I am looking to make a clean install of a Debian system on my home desktop. To clarify, I am switching from Windows and wish to use it as my day-to-day home OS - I'm not going to be running any servers or anything like that.

I also have reason to believe that some members of my household (who have physical access to my machine) would try to gain access to it, and look through my data or possibly even install a keylogger.

For the purpose of this question, please ignore the social aspects, except for the fact that I cannot act openly confrontational, so e.g. locking my room to prevent anyone accessing my PC is not an option.

The people I want to protect against are technologically literate; they know their way around linux even if they may lack much experience with it, and if something can be found with some googling and takes maybe an hour or two of messing around then it's most likely going to get attempted. That said, I am pretty certain that acquiring specialist equipment is not something they would bother with, which means that I don't have to worry about most hardware attacks, e.g. a keyboard keylogger or bug on my mobo / RAM sniffer / whatever.

One other thing is that I have a Windows 7 system to which they have admin access (so it can be considered compromised). This is one of the reasons I am switching to Linux; however, I'd like to keep a dual-boot system rather than removing Windows outright. I am aware that this would allow an attacker to outright nuke my Linux partition, and that is a risk I'm willing to take.

I am not concerned with securing my Windows system. I am aware it's compromised and don't really care what happens to it. As I mentioned, other people have accounts on my Windows system and occasionally use it (for legitimate reasons!). I am certainly looking to secure my Linux installation, but preventing access to Windows has no point unless it contributes to the security of the Linux part of my machine. In fact, I'd rather avoid limiting access to Windows if possible because I don't want to appear paranoid or create conflict in the household.

Full-disk encryption will prevent anyone from actually accessing my data from outside my Linux installation itself, which should then take care of both the Windows system and even make booting from a USB drive mostly useless (I am quite certain that the people in question do not have the resources or the motivation to decrypt a well-encrypted drive). I will also need to password-protect the single-user mode, of course.

What other things would I need to do to secure my system? I am handy with the command line and willing to get my hands dirty, but I have limited Linux experience and fragmentary knowledge of computer security. The choice of Debian is largely arbitrary and I would have no problem trying out a different distro if it would be better in my case. If there's anything I've missed, or if you have tips on things I mentioned (e.g. best practices for disk encryption?), then I would be glad to hear them.

I do not believe this question is a duplicate because all of the other questions I found on securing Linux on this site concern themselves with remote attackers and protection against viruses and exploits. They certainly have good answers but that is not the kind of information I am looking for here.
Another question has been brought to my attention when my post was flagged as duplicate. However, that one asks in general whether their machine is secure when others have physical access to it; the answers to it generally boil down to "Physical access = game over" and provide some tips to mitigate various attacks (including things such as rearview mirrors on your monitor). Many of those tips are not applicable here, since I am aware that unlimited physical access means the machine isn't mine anymore in theory, and hence I provide some limitations to the attackers in my threat model which fit my personal scenario.


Use a strong and difficult password for the root user. Secondly, always login and work from another user with no administrative rights (and also a strong password).

Enable the BIOS password option. Every time you power on your computer, the BIOS itself will ask you for a password before even booting on. It will also prevent everyone from applying changes to the BIOS setup.

Encrypt every partition of your hard drive (check cryptsetup for Debian - if it can't encrypt you Windows partition, too, use TrueCrypt (from Windows for your Windows))

Watch out for external hardware devices connected on your PC (like USB sticks or hubs) that you haven't used before. Someone might have plugged in a keylogger or something.

Always lock or power off the machine when you are away.

Software hardening:
Install gufw (GUI for the iptables firewall which is pre-installed) and block incoming traffic. Also install rkhunter and check your system for known rootkits and other threats from time to time.


That's all I can think of right now. If you have any questions feel free to comment below.
