Linux security: support, software and least privilege

Security on Linux depends above all on the distribution still receiving patches, on every path you use to install software being updated, and on doing everyday work without administrative access. Get packages from that distribution’s official repository. Staying logged in as root all day does not make the work easier or more professional; it only widens the damage from one program or one mistaken click. Treat disk encryption together with its recovery key, not as a box you ticked once during install and then forgot.

How to build a copy you can later restore is in backups you can restore, and the details of encryption layers are in encrypting stored files.

Choose a distribution that still receives patches

An abandoned release, even one that was once known as “secure”, slowly sits without patches. For everyday work a long-term supported version is usually better than a release that changes every six months and that you never actually upgrade. Ubuntu 24.04 has standard support until May 2029, and 26.04, which arrived in April 2026, until May 2031. Debian Stable and Fedora have their own cycles. What matters is knowing the end date for the version you installed, not treating the distribution’s name as enough.

1. See the version under Settings > System > About, or read /etc/os-release in a terminal.
2. Check that same name and number on the distribution’s official release page and see whether it still gets security updates.
3. If ordinary support has ended, either upgrade to a supported version or do a fresh install. Relying on a paid extended-maintenance patch only makes sense if you have actually obtained it and know how long it lasts.
4. Do not choose a testing or development branch for a machine that holds everyday mail and work.
5. After an upgrade, open About once more and confirm the number has changed.

Update every install path

Updating the main repository is not enough if you also installed a program from Flatpak, Snap, a manual Debian file, a user-level Python tool or a third-party repository. Each of those has its own clock and command. Software that has not been updated for years leaves the same known hole open.

On Ubuntu and Debian:

1. Open the Software app and install what is waiting under updates, or in a terminal run sudo apt update and then sudo apt upgrade.
2. It will ask for your own account password, not a separate root password, unless you set the system up with a distinct root account.
3. If you are told to restart, do not put it off; some kernel patches are not fully applied until after a reboot.
4. Review extra repositories in Software & Updates. Remove a source you no longer trust or no longer remember adding.
5. If you use Flatpak, run flatpak update separately. If you use Snap, it usually updates itself; still check its status once.

On Fedora the equivalent is GNOME Software or sudo dnf upgrade. There too, do not forget separate stacks such as Flatpak.

Do not install a package from a random site with a copied command that adds an unknown repository. If you fetch a standalone file, compare the checksum or the maker’s signature with the official site, not with the same doubtful page that offered the file.

Do not leave automatic security updates off

Many distributions can at least download and install security patches themselves. That does not replace looking in from time to time, but it does stop you falling months behind.

1. On Ubuntu, open Software & Updates and go to the Updates tab.
2. Leave automatic checking on and, for security updates, choose download and install automatically.
3. If you work with configuration files, the unattended-upgrades package on Ubuntu and Debian does this job and usually applies only the security pocket automatically.
4. On Fedora you can use dnf’s automatic update mechanism or set GNOME Software to notify and install.
5. After a few days, check the date of the last successful update in Software, or look at the list of upgradable packages, so you know automation is actually working.

If the machine must stay up, pick a time when a reboot is possible after a kernel patch. An update without a restart gives a feeling of safety but does not finish the job.

Work with the least privilege you need

The everyday account should not be root. sudo means you run one specific command with higher privilege; it does not turn the whole session into an administrator. Reading mail, browsing the web and editing a document do not need that privilege.

1. Sign in with your ordinary account, not as root.
2. Use sudo only to install, update and change system settings. Read the command, especially if you copied it from a page.
3. A separate account for heavy administration is unnecessary on a personal computer unless you are treating it like a server; sudo is enough, provided the account password is strong and the screen locks.
4. If someone else sometimes uses the same computer, create a separate account for them under Settings > System > Users. Do not make them an administrator without a reason.
5. Turn off automatic sign-in so that opening the laptop lid does not lay everything open.

Do not run a file that came from the internet with sudo “just so it will install”. If the program has a way to install without administrative privilege, prefer that, then see whether it can come from an official repository instead.

Treat the screen lock as part of the same design

Disk encryption does not protect you from someone sitting beside you while the session is unlocked. The screen lock is the layer that covers a short time away from the desk.

1. Go to Settings > Privacy & Security > Screen Lock. On some versions this section sits only under Privacy.
2. Set the screen to blank and to lock automatically after a short time, a few minutes for example.
3. Practise the desktop’s own shortcut for locking immediately so it becomes a habit before you stand up.
4. If the system asked you for both a sign-in password and a disk-encryption passphrase, keep them separate, and keep both somewhere other than the device itself.
5. If you close the laptop lid, check that closing it really locks or suspends, rather than only darkening the screen and leaving the session open.

