Firewall, Updates, and Accounts

Layers

No single setting makes a computer safe. What works is several layers, so that getting past one still leaves the others. For a Linux desktop or a home server, five matter:

Updates come first

Most break-ins use holes that already have fixes. unattended-upgrades installs security updates every day on its own (module 2), and that does more for your safety than anything else in this lesson ¹. Leave it on, run your weekly update-all, restart when /var/run/reboot-required appears, and move to a new LTS before your release’s support ends. Stick to the Ubuntu archive, snaps, and Flathub, since every third-party repository you add becomes part of what you’re trusting ².

What’s exposed

A firewall matters for programs that listen for connections from other machines. sudo ss -tlnp (module 5) lists them. Anything bound to 127.0.0.1 only accepts connections from the same machine; anything on 0.0.0.0, *, or your network address can be reached from your network. On a fresh desktop there’s little or nothing; a server will have sshd on port 22 and whatever you’ve installed.

A firewall with ufw

Ubuntu’s firewall tool is ufw, the Uncomplicated Firewall, a simple front end to the kernel’s packet filtering. It’s installed but off by default ³.

A sensible setup for a home server reachable by SSH:

me@garden-server:~$ sudo ufw default deny incoming
me@garden-server:~$ sudo ufw default allow outgoing
me@garden-server:~$ sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
me@garden-server:~$ sudo ufw enable
me@garden-server:~$ sudo ufw status verbose

• default deny incoming refuses any connection you haven’t allowed; default allow outgoing lets the machine reach out as normal ⁴.
• The allow rule lets in SSH, but only from your own network; use your network from ip addr in place of 192.168.1.0/24 ³.
• Allow SSH before you enable, if you’re working over SSH. Enabling a deny-by-default firewall without that rule cuts you off.
• status verbose shows the defaults and every rule ³.

If SSH has to be reachable from anywhere, use sudo ufw limit ssh instead: it allows connections but denies an address that tries 6 or more within 30 seconds, which defeats password guessing ⁴. With passwords turned off (module 5), guessing is hopeless anyway.

Other useful commands ^{3 4}:

• sudo ufw allow 8080/tcp opens a port to everyone; sudo ufw allow from 192.168.1.0/24 lets your whole network in ⁵.
• sudo ufw app list shows programs that installed a ufw profile, like OpenSSH; sudo ufw allow OpenSSH uses it.
• sudo ufw status numbered, then sudo ufw delete 3, removes rule 3.
• sudo ufw --dry-run allow http shows what a rule would do without applying it.
• sudo ufw disable turns it all off again.

On a desktop that serves nothing, sudo ufw enable with the defaults is enough: nothing comes in, everything goes out.

Accounts

Root is locked. Ubuntu’s root account has no usable password, so nobody can log in as root; administration goes through sudo, with your own password, which records who did what ⁶. The first account the installer creates is in the sudo group, and adding another account to that group gives it the same power ⁶. Since Ubuntu 25.10, sudo is sudo-rs, a reimplementation in Rust; it works the same for everyday use, and the original is still available as sudo.ws ⁶.

Good habits (Shell course, module 3, covered the commands):

• One account per person, and only those who need it in sudo.
• A long passphrase for any account that can log in, and SSH keys with passwords turned off for remote logins (module 5).
• Lock an account you’re not using rather than leaving it open: sudo passwd -l name, and sudo passwd -u name to unlock ⁶.

To see who’s been logging in:

me@garden-server:~$ last
me@garden-server:~$ journalctl -u ssh --since today

last lists logins and logouts, most recent first ⁷. The SSH service’s journal shows every attempt, accepted or refused; on a machine reachable from the internet, you’ll see strangers trying.

Confinement

Even trusted programs have bugs, so Ubuntu limits what some can touch:

• AppArmor profiles restrict particular programs to the files and abilities they need. It’s installed and loaded by default on Ubuntu; sudo aa-status lists the profiles in force ⁸.
• Snaps are sandboxed, with permissions you can see and change (module 2) ⁹.

You rarely need to touch either. If a confined program can’t open a file it should, the journal will usually mention apparmor="DENIED", and that’s where to look.

Your data

• Disk encryption, chosen at install time (module 1), protects a laptop’s contents if it’s lost or stolen. Without the passphrase the data can’t be read, by a thief or by you ¹⁰.
• Backups protect against everything else, including mistakes and ransomware. Keep the nightly snapshots, and keep the backup drive’s copy something an attack on your main account can’t easily delete.

What not to type

Many “fixes” online are a command to paste. Be suspicious of anything you don’t understand that runs with sudo, and especially of curl ... | sudo bash, which runs whatever a website sends with full power over your system. Read it first, or find an apt package or snap instead.

Your turn

So

Keep unattended-upgrades on: updates are the strongest protection. Check what’s listening with ss -tlnp. Turn on ufw with default deny incoming, default allow outgoing, and an SSH rule for your own network (or ufw limit ssh), added before ufw enable on a remote machine; status verbose, status numbered, and delete manage it. Root is locked and sudo (now sudo-rs) does administration; keep one account per person, lock unused ones, use SSH keys, and check last and the SSH journal. AppArmor and snap sandboxes confine programs; encryption and backups protect your data. Don’t paste sudo commands you don’t understand.