Chapter 09 · Build Ubuntu

The Ubuntu laptop

A laptop inverts the VPS threat model. It has no public IP and nothing is scanning it, but it gets carried through airports, left in hotel rooms, and joins networks run by strangers. The controls that matter are physical and mobile, not perimeter.

The whole chapter is one question, asked from the other side: someone is holding your laptop, and you are not. What they get depends almost entirely on what state the machine was in when they picked it up.

How it was taken Powered down Lid closed, asleep Open and unlocked

◀ ▶Play ▶

0 1 2 3 4

$ lsblk -o NAME,FSTYPE,MOUNTPOINT
nvme0n1p3 crypto_LUKS — the one line you want to see

$ gsettings get org.gnome.desktop.screensaver lock-delay
uint32 0 — locked the instant the screen blanked

$ w
you tty2 :0 still logged in — the lid was never closed

# the initramfs, on a cold boot
Please unlock disk nvme0n1p3_crypt: — nothing else on screen

# the lock screen, on wake
Password: — and the volume key is still live in RAM

$ ls ~/.ssh
id_ed25519 id_ed25519.pub known_hosts config

# their USB stick, in the boot menu
Enter Supervisor Password: — the menu never opens

# they hold the power button down
RAM contents gone — this is the powered-off case now

# nobody reboots a machine they already own
the running session is worth more than the disk

$ sudo cryptsetup luksDump /dev/nvme0n1p3
Version: 2 Cipher: aes-xts-plain64 — a header, and noise

$ lsblk -o NAME,FSTYPE (their machine, your SSD)
crypto_LUKS — identical to the cold case

$ mount | grep dm-0
/dev/mapper/nvme0n1p3_crypt on / type ext4 (rw)

# offline, on their hardware, for as long as they like
no lockout, no attempt counter — only your passphrase

$ cat /etc/crypttab
cryptswap /dev/urandom — hibernate has nowhere to leak to

$ ssh-add -l
256 SHA256:… (ED25519) — the agent is loaded and will sign

1. 0 · It is gone, and it was offThe volume key does not exist anywhere in the machine — it is derived from your passphrase during boot and lives only in RAM afterwards. A powered-down laptop is the one state where the disk is genuinely protected, and every control further down this ladder is really about getting the machine into it.
2. 0 · It is gone, and it was asleepThis is the common case: lid closed, bag over the shoulder. The disk was unlocked before the lid came down, so the volume key is sitting in RAM right now. Suspend does not undo that — it hides it behind the lock screen. That is why lock-delay 0 matters more here than anywhere else.
3. 0 · It is gone, and it was openTwo minutes at a café counter. The disk is mounted, your SSH agent may hold a loaded key, your browser is signed in to everything, and the machine is a member of your tailnet. Nothing in this chapter has any effect on this case except the idle timeout that should have fired.
4. 1 · They open the lid — and get a promptA cold boot lands in the initramfs, which asks for the passphrase and then waits. No desktop, no hostname, no filenames, not even a username to try. There is nothing to look at, which is a surprisingly large part of the value.
5. 1 · They open the lid — and get the lock screenlock-enabled true with lock-delay 0 means the screen locked the instant it blanked. A grace period exists so that you can wake the machine without typing; on a laptop that leaves the house it is a window someone else uses. Pair it with idle-delay 300 so the screen blanks while you are still walking away.
6. 1 · They open the lid — and it is your desktopMail, chat, the terminal you were mid-command in. Disk encryption, Secure Boot and the UEFI password have all been bypassed without being attacked, because none of them apply to a running, unlocked session. This one rung is the difference between an expensive inconvenience and an incident.
7. 2 · They try to boot their own OSThe classic evil-maid shortcut: boot a live USB and read the disk as an ordinary volume. A UEFI supervisor password stops the boot menu opening, disabling USB and network boot removes the target, and Secure Boot refuses the unsigned kernel even if they get that far. Check the last one with mokutil --sb-state.
8. 2 · A reboot is the best thing they could do for youCutting power throws away everything in RAM, including the volume key. From here the sleeping case and the cold case are the same case — and the firmware controls above now apply. The thief has just moved themselves into the harder problem.
9. 2 · There is no reason to rebootRebooting would cost them the unlocked session and gain them a LUKS prompt. A live, logged-in system is strictly more valuable than its disk. This rung only exists for a machine that was off — which is the argument for making sure yours is.
10. 3 · They take the SSD outUnscrew it, put it in an enclosure, plug it into a machine they control — and lsblk says crypto_LUKS. A header, a salt, and several hundred gigabytes of noise. No filenames, no sizes, no directory structure to work from. This is the single control the whole chapter rests on.
11. 3 · Pulling the disk means powering it offThe same ciphertext as the cold case — the RAM does not come with the drive. The honest risk in the sleeping state is not the disk at all, it is the memory: cold-boot and DMA attacks against a suspended machine are real, and they are a lab's job rather than an opportunist's. If you hibernate rather than suspend, that key gets written to swap, which is why /etc/crypttab matters.
12. 3 · The filesystem is already open/dev/mapper/nvme0n1p3_crypt is mounted read-write and they are inside it. ~/.ssh, the browser profile, ~/.bash_history, every cloud credential in ~/.config — readable as you, immediately, with no attack of any kind involved.
13. 4 · All that is left is the passphraseThey can copy the encrypted image and grind at it offline, on their own hardware, for as long as they care to. There is no hardware rate limiting the way a phone has, no lockout, no attempt counter, no remote wipe. Your passphrase length is the entire remaining control — pick it accordingly, and keep it in a password manager you can reach from another device.
14. 4 · The same passphrase problem, one step laterWhatever state it left in, the machine is cold by now and the maths is identical. The extra thing to check for a laptop that sleeps is hibernation: hibernating writes RAM — including the decrypted volume key — to swap. lsblk -o NAME,FSTYPE | grep -i swap and cat /etc/crypttab tell you whether that landing spot is encrypted.
15. 4 · There was never anything to brute-forceThe disk was decrypted from the moment they picked it up. LUKS protects data at rest, and an unlocked laptop has no data at rest. Every strong-passphrase argument on this rung applies to the other two scenarios and to none of this one.

