anilkagi
Thank you Xecure, Sybok and Rockytnji for coming. I was calmly going through all the interesting discussions going on between you knowledgeable guys. Now I thought, I should perhaps post.
stay away from fear and paranoia. Privacy is important, but obsession is worse
That’s a sound piece of advice. It made me relax too.
However actually, I am not paranoid or obsessed, but I am entering the danger zone I suppose, by trying to integrate my Android phone with my Computer. So I am venturing into learning to create secure environment to do such risky activities. This question popped up during that discussion and I started this thread.
I consider integrating an Android phone with my computer risky because, the Android phone that I paid for plus the data plan that I paid for, is used by Google and other Android apps, more than me, for their corporate goals, without me knowing it. Their opaque affairs, which I can’t see through, gives them immense power, to do what they choose to do with me and my data and lifestyle. (Do they own all that, just because they give me those free services?) We know the risks involved and we handle it accordingly. However integrating an Android phone with computer, opens up the computer too, to all that. I want to minimize if not annul the risks there.
I find that the suggestions offered by Seaken64, Dave, Moddit, Olsztyn, Sybok, Rockytnji and yourself are great. And Xecure, thanks for the link. I read further also.
And Sybok’s;
you can do a lot of the requirements by properly selecting groups to which the user belongs to (a current user can list the group they belong to using the command ‘groups’).
E.g. definitely remove the restricted-user from ‘sudo’.
READ-ONLY ROOT:
Also, it seems that Debian (and hence I guess that also antiX) allows to mount parts of the filesystem, e.g. root as read-only
Though I didn’t understand much of the link Sybok provided, Olsztyn’s reply…
So after the entire system is finalized in terms of installed applications and fully configured, there is no need for further changes to these vital parts of OS and these folders can be made read-only.
… gave an idea. That’s really interesting.
I didn’t understand most of Rockytnji’s post, what I could make out. if I am right, from it is, by editing the /etc/sudoers file we can restrict the abilities of users. It was apparent from the last line;
works fine. My wife can only shutdown and reboot.
Now I feel, I can get to where I want to, almost effectively. So finally I decided to come down to this; I will adopt the best of all the worlds.
For affairs like Banking, where significant security is necessary, I could adopt Olsztyn’s model of having a live USB, easily. And for my daily work I will do the following, with the guidance from you knowledgeable guys. I am afraid I would need a bit of hand-holding too. So I would require a lot of compassion from you guys too. I hope Rockytnji, won’t hate me for this.
First I will install Antix on the computer, which I already have done. After the system is totally ready, I will make the “vital parts of OS” read-only as suggested by Sybok. And then I will edit the /etc/sudoers file to restrict the abilities of all other users except me as suggested by Rockytnji.
Next, I will create an underprivileged user account. This underprivileged user account, is for doing all my work. Then, I will install VirtualBox on this same underprivileged account. I will also install firejail in this same user account. Next, I will create an Antix-core VM on the VirtualBox. And in that Antix-core VM, I will install GSconnect and connect it to the KDEconnect on my Android phone. I will start the VirtualBox / Antix-core VM in firejail.
Can this setup be created?
Would it not provide sufficient security for integrating my Android phone with my Computer, through KDEconnect & GSconnect?
If this is sufficient; to achieve this, to begin with, I will have to first create an underprivileged user account. I don’t find an option to create an underprivileged user account through the, Control center > Maintenance > User Manager. How do I do it?
By underprivileged user account, I mean, one where the user cannot install any software, does not have access to root, sudo, admin etc. I shall remove the privilege to install software after installing VB, Fire jail and Antix-core VM, GS-connect in the VM and any other necessary applications. How do I make this underprivileged user account?