Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So with an old burned install CD of Feisty Fawn I went through the process of completely formatting the Windows OS and installing Ubuntu on an old XP laptop. I then went through the online upgrade to 10.4 LTS, only installing the gnome desktop environment package in the process.

My (admittedly very open) question is that in this state and online, what security considerations do I have to immediately make for the default install? I understand that a lot of this swings on my intended use of the server, but just sitting there online what risks is it exposed to (this obviously goes far beyond the realm of linux, but I am not sure how these risks are accommodated in the default install). For example, I believe there is a firewall installed with Ubuntu but by default it allows all traffic.

Any other guidelines would be much appreciated. Thanks

share|improve this question
up vote 5 down vote accepted

The Community Documentation's security chapter is a good starting point. For a server you should read the security chapter in the server guide, too

share|improve this answer

You should feel secure, at least for the time being, because there are no services running by default. In addition, if you have a router between your ISP router and your computer, then your network is probably using private addressing, anyway, like 192.168.something. (And that router would need a specific instruction to forward certain packets from your public address to your private address.) There's plenty of time for Florian's first comment.

share|improve this answer


There is no firewall needed for a default Ubuntu system because there are no insecure services listening by default.

share|improve this answer
this answer is demonstrably incorrect - all services which listen must be considered as insecure. Not all the time, but zero-day exploits are real, and until an exploit in a service is patched it is insecure. – Rory Alsop Jan 7 '11 at 20:59
In the default installation Ubuntu doesn't have any services listening to external traffic. – Florian Diesch Jan 7 '11 at 21:09

As you say it does depend on exactly what you will use this for, but usual practice is:

  • Understand what services you want? HTTP? SSL? SMTP? Ensure all others are disabled/removed
  • Use some form of filtering to allow only those services, and you reduce the potential threat footprint (in case malicious or accidental services exist on the server)

Depending on your threat, you may want to run the initial install behind a firewall which only allows outbound connections. This is what I would recommend for any install which may need to download updates - it helps to remove the threat of compromise before updates and patches are implemented.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.