Comprehensive Bash Script for Optimizing and Debloating Ubuntu 24.04
Enhance Privacy and Security on Your Fresh Ubuntu Installation
Key Takeaways
- Comprehensive Debloating: Removes unnecessary and potentially insecure packages to streamline your system.
- Advanced Security Measures: Implements robust firewall configurations, SSH hardening, and intrusion prevention tools.
- Privacy Enhancements: Disables telemetry, enforces DNS encryption, and integrates privacy-focused tools like Tor.
Introduction
Securing a fresh installation of Ubuntu 24.04 involves more than just standard updates. To maximize privacy and security, it's essential to remove unnecessary packages, disable data collection services, and implement advanced security configurations. The following Bash script automates this process, incorporating best practices recommended by top privacy experts and security professionals.
Bash Script: Ubuntu 24.04 Optimization and Debloating
Script Overview
The script performs the following key actions:
- System Update and Upgrade: Ensures all packages are up-to-date.
- Removal of Bloatware and Telemetry: Purges unnecessary applications and data collection services.
- Disabling and Removing Snap: Eliminates Snap package management in favor of traditional methods.
- Firewall Configuration: Sets up UFW with secure default policies.
- SSH Hardening: Enhances SSH security by disabling root login and password authentication.
- Intrusion Prevention: Installs and configures Fail2Ban to protect against brute-force attacks.
- Privacy Tools Installation: Integrates tools like Tor and DNSCrypt for enhanced privacy.
- System Hardening: Applies kernel-level tweaks and disables unnecessary services.
- Cleanup: Removes residual files and unused packages to free up system resources.
The Script
#!/bin/bash
# Exit immediately if a command exits with a non-zero status
set -e
# Ensure the script is run as root
if [ "$EUID" -ne 0 ]; then
echo "Please run as root."
exit 1
fi
echo "Starting Ubuntu 24.04 Privacy & Security Optimization"
# Update and upgrade system packages
echo "Updating and upgrading system packages..."
apt update && apt upgrade -y
# Remove telemetry and unnecessary software
echo "Removing telemetry and bloatware..."
apt purge -y apport whoopsie ubuntu-report popularity-contest snapd thunderbird transmission* rhythmbox* totem* cheese gnome-games* aisleriot shotwell* remmina* simple-scan gnome-mahjongg gnome-mines gnome-sudoku gnome-calendar
# Disable and remove Snap
echo "Disabling and removing Snap..."
systemctl stop snapd.service
systemctl disable snapd.service
rm -rf ~/snap /snap /var/snap /var/lib/snapd /etc/systemd/system/snapd*
apt purge -y snapd
apt-mark hold snapd
# Install Flatpak as an alternative to Snap
echo "Installing Flatpak..."
apt install -y flatpak
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
# Disable telemetry services
echo "Disabling telemetry services..."
systemctl disable apport.service
systemctl mask whoopsie.service
systemctl disable motd-news.timer
systemctl mask motd-news.timer
# Install and configure UFW (Uncomplicated Firewall)
echo "Configuring firewall..."
apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw enable
# Harden SSH configuration
echo "Hardening SSH..."
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
# Install and configure Fail2Ban
echo "Installing Fail2Ban..."
apt install -y fail2ban
systemctl enable fail2ban
systemctl start fail2ban
# Install privacy-focused tools
echo "Installing privacy tools..."
apt install -y tor torsocks dnscrypt-proxy
# Configure DNSCrypt-Proxy
echo "Configuring DNSCrypt-Proxy..."
mv /etc/dnscrypt-proxy/dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml.bak
cat << EOF > /etc/dnscrypt-proxy/dnscrypt-proxy.toml
server_names = ['cloudflare', 'google', 'quad9-dnscrypt-ip4']
listen_addresses = ['127.0.2.2:53']
max_clients = 250
ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = true
EOF
systemctl enable dnscrypt-proxy
systemctl start dnscrypt-proxy
# Disable unnecessary kernel modules and features
echo "Disabling IPv6..."
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.conf
echo "Disabling USB storage..."
echo "blacklist usb-storage" > /etc/modprobe.d/disable-usb-storage.conf
# Enable AppArmor
echo "Enabling AppArmor..."
apt install -y apparmor apparmor-utils
systemctl enable apparmor
systemctl start apparmor
aa-enforce /etc/apparmor.d/*
# Disable core dumps
echo "Disabling core dumps..."
echo "* hard core 0" >> /etc/security/limits.conf
echo "* soft core 0" >> /etc/security/limits.conf
# Enable process accounting
echo "Enabling process accounting..."
apt install -y auditd
systemctl enable auditd
systemctl start auditd
# Disable unnecessary services
echo "Disabling unnecessary services..."
systemctl disable cups.service
systemctl disable cups-browsed.service
systemctl disable avahi-daemon.service
systemctl disable bluetooth.service
# Configure automatic security updates
echo "Configuring automatic security updates..."
apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
# Cleanup unused packages and residual files
echo "Cleaning up system..."
apt autoremove -y
apt autoclean -y
apt clean -y
echo "Optimization and security hardening complete! Please reboot your system."
Detailed Explanation
1. System Update and Upgrade
Keeping your system up-to-date is the first step in maintaining security. This ensures all installed packages receive the latest security patches and updates.
2. Removal of Bloatware and Telemetry
Unnecessary applications not only consume system resources but can also pose security risks. This script removes default applications like Thunderbird, Transmission, and various GNOME games, along with telemetry services that collect usage data.
3. Disabling and Removing Snap
Snap packages are often criticized for their automatic updates and potential privacy implications. By removing Snap and installing Flatpak as an alternative, users gain more control over their package management.
4. Firewall Configuration with UFW
Configuring UFW to deny all incoming connections and allow outgoing ones provides a strong security baseline. Allowing SSH traffic ensures remote management remains possible while blocking unsolicited inbound connections.
5. SSH Hardening
Disabling root login and password authentication for SSH enhances security by requiring key-based authentication, making unauthorized access significantly more difficult.
6. Intrusion Prevention with Fail2Ban
Fail2Ban monitors log files and bans IPs that show malicious signs, such as too many password failures. This is crucial in protecting against brute-force attacks.
7. Privacy Tools Installation
Installing Tor and DNSCrypt-Proxy ensures that your internet traffic is anonymized and DNS queries are encrypted, preventing tracking and improving privacy.
8. System Hardening
Disabling IPv6 reduces the attack surface, especially if IPv6 is not in use. Disabling USB storage can prevent unauthorized data transfers. Enforcing AppArmor enhances application-level security by constraining programs' capabilities.
9. Cleanup
Removing residual files and unused packages helps in maintaining a clean system, freeing up disk space, and reducing potential vulnerabilities from outdated software.
Conclusion
Deploying this comprehensive Bash script on a fresh Ubuntu 24.04 installation significantly enhances privacy and security. By removing unnecessary components, disabling data collection services, and implementing robust security measures, users can ensure a more secure and private computing environment. Always remember to review and understand each step of the script to tailor it to your specific needs and environment.
References
After running this script, it is recommended to reboot your system to apply all changes effectively.
Last updated January 22, 2025