Updates, Firewall, and Services¶
The same three quick wins as on Windows: patch it, turn on the firewall, and shut off what isn't needed.
Updates¶
Ubuntu releases patches constantly. Install them.
sudo apt update # refresh package lists
sudo apt upgrade # install available updates
apt list --upgradable shows what's waiting without installing.
Open Software Updater from the applications menu. It checks for updates and offers to install them.
Update settings¶
Open Software & Updates (from the applications menu, or the Settings button in Software Updater). Three tabs matter.
Ubuntu Software. Which repositories to pull from. Leave the official ones checked.
Other Software. Third-party repositories. Each one is another source you're trusting. Remove anything you don't recognize.
Updates. Check Important security updates and Recommended updates. Set Automatically check for updates to Daily. Leave unsupported and proposed updates off.
Note
If Software Updater offers to upgrade to a newer Ubuntu release, say no. On a competition image, a release upgrade takes an hour and can break the scoring engine.
Automatic security updates from the terminal:
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades # answer Yes
Firewall: ufw¶
Ubuntu's firewall is ufw (Uncomplicated Firewall). It is installed but off by default.
sudo ufw status # Status: inactive
sudo ufw enable
sudo ufw status verbose
The defaults after enabling are the right ones: deny all incoming, allow all outgoing. Only open what the README requires.
sudo ufw allow ssh # by service name
sudo ufw allow 80/tcp # by port
sudo ufw allow 443/tcp
sudo ufw deny 23 # explicitly block telnet
sudo ufw delete allow 80/tcp # remove a rule
Deny drops the packet silently. Reject drops it and tells the sender it was blocked. Deny is the default and the better choice for incoming traffic; the sender learns nothing.
Gufw¶
Gufw is a graphical front end for the same firewall.
sudo apt install gufw
Open Firewall Configuration from the applications menu (if it doesn't appear right after installing, log out and back in). Click Unlock, authenticate, and switch Status to on. The Rules tab has a + button; the Preconfigured tab lets you allow an application by name, which is safer than opening a port, same as the Windows exceptions list.
Services¶
Services are programs that run in the background. Each one that's running is something an attacker can talk to, so anything the scenario doesn't need should be off.
systemctl¶
systemd manages services on Ubuntu and Mint.
systemctl list-units --type=service --state=running # what's running now
systemctl list-unit-files --type=service # everything installed, and whether it starts at boot
systemctl status ssh # one service
sudo systemctl stop telnet.socket # stop now
sudo systemctl disable telnet.socket # don't start at boot
sudo systemctl disable --now vsftpd # both
sudo systemctl enable --now ssh # the reverse, if the README needs it
Services that usually shouldn't be running on a workstation: telnet, vsftpd or proftpd (FTP), apache2 or nginx (web) unless the scenario runs a website, samba unless file sharing is required, nfs-server, snmpd, rsh, xinetd. Search the name before you disable something you don't recognize.
Listening ports¶
The fastest way to see what's accepting connections:
sudo ss -tulnp
Each line is a listening port and the program behind it. Anything you can't explain is a lead.
Stacer¶
Stacer is a graphical system monitor that includes a services page with start/stop and enable/disable toggles.
sudo apt install stacer
stacer
The fourth icon in the sidebar is Services. Handy for a visual scan, but systemctl is what you should know.
Try it¶
- Run
sudo ufw status. Enable it if it's off, and confirm the defaults withstatus verbose. - List running services. Pick three you don't recognize and look up what they do.
- Run
sudo ss -tulnpand match each listening port to a service.