privacy.sexyRevamped

Linux privacy and hardening script catalog

The full index of what the Linux collection can change, grouped the way the script builder groups it. Every entry is a tweak you can select, read as plain commands, and download as one script that runs locally.

Build a Linux script →

This is a desktop Linux collection, not a server baseline. If you came looking for CIS or STIG remediation, an Ansible role will serve you better. What is here is the privacy surface of a workstation: shell and terminal history, recently-used file lists, package manager data for APT, Snap and Flatpak, shared caches and thumbnails, Firefox and Thunderbird profiles, Wine and Visual Studio Code state, and the distribution telemetry that Ubuntu, Debian, Arch and Zorin each collect differently: popcon, pkgstats, Apport, Whoopsie and the Ubuntu metrics reporter. Kernel and network hardening sysctls sit alongside them.

Distribution coverage is uneven and worth saying plainly: Debian and Ubuntu derivatives are covered best, Arch and Zorin partially, and Fedora and openSUSE barely at all. A script that targets a path your distribution does not use reports that it skipped and moves on.

Privacy cleanup

  • Empty trash Opt-in only
  • Clear screenshots Opt-in only

Clear terminal history

  • Clear bash history Opt-in only
  • Clear Zsh history Opt-in only
  • Clear tcsh history Opt-in only
  • Clear fish history Opt-in only
  • Clear KornShell (ksh) history Opt-in only
  • Clear ash history Opt-in only
  • Clear crosh history Opt-in only

Clear third-party application data

  • Clear Steam cache Opt-in only
  • Clear Clementine cache Opt-in only
  • Clear LibreOffice usage history Opt-in only

Clear third-party application data › Clear Wine data

  • Clear Wine cache Opt-in only
  • Clear Winetricks cache Opt-in only

Clear third-party application data › Clear Thunderbird data

  • Clear Thunderbird cookies Opt-in only
  • Clear Thunderbird session restoration data (open windows and tabs) Opt-in only
  • Clear Thunderbird passwords Opt-in only
  • Clear clicked links history in Thunderbird Opt-in only

Clear third-party application data › Clear data from development tools

  • Clear Python history Opt-in only

Clear third-party application data › Clear data from development tools › Clear Visual Studio Code data

  • Clear Visual Studio Code crash reports Opt-in only
  • Clear Visual Studio Code cache Opt-in only
  • Clear Visual Studio Code logs Opt-in only

Clear third-party application data › Clear data from development tools › Clear Azure CLI data

  • Clear Azure CLI telemetry data Opt-in only
  • Clear Azure CLI logs Opt-in only
  • Clear Azure CLI cache Opt-in only
  • Clear Azure login data (this will log you out of the current session) Opt-in only

Clear browser history › Clear GNOME Web (Epiphany) history

  • Clear GNOME Web cache Opt-in only
  • Clear GNOME Web browsing history Opt-in only
  • Clear GNOME Web cookies Opt-in only
  • Clear GNOME Web bookmarks Opt-in only

Clear browser history › Clear Firefox history

  • Clear Firefox cache Opt-in only
  • Clear Firefox crash reports Opt-in only
  • Clear Firefox cookies Opt-in only
  • Delete Firefox browsing history, bookmarks, and download history Opt-in only
  • Clear Firefox logins Opt-in only
  • Clear Firefox autocomplete history Opt-in only
  • Clear Firefox "Multi-Account Containers" data Opt-in only
  • Clear Firefox open tabs and windows data Opt-in only

Clear system and kernel usage data

  • Clear system crash report files Opt-in only
  • Clear system logs (`journald`) Opt-in only

Clear recently used files list

  • Clear GTK recently used files list Opt-in only
  • Clear KDE-tracked recently used items list Opt-in only

Clear package manager data

  • Clear YUM/RPM data Opt-in only
  • Clear DNF/RPM data Opt-in only

Clear package manager data › Clear Snap data

  • Clear Snap cache Opt-in only
  • Remove old Snap packages Opt-in only

Clear package manager data › Clear Flatpak data

  • Remove orphaned Flatpak runtimes Opt-in only
  • Clear Flatpak cache Opt-in only

Clear package manager data › Clear APT data

  • Clear obsolete APT packages Opt-in only
  • Clear APT package file lists Opt-in only
  • Clear orphaned APT package dependencies Opt-in only
  • Clear cache for APT packages Opt-in only

Clear shared caches

  • Clear user-specific cache Opt-in only
  • Clear Flatpak application cache Opt-in only
  • Clear Snap application cache Opt-in only
  • Clear thumbnails (icon cache) Opt-in only

Disable OS data collection

  • Disable connectivity checks (breaks Captive Portal detection) Opt-in only
  • Use a stable Wi-Fi MAC address per network Opt-in only

Disable GNOME data collection

  • Disable GNOME software usage statistics Recommended
  • Disable GNOME technical problem reports Recommended
  • Disable GNOME location services Recommended
  • Disable GNOME recent files history Strict
  • Disable GNOME application usage history Strict

