Hardening Linux Mint, beginner-friendly

Linux Mint 22 / published / guide #58 / ≈ 5 min read

Linux Mint is mostly safe out of the box for a typical desktop — no public services listening by default, automatic security updates available with one click. But there are a handful of small steps that take it from "safe enough" to "actually defended." This guide walks through them slowly.

Most of these steps are off by default on a desktop because they'd annoy a first-time user. They're still worth doing as soon as you're comfortable with the system.

The shortlist

  1. Turn on automatic security updates.
  2. Turn on the firewall.
  3. Make Timeshift snapshots a habit.
  4. Sane sudo timeout, no root login.
  5. SSH the right way (only if you'll ever use it).
  6. Browser hygiene (Firefox sandboxing, uBlock Origin).
  7. Lock your screen when you walk away.

Step 1: automatic security updates

Open Update Manager. Edit menu → Preferences → Automation tab. Check:

  • "Apply updates automatically" — type: security only, frequency: daily.
  • "Remove obsolete kernels and dependencies" — yes; keeps /boot tidy.

Now critical patches install on their own, quietly, in the background.

Step 2: the firewall (ufw)

Mint installs ufw (Uncomplicated Firewall) by default but doesn't turn it on. Two ways to enable it.

GUI: Menu → Firewall Configuration → toggle Status to ON. The default profile is "Public" which is appropriate for laptops; it blocks all incoming connections.

Terminal:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose

If you ever need to allow a service (SSH, a game server, Samba shares to other machines on your LAN), use the Firewall Configuration tool or:

sudo ufw allow ssh                                     # tcp 22
sudo ufw allow from 192.168.1.0/24 to any port 22      # only from LAN
sudo ufw delete allow ssh                              # undo

Step 3: Timeshift, set up properly

If you skipped this in the first-hour guide: open Timeshift, run the wizard, take a baseline snapshot. See the Timeshift on Mint guide for the long version.

Snapshots don't prevent compromise, but they prevent the second-order harm — being stuck on a broken system, or losing system config to a bad update.

Step 4: sudo timeout and no root

Mint, like Ubuntu, has no root password set — you become root via sudo only, with your own password. Don't change this. Don't set a root password and don't enable root login at the graphical login screen.

By default sudo remembers your password for 15 minutes after you type it. Shorten that:

sudo visudo

Add or change:

Defaults timestamp_timeout=2

Now sudo only remembers for 2 minutes. Tiny annoyance, real safety: if you step away with a terminal open, the sudo grace period expires fast.

Step 5: SSH (only if you use it)

SSH is not installed or running by default on a Mint desktop. If you don't use it, leave it that way — confirm:

systemctl is-enabled ssh 2>/dev/null   # "Failed to get unit file state" = not even installed = good
ss -tlnp | grep :22                     # nothing listening = nothing to attack

If you do need SSH (you log in from another machine sometimes):

sudo apt install openssh-server
sudo systemctl enable --now ssh
sudo ufw allow ssh

Then from your other machine, set up key-based login:

ssh-keygen -t ed25519                  # if you don't have one
ssh-copy-id you@mint-box

Test that it works without a password. Then on the Mint box, turn off password login:

sudo nano /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
AllowUsers you
sudo systemctl reload ssh

For a server you're actually exposing on the internet, also install fail2ban:

sudo apt install fail2ban

Defaults already protect SSH out of the box.

Step 6: browser hygiene

The browser is the most-exposed program on any desktop. Two five-minute wins:

  • uBlock Origin — install from the Firefox add-on store. Blocks ads, blocks the trackers attached to them, blocks the majority of drive-by exploit kits. There's no downside.
  • Update Firefox. Mint's Update Manager handles this. Don't fall behind by more than a couple of weeks.

Optionally, run Firefox via Flatpak instead of the apt version:

flatpak install flathub org.mozilla.firefox

The Flatpak version runs in a stricter sandbox — slightly more isolation if the browser is ever exploited.

Step 7: lock the screen

One key combo: Ctrl+Alt+L. Whenever you walk away. The hardening above is meaningless if anyone can sit down at your unlocked desktop.

Also: System Settings → Screensaver → Lock the screen when the screensaver is active. Make sure it's on and the screensaver kicks in within 5-10 minutes.

Step 8: kernel sysctls (slightly more advanced)

Same set as the other distro hardening guides — small, safe defaults that move the needle:

sudo nano /etc/sysctl.d/99-hardening.conf
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.rp_filter = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.yama.ptrace_scope = 1
sudo sysctl --system

Step 9: AppArmor

Mint ships AppArmor enabled by default — you don't need to do anything to turn it on. Verify:

sudo aa-status

Should report apparmor loaded with a list of profiles. If you ever see a guide telling you to disable AppArmor to "fix" a problem, find a different fix.

Step 10: backups (a separate thing from snapshots)

Timeshift snapshots system files, not personal data. For /home you want a real backup that lives somewhere else.

The Mint-friendly tool is Backup Tool (in the menu) — copies your home to a folder you pick. Useful, but limited (no scheduling, no remote).

For a better solution, set up rsync to an external drive (see the rsync without losing data guide) or use a cloud-syncing tool you trust (Syncthing, Nextcloud, …).

Things this guide doesn't cover (and why)

  • Full-disk encryption. Has to happen at install time — the installer has a checkbox. If you didn't check it, reinstall is the only solid path.
  • Two-factor for sudo. Possible, fiddly, and rarely worth it on a desktop. Worth considering on a server.
  • SELinux. Not what Mint uses; AppArmor covers the same ground here.
  • Tor / VPN. Privacy tools, not directly hardening. Worth their own guide.

The done check

sudo ufw status verbose                    # firewall on, rules look right?
sudo aa-status | head                       # apparmor loaded?
systemctl is-active unattended-upgrades     # auto-updates running?
ss -tulpn                                   # anything exposed you don't expect?
timeshift --list                            # snapshots exist?

Five commands. If they all look reasonable, your Mint laptop is in a quietly defensible state — without sacrificing anything that made you pick Mint in the first place.

← back to index