Keeping Linux updated and secure: updates, firewalls and users

TUREFF• •0

Linux has a good reputation for security, but that reputation depends on the basics being done well. A desktop that is never updated, runs everything as an administrator and exposes services to the network is not safe just because it runs Linux. The good news is that the essentials take little effort once set up.

Install updates regularly

Most security problems are fixed by updates, often before most people hear about them.

Use your distribution's updater. Ubuntu and Mint have a graphical Software Updater or Update Manager, Fedora uses GNOME Software or KDE Discover, and every distribution has a command-line route such as 'sudo apt update' followed by 'sudo apt upgrade' on Debian and Ubuntu, or 'sudo dnf upgrade' on Fedora.
Turn on automatic security updates where your distribution offers them. Ubuntu, for example, can install security updates unattended.
Remember Flatpak and Snap. They update separately from the system packages. Snaps refresh automatically by default; Flatpaks update through the software centre or a 'flatpak update' command.
Restart when asked, particularly after kernel or core library updates. A patched kernel does nothing until you boot into it.
Firmware matters too. Many distributions can install firmware updates for supported hardware through the fwupd service, often shown in the software centre.

Stay on a supported release

Every distribution release has an end of support date, after which security updates stop.

Check how long your release is supported on the distribution's own website. Long-term support releases, such as Ubuntu LTS versions, are supported for years; others for a shorter period.
Plan upgrades before support ends, and back up first.

Use a firewall sensibly

On a typical desktop that runs no servers, very little is listening for incoming connections, but a firewall is a sensible safety net, especially on public Wi-Fi.

Ubuntu includes UFW, the Uncomplicated Firewall, which is installed but switched off by default. 'sudo ufw enable' turns it on with a policy of denying incoming connections and allowing outgoing ones. A graphical front end, Gufw, is available in the repositories.
Fedora and several other distributions use firewalld, managed with 'firewall-cmd' or a graphical tool.
Only open what you need. If you run file sharing or a game server, allow that specific service rather than turning the firewall off.

Be careful with administrator rights

Use a normal account day to day and let sudo prompt you for your password when a task needs administrator rights. Do not log in as root for everyday work.
Read before you paste. A command beginning with sudo, especially one that downloads and runs a script, can do anything to your system.
Give each person their own account on a shared computer, and only make people administrators if they need to be.
Use strong passwords for your user account, and turn on the screen lock.

Install software from trusted sources

Prefer your distribution's repositories, Flathub or the Snap Store over random downloads.
Be cautious with third-party repositories and personal package archives. They run with full privileges when you update.
Remove software you no longer use, because every program is something that needs updating.

Encrypt and back up

Full-disk encryption, usually LUKS, is offered by most installers. It protects your data if a laptop is lost or stolen. Store the passphrase somewhere safe, because there is no way back without it.
Back up regularly to an external drive or another location. Many distributions include a simple backup tool, and Timeshift-style snapshots can roll back a broken system, though snapshots of system files are not a backup of your personal data.

Services and remote access

Do not run services you do not need. If you installed an SSH server to try something, remove or disable it afterwards.
If you do use SSH, prefer key-based login and keep the server updated.

A simple routine

Let updates install, or run them at least weekly.
Restart after kernel updates.
Check once in a while that Flatpak and Snap apps are current.
Review your backups and test a restore occasionally.

What does your update and security routine look like? Tell us in the comments.