Hardening Manjaro, beginner-friendly

manjaro 26 / published / guide #49 / ≈ 5 min read

Manjaro is friendly out of the box but still ships a fairly default Linux install — no firewall enabled by default on most editions, SSH off (good), AppArmor available but inactive. This guide is the gentle walkthrough: what to turn on first if you're putting your Manjaro machine on a network you don't fully trust.

Most of the steps are identical to the Arch hardening guide — Manjaro is Arch underneath — but a few of the tools are friendlier on Manjaro, and we'll use those.

The shortlist

  1. A firewall — Manjaro pre-installs ufw, just enable it.
  2. Tight SSH (if you'll ever use SSH at all).
  3. fail2ban / sshguard if SSH is exposed.
  4. A few kernel sysctls.
  5. AppArmor, on.
  6. Timeshift / snapper, set up — so you can roll back from any future surprise.

Step 1: ufw, the friendly firewall

Manjaro pre-installs ufw (Uncomplicated Firewall) — a wrapper over nftables. Turn it on:

sudo systemctl enable --now ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

That's a working "block everything coming in, allow what I start" firewall.

If you do use SSH from another machine, allow it first or you'll lock yourself out (only relevant on remote boxes):

sudo ufw allow ssh        # opens tcp 22

Check what's open:

sudo ufw status verbose

On a desktop, that's often the entirety of the firewall story.

Allow KDE / GNOME discovery on the LAN only

If you use printer discovery, Samba shares, or KDE Connect on your home network, open them only for the LAN:

sudo ufw allow from 192.168.1.0/24 to any port 137,138,139,445 proto tcp   # samba
sudo ufw allow from 192.168.1.0/24 to any app KDE-Connect                  # kde connect

Step 2: SSH

If you don't need SSH at all (typical desktop), leave it off. Confirm:

systemctl is-enabled sshd 2>/dev/null   # disabled / enabled
ss -tlnp | grep :22                       # nothing listening = nothing exposed

If you do need SSH:

sudo pacman -S openssh
sudo systemctl enable --now sshd

Then go through the same key-only setup as elsewhere:

  1. On your laptop: ssh-keygen -t ed25519, then ssh-copy-id you@manjaro.
  2. Test it works without a password.
  3. Edit /etc/ssh/sshd_config on the Manjaro box: set PasswordAuthentication no, PermitRootLogin no, optionally AllowUsers your-username.
  4. sudo systemctl reload sshd.

Step 3: sshguard or fail2ban

Only if SSH is exposed on a network you don't control. sshguard is the lighter pick on Arch-family:

sudo pacman -S sshguard
sudo systemctl enable --now sshguard

Defaults are fine. It watches the journal and adds nftables blocks for IPs that fail logins repeatedly.

Step 4: kernel sysctls

sudo nano /etc/sysctl.d/99-hardening.conf
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.rp_filter = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.yama.ptrace_scope = 1
sudo sysctl --system

(Same set as the Arch hardening guide. I left out accept_ra = 0 — keep IPv6 router advertisements on for desktop / laptop use.)

Step 5: AppArmor

Manjaro doesn't ship AppArmor enabled. To turn it on:

sudo pacman -S apparmor

Add the kernel parameter to enable the LSM. Manjaro defaults to GRUB:

sudo nano /etc/default/grub

Find GRUB_CMDLINE_LINUX_DEFAULT= and append:

lsm=landlock,lockdown,yama,integrity,apparmor,bpf

Regenerate the config and enable the service:

sudo grub-mkconfig -o /boot/grub/grub.cfg
sudo systemctl enable apparmor
sudo reboot

After reboot, verify:

sudo aa-status

Should report apparmor loaded with a handful of default profiles in complain mode. Switch a profile to enforce mode when you're confident with it:

sudo aa-enforce /etc/apparmor.d/usr.bin.firefox

Step 6: Timeshift, set up properly

Manjaro recommends Timeshift — a "system restore" tool that periodically snapshots the system. On Btrfs it's essentially free; on ext4 it uses rsync.

sudo pacman -S timeshift

Open it (look for "Timeshift" in the menu) and walk through the wizard:

  • Snapshot type: Btrfs if you have it, else rsync.
  • Location: the system partition for Btrfs; a separate disk if rsync.
  • Schedule: daily + weekly is plenty for a desktop.
  • Include @home? Usually no — Timeshift is for system rollback, not personal backup. Use a separate tool (see rsync without losing data) for /home.

Take a manual snapshot now so you have a known-good baseline:

sudo timeshift --create --comments "fresh hardened install"

Step 7: house-keeping that adds up

  • Keep the system up to date. Manjaro's update tool (pamac or sudo pacman -Syu) addresses CVEs frequently; running it weekly is the single biggest security win.
  • Don't install AUR packages you can't roughly read. The AUR is community code with no formal review. Open the PKGBUILD with yay -S --editmenu <pkg> before installing anything off the beaten path.
  • Disable the pamac tray icon if you don't want a daemon polling for updates in the background:
    systemctl --user disable --now pamac-tray-icon-plasma   # KDE
systemctl --user disable --now pamac-tray-icon-gtk      # GNOME / Cinnamon / Xfce
  • Lock your screen. A laptop habit, not a software install: Super+L (KDE) or via your DE's shortcut. Whenever you walk away.

Step 8: full-disk encryption

This one has to happen at install time — Manjaro's installer (Calamares) has a "Encrypt system" checkbox. If you didn't check it, the only solid path is reinstall.

For ongoing management of LUKS — changing passphrases, adding a second key for backup, recovering — see the changing the LUKS passphrase guide. The advice there is distro-agnostic.

The done check

sudo ufw status verbose                       # firewall up, rules look right?
systemctl is-active ufw apparmor sshguard      # all "active" (sshguard only if you set it up)?
sudo aa-status | head                         # apparmor loaded?
ss -tulpn                                     # anything exposed you didn't expect?
timeshift --list                              # snapshots exist?

Five commands. If they all look reasonable, your Manjaro machine is in a quietly defensible state — without anything you'll regret in three weeks when you've forgotten what you did.

← back to index