Linux is often considered a secure operating system, but no platform is secure by default. A well-protected Linux workstation depends on proper configuration, regular maintenance, strong authentication, and limiting unnecessary exposure. Whether you use Ubuntu, Linux Mint, Fedora, Debian, Arch, openSUSE, or another mainstream distribution, the following practices provide a strong security baseline.
Keep the System Updated
Install security updates promptly and keep the operating system, kernel, browser, applications, and firmware current.
Common commands include:
Debian, Ubuntu, and Linux Mint:
sudo apt update
sudo apt upgrade
Fedora:
sudo dnf upgrade
Arch Linux:
sudo pacman -Syu
Avoid unsupported distributions and remove obsolete or untrusted software repositories.
Encrypt the Device
Full-disk encryption is one of the most important protections for laptops and mobile workstations. Most modern Linux distributions support LUKS encryption during installation.
Use a strong encryption passphrase, encrypt removable media containing sensitive information, and store recovery information separately from the device.
Encryption provides its strongest protection when the computer is fully powered off.
Use Strong Authentication
Use a strong, unique login password and avoid routinely operating as the root user.
For online accounts:
- Use a password manager.
- Use unique passwords for every account.
- Enable multifactor authentication.
- Prefer passkeys or hardware security keys for high-value accounts.
Automatic screen locking should also be enabled, ideally after five to ten minutes of inactivity.
Enable the Firewall
A desktop or laptop generally should not accept unsolicited incoming connections.
On systems using UFW:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
Review listening network services with:
sudo ss -tulpn
Disable services such as SSH, remote desktop, file sharing, web servers, or databases when they are not required.
Keep Linux Security Controls Enabled
Many Linux distributions include mandatory access controls such as AppArmor or SELinux.
Ubuntu, Linux Mint, and many Debian-based distributions commonly use AppArmor.
Fedora and RHEL-family distributions commonly use SELinux.
These protections should generally remain enabled. If an application encounters a policy issue, investigate the configuration rather than disabling the security framework.
Reduce the Attack Surface
Every unnecessary application or background service increases potential exposure.
Periodically review:
systemctl --type=service --state=running
and:
systemctl list-unit-files --state=enabled
Remove unused applications, disable unnecessary startup programs, and avoid installing software from unknown repositories or unverified scripts.
Secure Wi-Fi and Bluetooth
Treat public networks as untrusted.
Recommended practices include:
- Disable automatic connection to unknown networks.
- Remove obsolete saved Wi-Fi profiles.
- Prefer WPA2 or WPA3 networks.
- Use a trusted hotspot when practical.
- Use an approved VPN on untrusted networks.
- Disable Bluetooth when it is not needed.
Saved NetworkManager connections can be reviewed with:
nmcli connection show
Secure the Browser
The browser is one of the most exposed applications on any workstation.
Keep it updated and:
- Minimize extensions.
- Restrict camera and microphone access.
- Restrict location permissions.
- Limit third-party tracking.
- Disable unnecessary notifications.
- Consider separate browser profiles for work, personal use, and research.
Browser extensions should be treated as privileged software because many can access webpage content and account sessions.
Protect Sensitive Files and Credentials
Use restrictive permissions for confidential files.
For example:
chmod 600 sensitive-file
chmod 700 private-directory
Never routinely use broad permissions such as:
chmod 777
Protect SSH private keys, API credentials, VPN profiles, and other secrets.
Avoid placing passwords or tokens directly into command-line instructions, where they may be recorded in shell history.
Control USB and Removable Media
Unknown USB devices should never be trusted.
USB hardware can impersonate storage devices, keyboards, network adapters, or multiple devices simultaneously.
Encrypt removable drives containing sensitive information and consider USB authorization controls for higher-security environments.
Maintain Secure Backups
Security also means being able to recover.
Maintain encrypted backups of important information and periodically verify that those backups can actually be restored.
System snapshots such as Timeshift, Btrfs snapshots, or ZFS snapshots can help recover from failed updates or configuration changes, but they should not replace independent backups of important data.
Be More Restrictive During Travel
For personnel handling sensitive information, travel introduces additional risk.
Consider:
- A dedicated travel laptop
- Minimal locally stored information
- Full-disk encryption
- Hardware security keys
- Bluetooth disabled
- Automatic Wi-Fi connections disabled
- An organization-controlled VPN
- Restricted USB access
- Complete shutdown during uncontrolled physical custody
- Pre-travel and post-travel security reviews
The Bottom Line
Linux provides a strong security foundation, but effective protection comes from configuration and operating practices rather than the operating system name alone.
A strong Linux security baseline includes:
- Prompt security updates
- Full-disk encryption
- Strong authentication
- Automatic screen locking
- An enabled firewall
- Minimal exposed services
- AppArmor or SELinux
- A password manager and MFA
- Secure browser settings
- Encrypted and tested backups
- Careful Wi-Fi, Bluetooth, and USB use
The goal is not to apply every hardening setting available. The goal is to reduce unnecessary exposure while keeping the system secure, reliable, understandable, and recoverable.