Disk encryption and the recovery key

During an Ubuntu install you can choose full-disk encryption and set a separate passphrase. Without that phrase, someone who has removed the drive cannot read the files as an open disk. Some newer installs may also rely on a hardware security chip; in that case the system gives you a recovery key that you should save at that moment.

1. If the system was installed without encryption, turning it on afterwards is not always simple and sometimes needs a reinstall. Take a backup before such a change.
2. Keep the disk passphrase in a password manager and on paper, away from the laptop itself.
3. If a recovery key was shown during install or in security settings, write it down immediately somewhere off that disk and read it back once carefully.
4. After a reboot, sign in once through the prompt that asks for the disk passphrase so you know you still remember it.
5. Follow the file-storage guide for layers and leftover copies; the point here is that encryption without a recovery key is also a way to lose the data.

Keep the system defaults that help: firewall and access frameworks

On a desktop that does not offer a service to the network, a firewall mainly stops unexpected inbound connections to background services you may have installed without noticing.

1. If your distribution has ufw, check its status and leave inbound traffic denied unless you have opened a service on purpose.
2. On Fedora, firewalld usually plays that role. Do not stop it just so “a connection will work”; open the specific service you need instead.
3. If you have enabled ssh on this machine and it is reachable from the internet, do not leave password sign-in open, create a separate key, and do not expose the port to the whole internet without a reason. If you do not need ssh, do not leave the service installed and forgotten.
4. Do not turn off SELinux on Fedora, or AppArmor on Ubuntu and Debian, to make something easier. If a program hits a restriction, understand that program rather than disabling the whole framework.

Do not forget firmware and the kernel

Patches are not only for desktop applications. The firmware that starts the hardware (BIOS or UEFI) and the firmware of accessories sometimes have holes too. Many distributions can fetch firmware updates from the LVFS catalogue through fwupd.

1. GNOME Software sometimes has a separate firmware section. Check it.
2. In a terminal, if fwupdmgr is installed, you can list devices and any available update and install it from that same official path.
3. Before a firmware update, plug the laptop into power and do not leave the job half-finished.
4. After a kernel patch, reboot and check the version in About or with uname.

Count anything from outside the repository separately

A PPA, a third-party repository, an install script run as a one-line download, and a look-alike package with a name close to the real one are the most common ways unwanted software arrives on a Linux desktop. Linux is not magic in this respect; its official repository is simply reviewed more carefully.

1. Before you add a repository, see whether the same program exists in the official one or as a known Flatpak.
2. Do not run a script that pipes a download into sudo unless you know the source another way and have read the text.
3. Look at the file type and, for a manual install, check the signature.
4. Get browser extensions from that browser’s official store, not from a separate “Linux package” on an unknown site.
5. Every so often, review extra sources and unofficial installed packages and remove what you no longer want.

Do not tie backups to the distribution

Upgrading or reinstalling is a normal part of life with Linux. If the only copy of your documents lives on the same system partition, one reinstall is enough to lose them. Keep the backup on a separate disk or service and test a restore once. A full disk image is useful, but for work files a simple readable export on other media is often easier to bring back.

Common mistakes

• Staying for years on a release whose support has ended because “it still works fine”.
• Updating apt and forgetting Flatpak, Snap or a program installed by hand.
• Doing everyday work as root, or running every copied command with sudo.
• Turning off SELinux or AppArmor to clear an error.
• Encrypting the disk and never storing the recovery key off that same laptop.
• Automatic sign-in and no screen lock on a device that leaves the house.

Check whether the disk is actually encrypted

Some installers show an encryption option and you may have skipped it. Guessing is not enough.

1. In a terminal, listing block devices usually shows an encrypted partition with a LUKS- or crypt-related name.
2. If, before the desktop sign-in, the machine asks for a separate disk passphrase, the disk layer is active. If you only see the GNOME sign-in password, the account may be locked while the disk remains readable at rest.
3. Write down the result. If it is not encrypted and sensitive data is on the device, plan encryption later and until then at least encrypt the most sensitive files separately.
4. A laptop that travels without this layer can be read easily once the drive is removed.

Who is allowed to use sudo

Any account in the sudo group on Debian and Ubuntu, or the wheel group on Fedora, can run administrative commands with its own password. That is sometimes turned on during setup for a visitor’s convenience and then forgotten.

1. Open the user list under Settings > System > Users and see who is an administrator.
2. Delete a guest or test account if you created one and no longer need it.
3. Give the administrator account a unique password and keep it in a password manager.
4. If groups such as docker exist on this machine, know that membership in some of them is effectively the same as full access. Do not add people to those groups without a reason.

