-alt-delor That's what I always say. I do like learning new things, that is a part of why I would like to switch to Linux. The only thing is, I like to be able to do everything that I need to do in everyday computer use on my system and to not worry about privacy intrusions. – Jack Jan 08 '20 at 17:51
  • Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/103045/discussion-between-ctrl-alt-delor-and-jack). – ctrl-alt-delor Jan 08 '20 at 17:59
  • You might want to look into Opensnitch https://github.com/gustavo-iniguez-goya/opensnitch – Guest Jan 01 '21 at 23:50

2 Answers2

4

You are looking for the following programs:

ValdikSS
  • 61
  • 4
2

I just read your latest comment (as of now).

I think you are wrong about what can be done on Gnu/Linux. I have been using it as my only OS for over 20 years. What you are looking for is process isolation. Here are some solutions.

  1. Create a second account, and log in as that. Run un-trusted apps as one user, and personal apps as another.
  2. Docker: (a bit advanced for now).
  3. App armour: (advanced setup, but you can use existing configurations).
  4. nftables: to restrict what users can asses what on network (Each person can be more than one user).

Digging into your intent. I would install Debian, they don't spy on you. There is a popularity contest (it monitors what you install (anonymously), but you can easily opt out).

If they turn out to be untrustworthy then there is nothing you can add the the OS: Firewall uses OS, and needs to trust it.

As for monitoring a firewall. On Unix (Gnu/Linux, UNIX, BSD) things are a little different. The firewall, the firewall setup app, and the logging will be separate. Currently there is one of two firewalls for Linux (iptables, and the new nftables). Then there are firewall apps such as ufw that configure these filewalls. gufw that is a graphical front end for ufw (you will not notice this. It is all seamless, but it is good to know, as it come in useful.) Then the fire wall will write to some logs. You now need a program that reads the logs and generates notification. This is sometimes included with the firewall app, but sometimes not. In ether case you can use a 2nd app to do the notifications.

Don't worry if this is confusing. You can ignore the extra power of Unix, and just use it as a better Windows. But if you learn about it, you will find hidden powers.

ctrl-alt-delor
  • 27,473
  • 9
  • 58
  • 102
  • Yes! I've tried installing Qubes, but it's very heavy on my system, especially on the RAM and CPU, so I dropped it and moved to Parrot OS, which is the second best in my opinion (based on a days reading trip on everything Linux) when it comes to security. Parrot still offers sandboxed running of apps, which is great, and it does have App Armour pre-installed. It also has a decent firewall where I can add rules, but so in theory, I could just track everything I install and where it connects, then add a rule for each program, but that would be tremendously tedious. – Jack Jan 08 '20 at 14:26
  • Parrot is also based on Debian, by the way. I do have an old laptop that I can install a firewall OS on however, but that would still end up a rather tedious process to each time get up and go to it to allow some program to connect somewhere. Of course it would be less tedious than the aforementioned process. Parrot comes with GUFW preinstalled too, which is what I was referring to before. I do understand the principle of how it should work in Linux, and I appreciate you explaining it, but imagining the process makes it so tedious in my mind. Though perhaps it seems more tedious than it is? :) – Jack Jan 08 '20 at 14:28
  • 2
    It will be hard, because it is new. You are also trying to do some advanced stuff. You don't need to separate each app, and doing so will take away some of the power of Unix. Just think of 2 or 3 zones: insecure (I don't trust it), normal, and secure. – ctrl-alt-delor Jan 08 '20 at 17:47
  • I think it's useful to point out, perhaps even more explicitly, that doing such an advanced thing takes study (and practise), especially with something as powerful as Unix(-based systems). Would it be a fair comparison to say that flying an airplane takes a lot more knowledge and understanding than driving a car? – Mr. Donutz Jan 09 '20 at 09:32
  • Flying is easier (there is less to crash in to). I would say there are two aspects. Pressing a button is easier than setting up a button. And Not all buttons do what they say they do. – ctrl-alt-delor Jan 09 '20 at 17:55