After looking around on the Internet for a while, I've only come up with ways to help secure Debian when it comes to production servers, not home PCs. (Aside from this, anyway. I do everything the first answer mentions, but I figured I'd ask anyway.) I'm sure some of the tips can be used for both situations, but I'm honestly not sure which.
First of all, I should tell you what I actually use my computer for, as the outcome of this question will ultimately be broken down for that purpose. All I really do with my computer is browse the Internet (mainly watching cartoons on JTV), talk to people using Pidgin, and play Minecraft and Tales of Maj'Eyal.
This is all I really do when setting up my computer after I install Debian:
1. Disable some start-up services: * = Disabled
AT-SPI D-Bus Bus (*) Bluetooth Manager (*) Caribou Certificate and Key Storage (*) Desktop Sharing (*) Disk Notifications (*) Evolution Alarm Notify Files GNOME Settings Daemon GPG Password Agent GSettings Data Conversion (*) Mount Helper Network (*) Notification Daemon (*) Orca screen reader (*) Personal Filer Sharing PolicyKit Authentication Agent Pulseaudio Sound System (Question regarding this: Why is it run with "Very High" priority by default?) (*) Screensaver Secret Storage Service SSH Key Agent (*) Tracker File System Miner (*) Tracker Store User folders update Volume Control
The ones I left enabled are ones that I either don't know what they do and/or I'm unsure if they're needed for proper system functionality. If anyone could point out any others that could also be disabled, please let me know.
2. Change system settings:
Nothing interesting to note here. All I really change is mouse speed/acceleration and some other stuff within GNOME.
3. Install (G)UFW / remove GRUB's wait time before automatically selecting a kernel to load:
apt-get install gufw -- I leave this with the default settings: Incoming deny, outgoing allow.
Is this necessary? I have a firewall on my router as well.
nano /etc/default/grub -- I change GRUB_TIMEOUT from 5 to 0 then run
I usually reboot here
4. Install Google Chrome:
Pretty standard stuff here. When it comes to settings:
Privacy - The only thing I leave enabled is "Enable phishing and malware protection"
System - I disable "Continue running background apps when Google Chrome is closed"
I remove Google Docs, as I don't need it. As for plugins, all I leave enabled is Adobe Flash Player. For some reason Shockwave Flash was just awful when I tried it, so I kept using the other one. I also install Adblock Plus and HTTPS Everywhere.
5. Install Pidgin:
Again, nothing special to note. Disable chat logging, disable UPnP (not that it matters, it's disabled at a router level), disable multiple logins, and require SSL.
6. Remove Java entirely and re-install it:
apt-get install openjdk-7-jre
I usually reboot here
7. Whatever I want.
I have nothing particularly valuable stored on my HDD, thus I haven't bothered with encryption. Should I? I have thought about changing UFW to deny all outgoing connections as well, and I did try, but no matter what I did, adding rules to allow 80/443 (That's all I tested, I assume other ports for Pidgin and such would fail as well.) through did not end well!
Is this good enough for my needs as stated above? Is there something extra I should really be doing, or anything I need to change in my current routine?