Disable Debian telemetry › Disable sending of package statistics (popcon)

  • Disable participation in Popularity Contest Recommended
  • Remove Popularity Contest (`popcon`) package Opt-in only
  • Remove daily cron entry for Popularity Contest (popcon) Strict

Disable Arch Linux telemetry › Disable `pkgstats` that collects installed package list (opt-in)

  • Remove `pkgstats` package Opt-in only
  • Disable weekly `pkgstats` submission Recommended

Disable Zorin OS telemetry

  • Disable Zorin OS census pings Opt-in only
  • Remove Zorin OS census unique ID Opt-in only

Disable Ubuntu telemetry

  • Disable Ubuntu MOTD News requests Recommended

Disable Ubuntu telemetry › Disable metrics reporting in Ubuntu

  • Disable participation in metrics reporting in Ubuntu Recommended
  • Remove Ubuntu Report tool (`ubuntu-report`) Opt-in only

Disable Ubuntu telemetry › Disable Ubuntu error tracker › Disable creating crash reports to send (Apport)

  • Remove `apport` package Opt-in only
  • Disable Apport service Recommended
  • Disable participation in Apport error messaging system Recommended

Disable Ubuntu telemetry › Disable Ubuntu error tracker › Disable uploading errors (Whoopsie)

  • Remove `whoopsie` package Opt-in only
  • Disable Whoopsie service Recommended
  • Disable crash report submissions Recommended

Configure programs

  • Disable Python history for future interactive commands Opt-in only
  • Disable .NET telemetry Recommended
  • Disable PowerShell Core telemetry Opt-in only

Disable Visual Studio Code data collection

  • Disable Visual Studio Code telemetry Recommended
  • Disable online experiments by Microsoft in Visual Studio Code Recommended
  • Disable Visual Studio Code automatic updates in favor of manual updates Opt-in only
  • Disable fetching release notes from Microsoft servers after an update Opt-in only
  • Disable automatic fetching of remote repositories in Visual Studio Code Opt-in only
  • Disable fetching package information from NPM and Bower in Visual Studio Code Opt-in only
  • Disable sending search queries to Microsoft in Visual Studio Code Strict
  • Disable Visual Studio Code automatic type acquisition in TypeScript Opt-in only
  • Disable Visual Studio Code Edit Sessions Opt-in only

Disable Visual Studio Code data collection › Configure auto-update settings for Visual Studio Code extensions

  • Disable automatic Visual Studio Code extension updates Opt-in only
  • Disable Visual Studio Code automatic extension update checks Opt-in only
  • Disable automatic fetching of Microsoft recommendations in Visual Studio Code Opt-in only

Disable Visual Studio Code data collection › Disable data sharing for Visual Studio Code "Settings Sync"

  • Disable synchronization of Visual Studio Code keybindings Opt-in only
  • Disable synchronization of Visual Studio Code extensions Opt-in only
  • Disable synchronization of Visual Studio Code settings Opt-in only

Configure Firefox

  • Disable connection tests (breaks automatic Wi-Fi login) Opt-in only

Configure Firefox › Harden Firefox privacy

  • Enable Firefox tracking protection Recommended
  • Enable Firefox anti-fingerprinting (may break some websites) Strict
  • Disable WebRTC exposure of your private IP address in Firefox Recommended

Configure Firefox › Harden Firefox privacy › Enable Firefox state partitioning (Total Cookie Protection)

  • Enable dynamic First-Party Isolation (dFPI) Recommended
  • Enable Firefox network partitioning Recommended
  • Disable outdated Firefox First-Party Isolation (FPI) Strict

Configure Firefox › Disable Firefox telemetry

  • Disable collection of technical and interaction data in Firefox Recommended
  • Disable detailed telemetry collection in Firefox Recommended
  • Disable archiving of Firefox telemetry Recommended
  • Clear Firefox telemetry user ID Recommended

Configure Firefox › Disable Firefox telemetry › Disable Firefox telemetry logs

  • Minimize Firefox telemetry logging verbosity Recommended
  • Disable Firefox telemetry log output Recommended

Configure Firefox › Disable Firefox telemetry › Disable Firefox telemetry pings

  • Disable pings to Firefox telemetry server Recommended
  • Disable Firefox shutdown ping Recommended
  • Disable Firefox new profile ping Recommended
  • Disable Firefox update ping Recommended
  • Disable Firefox prio ping Recommended

Configure Firefox › Disable Firefox Phishing Protection (Safe Browsing) (decreases security)

  • Disable blocking of unstable plugins in Firefox Opt-in only
  • Disable Firefox application reputation checks for downloads Opt-in only
  • Disable Firefox malware protection Opt-in only
  • Disable Firefox phishing protection Opt-in only

Security improvements

Improve network privacy

  • Enable IPv6 privacy extensions Recommended

Harden the kernel

  • Disable unprivileged access to kernel logs Recommended
  • Disable exposure of kernel memory addresses Recommended
  • Disable process debugging by unrelated processes Strict
  • Disable unprivileged eBPF access Strict