Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

After looking around on the Internet for a while, I've only come up with ways to help secure Debian when it comes to production servers, not home PCs. (Aside from this, anyway. I do everything the first answer mentions, but I figured I'd ask anyway.) I'm sure some of the tips can be used for both situations, but I'm honestly not sure which.

First of all, I should tell you what I actually use my computer for, as the outcome of this question will ultimately be broken down for that purpose. All I really do with my computer is browse the Internet (mainly watching cartoons on JTV), talk to people using Pidgin, and play Minecraft and Tales of Maj'Eyal.

This is all I really do when setting up my computer after I install Debian:

1. Disable some start-up services: * = Disabled

AT-SPI D-Bus Bus
(*) Bluetooth Manager
(*) Caribou
Certificate and Key Storage
(*) Desktop Sharing
(*) Disk Notifications
(*) Evolution Alarm Notify
Files
GNOME Settings Daemon
GPG Password Agent
GSettings Data Conversion
(*) Mount Helper
Network
(*) Notification Daemon
(*) Orca screen reader
(*) Personal Filer Sharing
PolicyKit Authentication Agent
Pulseaudio Sound System (Question regarding this: Why is it run with "Very High" priority by default?)
(*) Screensaver
Secret Storage Service
SSH Key Agent
(*) Tracker File System Miner
(*) Tracker Store
User folders update
Volume Control

The ones I left enabled are ones that I either don't know what they do and/or I'm unsure if they're needed for proper system functionality. If anyone could point out any others that could also be disabled, please let me know.

2. Change system settings:

Nothing interesting to note here. All I really change is mouse speed/acceleration and some other stuff within GNOME.

3. Install (G)UFW / remove GRUB's wait time before automatically selecting a kernel to load:

apt-get install gufw -- I leave this with the default settings: Incoming deny, outgoing allow.

Is this necessary? I have a firewall on my router as well.

nano /etc/default/grub -- I change GRUB_TIMEOUT from 5 to 0 then run update-grub

I usually reboot here

4. Install Google Chrome:

Pretty standard stuff here. When it comes to settings:

Privacy - The only thing I leave enabled is "Enable phishing and malware protection"

System - I disable "Continue running background apps when Google Chrome is closed"

I remove Google Docs, as I don't need it. As for plugins, all I leave enabled is Adobe Flash Player. For some reason Shockwave Flash was just awful when I tried it, so I kept using the other one. I also install Adblock Plus and HTTPS Everywhere.

5. Install Pidgin:

Again, nothing special to note. Disable chat logging, disable UPnP (not that it matters, it's disabled at a router level), disable multiple logins, and require SSL.

6. Remove Java entirely and re-install it:

Removal -- apt-get install openjdk-7-jre

I usually reboot here

7. Whatever I want.


I have nothing particularly valuable stored on my HDD, thus I haven't bothered with encryption. Should I? I have thought about changing UFW to deny all outgoing connections as well, and I did try, but no matter what I did, adding rules to allow 80/443 (That's all I tested, I assume other ports for Pidgin and such would fail as well.) through did not end well!

Is this good enough for my needs as stated above? Is there something extra I should really be doing, or anything I need to change in my current routine?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.