Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My mother will be traveling for a while and I need to provide her with a secure laptop so she can work. A windows laptop is out of the question because:

  • she'll be logging into dodgy hotel wireless networks and conference networks

  • price of the windows license to install on a netbook

I've installed libreoffice, media players and skype on it. Also enabled SSH so I can intervene but I am worried that I might not be in a position to do so.

Possible threats:

  • web browsing

  • USB sticks

  • insecure networks prone to intrusions

  • malware

  • SSH/VNC vulnerabilites

  • Skype vulnerabilities

All the "securing Ubuntu" guides out there assume the user has a certain level of technical knowledge but this is not the case with moms in general. If a malware can gain even user level access it might compromise her files.

share|improve this question
add comment

5 Answers

up vote 8 down vote accepted

The number one thing you can do to keep that computer secure is to ensure that the packages are updated regularly. I would enable fully automatic updates (https://help.ubuntu.com/community/AutomaticSecurityUpdates), as long as the potential for a burst of network use while connected to dodgy hotel WiFi isn't a severe problem.

After that, I think the only big problem is VNC. If VNC server is running constantly, it is probably the biggest potential security issue on the system (SSH is similar in scope but is considered to be more secure by default). If you need VNC installed and need it to be running all of the time, then there's probably nothing you can do about it -- it's either running or it's not, and there's not much you can do to secure a process that has control over input/output like VNC does. But if you don't need it to be on all the time, then just disable it. You can start it up manually via SSH if you need to.

As long as your packages are up to date, I wouldn't worry about web browsing, USB sticks, malware or SSH vulnerabilities. Linux desktops/notebooks are not a common target for them and Ubuntu is fairly well hardened by design. Even if you don't do anything special to secure against those vulnerabilities, an Ubuntu system will be less likely to be compromised than a Windows machine running even fairly good security software.

Skype is not necessarily secure, but it doesn't run with elevated privileges and there's not very much you can do to secure it given the state of the Skype linux version. Just be aware that Skype for Linux is not very stable or featureful and hasn't been worked on for a long time. That having been said, I use it for business purposes all the time and after I got used to its quirks it was adequate.

share|improve this answer
2  
i think team viewer is better than of vnc –  One Zero Mar 26 '12 at 19:01
1  
SSH will not work if she is in a hotel (or any) LAN because there will be no way to reach her machine without controlling the router... –  laurent Mar 26 '12 at 20:57
    
@laurent will this compromise SSH security? –  Gil Mar 27 '12 at 8:45
    
@Gil Opening the SSH port on the internet is always a problem and if your mom is in a LAN (hotel or conference rooms) even with the port open you won't be able to reach her computer because the IP (if you know it from team viewer for example) will be associated with the LAN router and it won't forward to your mom's computer. So you won't be able to connect to her computer this way (but others in the hotel LAN will). So I think it is not a working solution and it is dangerous. I think the way I answered using a VPN is the only simple way to reach her computer always and without high risk. –  laurent Mar 29 '12 at 1:41
    
There is such a thing as "reverse ssh", where the connection is initiated by the host -- your mother in this case -- and that could possibly be packaged up into a script and put on the desktop for the user to use in emergencies. I don't know any of the details about that approach, though, since I've never had to use it myself. –  Andrew G. Mar 29 '12 at 18:41
add comment

The most important security-risk for road warriors is an unsecure network connection (public WiFi) that allows unencrypted traffic to be read by third parties or man-in-the-middle attacks on encrypted traffic.

The only way around this is to use a VPN. If you own a server just set up a VPN on it. PPTP or OpenVPN are easily set up and at least the former is supported out-of-the-box by pretty much everything (Linux, Mac, Win, iPhone, Android, you name it).

For remote support I'd recommend Teamviewer. Works from everywhere and behind every firewall.

share|improve this answer
2  
It's my mother. There is no way she is going to set up a vpn every time she connects. –  Gil Mar 26 '12 at 21:18
3  
@Gil: Ubuntu allows you to automate that process as long as you have a "fixed" external provider for the VPN. For example you could set up a rule to connect to the VPN whenever WLAN is used, while normal wired LAN will not trigger that behavior. +1 for the answer, btw. –  0xC0000022L Mar 29 '12 at 2:34
add comment

You should run firewall (ufw) and allow only ports which are needed to be open (22 SSH). https://help.ubuntu.com/community/UFW If you need a GUI with ufw, there is GUFW. https://help.ubuntu.com/community/Gufw

You should also use something like sshguard to make sure that automatic bots etc. will not be able to login. http://www.sshguard.net/ SSHGuard will ban from one failed login attempt to 5 or 15 (I don't remember which) minutes at first and it will raise exponentially after more failed login attempts. I have aliases to help in this case.

alias ssh-add='\ssh-add -D && \ssh-add '

(So ssh-agent will not contain too many keys and fail, because of it)

alias sshguard-show-bans='sudo iptables -L sshguard --line-numbers'

(To see bans which sshguard has added)

alias sshguard-unban='sudo iptables -D sshguard '

(To easily unban IP address. Usage sshguard-unban number_from_sshguard_show_bans)

You should also tell SSHd to not allow login with password (optional, but recommended. If you don't do this, use at least sshguard or alternative to it) https://help.ubuntu.com/11.10/serverguide/C/openssh-server.html

VNC could be tunneled with SSH. In ~/.ssh/config it's something like this:

Host lan-weibef   
    Port 8090                                                                                                                                                     
    User mkaysi                                                                                                                                      
    hostname compaq-mini.local                                                                                                                      
    LocalForward 127.0.0.1:8090 127.0.0.1:5900

The last line forwards port 5900 (VNC) to localhost port 8090 so to connect to remote server, tell VNC client to connect to localhost 8090. (There are 4 spaces before "Port" "User" "hostname" and "LocalForward"

share|improve this answer
add comment

Keep it updated (automatic).

If you need to use ssh (I think you need to fix things... :)) install openVPN server on your machine and client on her (and automatic/permanent connection). If your IP is dynamic, you'll need a dynamic DNS (like dnsexit.com for example). This way you'll be able to reach her machine everywhere using the tunnel (even if in a LAN in an hotel where you won't be able to use SSH another way usually because you don't control the router she is connected, only VNC or team viewer and this means VNC server always online...). Allow SSH and VNC (or similars) connection only on the openvpn subnet (and only you will be able to connect to them).

Don't forget to configure iptables to block everything from outside including all local networks subnets (for insecure hotel LANs) except the openvpn subnet (and do not use the default one :)).

Use VNC or any remote desktop you want over the tunnel too and you should be safe.

UPDATE after I saw your comment about setting a VPN each time: You can start the VPN at boot and let it that way. When your machine is not online or your mother not connected to internet, the connection will not succeed and retry every x minutes (you set it). When both machines are ok the connection will succeed so she will have a permanent connection without doing anything (like 2 branch offices for example). Another way could be to make a small script starting openvpn and place an icon on her desktop but she will need to be in sudoers to execute the script I believe and she will need to remember to click on the icon. For this reason I would prefer the 1st way with permanent connection. You only need to pay attention to not redirect all her traffic though the VPN in the config.

share|improve this answer
add comment

What about UMTS/LTE access? It would protect from sniffing and allow SSH. It's gotten really easy to configure. You would have to teach your mom how to get her IP or get a dyndns-like solution. It's a matter of pricing and coverage of course.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.