I was wondering if there was extra steps that could be taken to help regulars users harden their systems. There’s currently the security center with suggestions and prompts.
Are there more things a regular user should do to protect themselves? Setting up their firewall? Creating and using unprivileged users? Inform users about good SSH practices?
Just setup a VPS with ovhcloud and they had a really thorough guide that covered a bunch of solid hardening steps. I think it would be interesting to set that up or give similar prompts for a desktop user.
This is rather an advanced topic, and it also depends on which version of Ubuntu you’re using. For example, Ubuntu Core 26, Ubuntu Server 26.04 and Ubuntu desktop 26.04 all have different requirements.
Ubuntu has had a hard policy of “no open ports” for the desktop since day one (which got mildly weakened when we allowed avahi into the main desktop, which actually does open the mDNS port) so technically you should never need to do anything if you do not install any packages that open ports on your machine … (note though that a debian packaging policy for something like a server package is that it needs to come up with a default config and should always auto-start, that means if you install some webserver deb you indeed do open port 80 on your machine)
Its not a support question. I’m asking as an improvement to the new user experience on desktop, are sufficient steps taken to harden user systems? Is there more that can be added to the security center?
When I used it recently, it seemed incomplete. I’ll review what I did on my system, but I think the security onboarding for Linux in general is not something a new user coming from Windows is equiped for.
This is too vague for me, please provide specific examples preferably with screenshots or terminal output.
Again, this is rather general and not clear to me what you mean. Provide a bullet-point list of what you think users should know but do not or seem not to be able to find quickly and easily.
As has been pointed out, Linux, including Ubuntu, is mostly safe out of the box with very few additional steps needed except in certain instances such as using SSH, specific uses like servers and so on.
The average desktop user will not need to take any precautions other than the usual recommended steps.
only install from the official repositories
enable the firewall (though this is personal and not strictly speaking a requirement)
Ubuntu, like the rest of Free and Open Source Software (F.O.S.S.), is under constant development. That is what a new user coming from a Microsoft operating system may not realize.
The Security Center is new to Ubuntu. It is installed by default in Ubuntu 26.04 LTS but I had to specifically install Security Center to get it in Ubuntu 24.04 LTS. I expect the Security Center to become more useful over time. That is how things are done in F.O.S.S.
To give you some idea of the extent that Ubuntu developers are going to improve and keep up to date the security of Ubuntu users, please read this link.
Hype! Thanks for that info! Ill go read up on that. Happy those steps are taken. Seen enough people go all in on Arch and just do things that are absurd.
It would help us understand you better if you explained what you would recommend a new Ubuntu user to do to “harden” their Ubuntu system.
I was a new Ubuntu user decades ago. I consider myself to be an ordinary Ubuntu user. I will admit to being a better educated ordinary Ubuntu user than I was decades ago.
I am informed that the first release of Ubuntu was in 2004. So, it would be correct to say that from the beginning the root or administrator account has been locked in Ubuntu. I consider that to be a “hardening.” of the O.S. No need for a new user to lock the root account. The root account is already locked. Or, do you consider locking the root account to be “absurd.”
There are distributions of Linux that require the user to set up a User account (with password) and an Administrator or Root account (with password). But not Ubuntu.
When I was last in employment I worked for a retail enterprise in one of the retail stores. The computers ran Windows NT.
I have had the experience of going on a computer after a member of the management team came off of the computer. The member of the management team was still logged in. And I had the same access privileges as he did. And could work under his user name. And if he was logged in as Administrator (which they often were) then I, the lowly shop assistant, could do anything an Administrator could do. That could not happen in Ubuntu.
Security and hardening should also include process and working practices. This is where the Ubuntu documentation that you call “Hype!” prove to be educational. Management teams should study this documentation or take out a service contract with Canonical and let Canonical regulate their IT department.