Wireless internet security

Question

I have just installed Ubuntu 10.10 (dual booted with Windows 7) on a laptop which will connect to the internet through a wireless internet connection and I want to ensure that this is secure. I have installed GUFW and enabled the UFW firewall and set incoming to deny. What else can I do to secure this laptop?

Answer 1

• Keep your installation updated: Even Linux programs will have security issues ocassionally, so make sure you periodically install all suggested updates for your system.
• don't install packages you don't need: What isn't there on your system can't have security risks. This is especially true for daemons/server of any kind. I.e. if you don't need a webserver, uninstall apache. Ubuntu doesn't come with those by default but if you added one, consider removing it.
• consider disabling Flash and Java plugins for your browser: Of course if you need one of those, you'll have to leave it enabled. Make sure you update the plugins, then. However, if you don't need e.g. a Java plugin in your browser, consider removing icedtea6-plugin, sun-java6-plugin and the likes
• filter your internet: there are many browser extensions that help you filter the internet from stuff you don't need and can carry security issues
  • Flahblock Addon (xul-ext-flashblock ) disables auto-play for flash applications. Flash apps are replaced by a "play" button that starts the app on click. Also, it allows to whitelist sites like youtube or hulu, when you're sure they pose no thread
  • Adblock Plus (xul-ext-adblock-plus ) filters website ads that often don't come from the original site but from third parties that may not be as trustworthy as the original site you're visiting. However, if you trust a site and want to support it by viewing ads, it allows whitelisting known good sites.
  • NoScript disables JavaScript everywhere you don't whitelist, helping keep you safe from JavaScript exploits or some XSS-Attacks
• don't run stuff you don't trust: not only executable files are dangerous. Recently, PDF files could include security risks, too. Those are mostly designed for the original Adobe Reader, however standard caution is still useful when opening files from untrusted sources
• don't add random PPAs or install random packages: Addins PPAs or installing packages from website might be a huge convenience when installing programs that are not included in Ubuntu sources (or just plain old), however keep in mind that third party-repositories not only are able to install malicious software through updates, but that the installation process usually runs as root, which includes any scripts included in the installation package. Only add PPAs and packages from a trusted source, if you must have them.
• keep your laptop physically secure: This one depends on what kind of security you wish to achieve. Consider buying a hardware chain and lock (Kensington Lock) so your hardware can't be stolen. As a basic precaution, lock your screen when you leave the laptop for longer than a few seconds by clicking the power-off button top right and selecting lock screen.
• Encrypt your data: if you travel with sensitive data, consider encrypting your data. When installing Ubuntu or adding a new user, there is a checkbox that says Encrypt my home directory. This encrypts your home directory and protects its contents when your device is off. Keep in mind, however, that as long as the laptop is running, files are not protected and accessible.

Answer 2

As mentioned previously, go with protected wireless, using WPA/WPA2, avoiding WEP or open wireless. Also, avoid unknown applications, or those that have not been reviewed first. Anything you do on the internet today should all be encrypted using SSH/HTTPS. Although Ubuntu is not installing services by default, this is something that a local Linux guru should check to make sure nothing that you don't know is running. There also may be services for things such as Bluetooth, Eudora or other end-user services that you don't need. The less programs you run, the better/safer you are. For example, Ubuntu is known to run an email agent of some kind for checking your email, regardless of the email software you use. I usually disable half a dozen of such services on my installation, before starting to really use it.

Answer 3

The problem is not the security of the laptop (incoming ports etc) you've taken care of those. The problem is that wifi is inherently insecure by the nature of you broadcasting all your information for a 30 foot radius.

Always use ssl/https, always ensure you're using an encrypted WPA2 network (not WEP) and plug in via ethernet if you really want to make sure.

Answer 4

That's pretty much all you need. By default, no "server" services run on Ubuntu, so technically even starting ufw (using gufw) is overkill. Obviously if you later configure services, then these should be ideally firewall protected so that only your desired clients can see them.

Having said that, you still want to ensure that your wireless connection is properly protected (which isn't really Ubuntu specific but I'll add it here for completeness) :

Go to the network manager applet, right click and choose "Connection Information". Highlight your wireless network, then check the "Security" :

That should say either "WPA/WPA2" or "WEP". If it's "Open", then you have to reconfigure your router, then reconnect your laptop with the proper key.

Answer 5

Get rid of Windows 7?

More seriously, always use SSL websites (https://) where possible and install some security/privacy-related extensions in Firefox, e.g. NoScript, Adblock Plus, Better Privacy, Cookie Monster, Ghostery, HTTPS-Anywhere, Passwordmaker.