Disk encryption is the whole game

Every other control on a laptop assumes the attacker does not have the disk. Without full-disk encryption, a stolen laptop hands over your SSH keys, your browser sessions, and your shell history in the time it takes to boot a USB stick.

# Are you actually encrypted? crypto_LUKS on the root device is the answer.
lsblk -o NAME,FSTYPE,MOUNTPOINT

# Detail on the LUKS header
sudo cryptsetup luksDump /dev/nvme0n1p3

Two follow-ups people miss. Use a genuinely strong passphrase, since it is the only thing between a thief and the disk — unlike a phone, there is no hardware rate limiting on attempts. And if you hibernate, confirm swap is encrypted too, because hibernation writes RAM (including decrypted keys) to it:

lsblk -o NAME,FSTYPE | grep -i swap
cat /etc/crypttab

Firmware and boot

• Set a BIOS/UEFI supervisor password so the boot order cannot be changed.
• Disable booting from USB and network once you no longer need it.
• Leave Secure Boot enabled — Ubuntu supports it out of the box. Check with mokutil --sb-state.

These stop the evil-maid shortcut of booting another OS to read or tamper with your disk. They do not stop a determined attacker with the machine for a week, but they raise the cost substantially for the realistic case.

Lock screen and idle

gsettings set org.gnome.desktop.screensaver lock-enabled true
gsettings set org.gnome.desktop.screensaver lock-delay 0
gsettings set org.gnome.desktop.session idle-delay 300

lock-delay 0 means the lock takes effect the instant the screen blanks, with no grace period. On a machine that leaves the house, the grace period is a liability.

Hostile networks

A laptop joins conference Wi-Fi and hotel networks where other guests are on the same segment. Default-deny inbound is not paranoia here, it is the baseline:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose

Note that you do not add an SSH allow rule. Tailscale traffic arrives over the tailscale0 interface, and binding sshd to the tailnet address (below) means the hotel network never sees the port at all.

Randomise your MAC address

By default your network card broadcasts a stable hardware address on every network you join, which is a durable tracking identifier across venues:

[device]
wifi.scan-rand-mac-address=yes

[connection]
wifi.cloned-mac-address=stable
ethernet.cloned-mac-address=stable

stable generates a consistent address per network — so captive portals and MAC allow-lists keep working — while presenting a different one to each. Use random for a fresh address every connection, at the cost of re-authenticating to portals.

Joining the tailnet

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh
tailscale ip -4

Tailscale SSH works as a server on Linux, so this is the simplest path: identity-based auth, no authorized_keys to maintain, and the ability to force periodic re-authentication through the check action in your ACL policy.

If you prefer OpenSSH, bind it to the tailnet address as on the Mac:

# Both families — `tailscale ip -4` and `tailscale ip -6`.
# One ListenAddress line stops sshd listening on everything else,
# and MagicDNS hands clients the IPv6 record too. See chapter 05.
ListenAddress 100.x.y.z
ListenAddress fd7a:115c:a1e0:ab12:4843:cd96:6475:ca41
PasswordAuthentication no
PermitRootLogin no
AllowUsers yourname
ClientAliveInterval 30
ClientAliveCountMax 6
LogLevel VERBOSE

AppArmor

Ubuntu ships AppArmor enabled, confining many services to a declared set of files and capabilities. It is easy to leave alone and worth confirming rather than assuming:

sudo aa-status

If a profile is in complain mode it logs violations without blocking. That is useful while developing a profile and pointless as a permanent state — move profiles you rely on to enforce.

Automatic updates

Same package as the VPS, different reboot policy. A laptop should never reboot itself while you are mid-sentence:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Unattended-Upgrade::Automatic-Reboot "false";

Then check /var/run/reboot-required yourself, or let the desktop notify you. Kernel and libssl updates do not take effect until a restart, so "patched" and "rebooted since patching" are different states.

Dev environment

sudo apt install -y tmux mosh git build-essential
curl -fsSL https://herdr.dev/install.sh | sh

# Same tmux config as the Mac — keep them identical across machines
# so your muscle memory works everywhere.

Keeping ~/.tmux.conf and ~/.config/herdr/config.toml byte-identical on every machine is worth the small effort of a dotfiles repo. Prefix keys that differ between hosts are a constant, low-grade tax.

Checklist

• LUKS full-disk encryption confirmed with lsblk.
• Strong disk passphrase, stored in a password manager you can reach from another device.
• Swap encrypted if you hibernate.
• UEFI supervisor password set; USB/network boot disabled; Secure Boot on.
• Screen locks immediately on blank, idle timeout at five minutes or less.
• UFW default-deny inbound, with no public SSH rule.
• MAC address randomisation configured.
• Tailscale joined; tailscale up --ssh or sshd bound to the tailnet address in both families.
• AppArmor enforcing.
• unattended-upgrades on, automatic reboot off.
• tmux, mosh and Herdr installed with configs matching your other machines.

The commands in this guide change firewall and login settings, and can lock you out of a machine. Practise on something disposable first. Everything here is provided as is, with no warranty — you accept the risk of running it. Read the disclaimer.