Sharing, remote desktop and open services

GNOME has a section for sharing and remote desktop. Leaving it on on a network that is not yours means the screen and files may be visible from that same network.

1. Go to system settings and the sharing or remote desktop section.
2. Turn off file sharing, screen sharing and remote sign-in if you do not use them.
3. If you do need them, set a separate password and bind them to a limited network, not to “everyone on the guest Wi-Fi”.
4. Look at the printer and the public folder in the home directory in the same pass. A folder open to the network should not hold sensitive content.
5. If you want to know which ports are listening, use the distribution’s official way of listing listening sockets and disable or remove a service you do not recognise, rather than only changing the port number and relaxing.

Flatpak permissions and other package formats

Flatpak runs a program with some isolation, but many apps ask for access to the home folder or to devices. That isolation only means something if you look at those permissions.

1. On newer GNOME versions, open that Flatpak app’s permissions in app settings and reduce access to files, the camera or the microphone.
2. If you use a separate tool for Flatpak permissions, get that tool from the official repository too.
3. AppImages and portable programs usually have no repository update path. Either you fetch a new version from the maker’s site yourself, or the program slowly goes stale. For important tools, prefer a format that lives in the repository.
4. Before marking a desktop file or script that arrived with an AppImage in a message as executable, open it and read it.

Suspend, hibernate and encryption keys

When the system suspends, the disk-encryption key may remain in memory. For a short time away in a familiar room, suspend is usually acceptable. If the device might leave your hands, or you leave it unattended while travelling, a full shut-down puts the disk layer back behind the passphrase and is safer than suspend. Hibernate writes memory to disk; if that space is not encrypted, the same memory image can reveal keys. On an encrypted system, follow your distribution’s default hibernate setup and do not change it from an unknown guide without understanding the consequence.

Do not turn Secure Boot off without a reason

Secure Boot helps stop an unverified operating system from taking the place of your kernel. Turning it off is sometimes suggested in order to install a driver or a second system. If you have to, turn it back on when you finish and understand why it was needed. Do not test a second system from an unknown flash drive, without checking a signature, on the machine you use for everyday work.

Before a major distribution upgrade

1. Back up the home files and, if you can, a list of installed packages.
2. Set third-party repositories aside for a while; most failed upgrades come from those.
3. Run the official upgrade from the distribution’s own tool, not by hand-editing a few files and hoping it works out.
4. After the upgrade, check sources, automatic updates, the screen lock and encryption again.
5. If the upgrade fails, go back to the backup; repairing mid-way with scattered commands usually makes things worse.

Camera, microphone and file history in GNOME

Like a phone, the desktop can tell you which programs may use the camera and microphone. If your distribution uses GNOME:

1. Go to Settings > Privacy & Security.
2. Review Camera and Microphone and turn off access for an app that should not always be listening.
3. Limit or clear file history or recent search if this is a shared computer.
4. Turn off location detection for a desktop that does not need it.

Check the firewall with a specific command

On Ubuntu and Debian, if ufw is installed:

1. See whether it is on with sudo ufw status.
2. If it is inactive and you do not offer a service to the outside, sudo ufw enable usually denies inbound traffic and allows outbound; that suits most personal computers.
3. Before you turn it on on a machine you have connected to remotely, make sure you have excepted your own way in, or the session will drop.
4. On Fedora, check the equivalent with firewall-cmd or that distribution’s firewall settings, and do not stop it just so a local program will work.

Get the install image and the browser from an official source

If you reinstall the system or build a live flash drive, the image file itself can be faked.

1. Download the image from the distribution’s official domain, not from the first advertised search result.
2. Take the official hash from that same site and compare it with the file you downloaded.
3. If the distribution publishes a separate signature, check that too.
4. Install the browser from the official repository or from a repository the maker itself publishes. Do not take a Chrome or Firefox package from an unknown “Linux software bundle”.

After updates, and on a multi-user machine

Software sometimes says everything is current while a package is still waiting or a new kernel is not yet running. On Ubuntu and Debian you can list upgradable packages in a terminal. If something remains, install it. If there is a message that a restart is needed, take it seriously. Fedora has a similar way to see which updates want a fresh session.

If more than one person uses this computer, your home folder should not be readable by the others. The default permissions on some distributions are more open than you might think. Keep accounts separate in user settings, and do not leave a sensitive file in a shared desktop folder. How to back up those same home folders is in the restore guide.

What to do from today

1. Match the distribution version to its official end-of-support date.
2. Update the main repository and every other install path, and reboot if needed.
3. Check that automatic security updates are on.
4. Work from an ordinary account, shorten the screen lock and turn off automatic sign-in.
5. Establish whether the disk is encrypted and where the recovery key is, and make a separate backup if you do not have one.