Most Linux distributions ship with sensible defaults, but many security controls remain untouched after installation. Several are outside GNOME or KDE settings, and some need testing before they suit your desktop.
Start with the machine’s real use
A desktop used only at home has different requirements from a travel laptop that stores client documents, saved browser sessions, SSH keys, invoices, and password-manager data. The risks change again if you’re using that device in cafes, hotels, coworking spaces, or airports.
Someone working from those locations may consider full-disk encryption, automatic screen locking, a firewall, and a VPN on Linux, which is available with a dedicated Linux app and simple setup.
A VPN protects network traffic between your device and the VPN provider, which can be useful on untrusted networks. However, it doesn’t protect against malware, malicious browser extensions, compromised accounts, or files with unsafe permissions. You also need to trust the VPN provider, because your traffic passes through its infrastructure, so use a reputable company.
Here are 10 further tips to help protect your device.
1. Disable automatic login
Automatic login gives anyone holding the device direct access to its account. Turn it off on portable systems. Use a long password or passphrase and require it after reboot, logout, and suspend.
2. Shorten screen-lock time
Set the display to lock after 10 minutes of inactivity on a laptop used in public spaces like offices, cafés, and libraries.
3. Confirm full-disk encryption
Full-disk encryption protects data stored on the drive if the computer is lost or stolen and the attacker doesn’t have the encryption key. Note: it doesn’t protect data after you’ve unlocked the computer from malware or someone who has access to your logged-in session.
4. Keep Secure Boot enabled
Secure Boot helps verify the boot chain and makes boot-level tampering harder. It addresses a different problem from disk encryption, so enable both where hardware and required drivers support them.
5. Enable the firewall
UFW is common on Ubuntu, while Fedora generally uses Firewalld. Turn on the firewall, then confirm that rules allow only services the desktop genuinely needs.
6. Disable unused network services
Inspect listening ports before adding firewall rules. SSH, remote desktop tools, local web servers, databases, printer discovery, file sharing, and sync applications can all expose services. Disable a component that’s no longer used (rather than leaving it ready for occasional access).
7. Audit Flatpak permissions
Check whether any Flatpak apps have full home-directory access, removable-storage access, camera or microphone permissions, location access, or host networking. A PDF reader usually doesn’t need the whole filesystem, so grant access only to the directories it needs.
8. Confirm AppArmor or SELinux enforcement
AppArmor and SELinux limit what applications can access after compromise. Ubuntu users can check whether AppArmor profiles are active, while Fedora users should ensure SELinux is in enforcing mode. Keep distribution-supplied profiles before building custom policies that could break updates or hardware access.
9. Check for unnecessary remote-access software
If you don’t use SSH, remote desktop software, remote administration tools, or similar services, consider removing or disabling them. Fewer exposed services mean fewer things an attacker can potentially target.
10. Reduce routine admin access
Use sudo only for administrative tasks; never run an everyday graphical session as root. Keep the operating system, browser, applications, and firmware updated, and reboot after kernel patches. A downloaded kernel update does not protect the system until it’s running.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
