How to secure Ubuntu for a non-technical user? (your mom)

Question

My mother will be traveling for a while and I need to provide her with a secure laptop so she can work. A windows laptop is out of the question because:

• she'll be logging into dodgy hotel wireless networks and conference networks

• price of the windows license to install on a netbook

I've installed libreoffice, media players and skype on it. Also enabled SSH so I can intervene but I am worried that I might not be in a position to do so.

Possible threats:

• web browsing

• USB sticks

• insecure networks prone to intrusions

• malware

• SSH/VNC vulnerabilites

• Skype vulnerabilities

All the "securing Ubuntu" guides out there assume the user has a certain level of technical knowledge but this is not the case with moms in general. If a malware can gain even user level access it might compromise her files.

Answer 1

The number one thing you can do to keep that computer secure is to ensure that the packages are updated regularly. I would enable fully automatic updates (https://help.ubuntu.com/community/AutomaticSecurityUpdates), as long as the potential for a burst of network use while connected to dodgy hotel WiFi isn't a severe problem.

After that, I think the only big problem is VNC. If VNC server is running constantly, it is probably the biggest potential security issue on the system (SSH is similar in scope but is considered to be more secure by default). If you need VNC installed and need it to be running all of the time, then there's probably nothing you can do about it -- it's either running or it's not, and there's not much you can do to secure a process that has control over input/output like VNC does. But if you don't need it to be on all the time, then just disable it. You can start it up manually via SSH if you need to.

As long as your packages are up to date, I wouldn't worry about web browsing, USB sticks, malware or SSH vulnerabilities. Linux desktops/notebooks are not a common target for them and Ubuntu is fairly well hardened by design. Even if you don't do anything special to secure against those vulnerabilities, an Ubuntu system will be less likely to be compromised than a Windows machine running even fairly good security software.

Skype is not necessarily secure, but it doesn't run with elevated privileges and there's not very much you can do to secure it given the state of the Skype linux version. Just be aware that Skype for Linux is not very stable or featureful and hasn't been worked on for a long time. That having been said, I use it for business purposes all the time and after I got used to its quirks it was adequate.

Answer 2

The most important security-risk for road warriors is an unsecure network connection (public WiFi) that allows unencrypted traffic to be read by third parties or man-in-the-middle attacks on encrypted traffic.

The only way around this is to use a VPN. If you own a server just set up a VPN on it. PPTP or OpenVPN are easily set up and at least the former is supported out-of-the-box by pretty much everything (Linux, Mac, Win, iPhone, Android, you name it).

For remote support I'd recommend Teamviewer. Works from everywhere and behind every firewall.

Answer 3

What about UMTS/LTE access? It would protect from sniffing and allow SSH. It's gotten really easy to configure. You would have to teach your mom how to get her IP or get a dyndns-like solution. It's a matter of pricing and coverage of course.

Answer 4

You should run firewall (ufw) and allow only ports which are needed to be open (22 SSH). https://help.ubuntu.com/community/UFW If you need a GUI with ufw, there is GUFW. https://help.ubuntu.com/community/Gufw

You should also use something like sshguard to make sure that automatic bots etc. will not be able to login. http://www.sshguard.net/ SSHGuard will ban from one failed login attempt to 5 or 15 (I don't remember which) minutes at first and it will raise exponentially after more failed login attempts. I have aliases to help in this case.

alias ssh-add='\ssh-add -D && \ssh-add '

(So ssh-agent will not contain too many keys and fail, because of it)

alias sshguard-show-bans='sudo iptables -L sshguard --line-numbers'

(To see bans which sshguard has added)

alias sshguard-unban='sudo iptables -D sshguard '

(To easily unban IP address. Usage sshguard-unban number_from_sshguard_show_bans)

You should also tell SSHd to not allow login with password (optional, but recommended. If you don't do this, use at least sshguard or alternative to it) https://help.ubuntu.com/11.10/serverguide/C/openssh-server.html

VNC could be tunneled with SSH. In ~/.ssh/config it's something like this:

Host lan-weibef   
    Port 8090                                                                                                                                                     
    User mkaysi                                                                                                                                      
    hostname compaq-mini.local                                                                                                                      
    LocalForward 127.0.0.1:8090 127.0.0.1:5900

The last line forwards port 5900 (VNC) to localhost port 8090 so to connect to remote server, tell VNC client to connect to localhost 8090. (There are 4 spaces before "Port" "User" "hostname" and "LocalForward"

Answer 5

Keep it updated (automatic).

If you need to use ssh (I think you need to fix things... :)) install openVPN server on your machine and client on her (and automatic/permanent connection). If your IP is dynamic, you'll need a dynamic DNS (like dnsexit.com for example). This way you'll be able to reach her machine everywhere using the tunnel (even if in a LAN in an hotel where you won't be able to use SSH another way usually because you don't control the router she is connected, only VNC or team viewer and this means VNC server always online...). Allow SSH and VNC (or similars) connection only on the openvpn subnet (and only you will be able to connect to them).

Don't forget to configure iptables to block everything from outside including all local networks subnets (for insecure hotel LANs) except the openvpn subnet (and do not use the default one :)).

Use VNC or any remote desktop you want over the tunnel too and you should be safe.

UPDATE after I saw your comment about setting a VPN each time: You can start the VPN at boot and let it that way. When your machine is not online or your mother not connected to internet, the connection will not succeed and retry every x minutes (you set it). When both machines are ok the connection will succeed so she will have a permanent connection without doing anything (like 2 branch offices for example). Another way could be to make a small script starting openvpn and place an icon on her desktop but she will need to be in sudoers to execute the script I believe and she will need to remember to click on the icon. For this reason I would prefer the 1st way with permanent connection. You only need to pay attention to not redirect all her traffic though the VPN in the config.