Purpose
On October 9, 2026, cleaning up an accidental SELinux install turned into a full security check of two machines. The goal was to leave both safer than they started, and to get the travel laptop ready for my Spain trip.
The SELinux part is covered in its own post: From SELinux Back to AppArmor. This post covers what I found after that, and keeps a checklist of what’s left.
Debian desktop: no firewall at all
The desktop’s biggest gap was that nothing filtered incoming connections. Every listening service was reachable from both home networks, and from its public IPv6 addresses.
| Area | Before | After |
|---|---|---|
| SELinux | Installed, permissive, full relabel on boot | Removed; GRUB setting and relabel flag gone |
| AppArmor service | Disabled; 24 profiles loaded | Enabled at boot; 179 profiles, 67 enforcing |
| Firewall | None installed | ufw active: deny incoming, allow outgoing |
| Wazuh API (port 55000) | Open to the network | Blocked from other devices |
| SSH, Wazuh dashboard and agent ports | Open to every network | Allowed only from home Wi-Fi and Tailscale |
| Public IPv6 exposure | Services listening on [::] with no filter | Covered by the same ufw rules |
How it was tested: from the HP 15 laptop, nc reached ports 22 and 1514, and port 55000 timed out. The laptop’s Wazuh agent still showed Active.
Travel laptop (HP Pavilion x360): no security updates
The travel laptop had never received a Debian security update. Debian had been installed without a USB stick, inside Omarchy’s encrypted drive, and the security sources were never added.
| Area | Before | After |
|---|---|---|
| Disk encryption | LUKS2 (from the Omarchy install) | Unchanged, still encrypted |
| apt sources | Only trixie | Added trixie-security and trixie-updates |
| Updates | 72 behind | Fully updated, including OpenSSL, Firefox, Thunderbird |
| Running kernel | 6.12.94, hard-coded in the boot menu | 6.12.111, booted through fixed file names |
| Future kernels | Would never boot | A hook copies each new kernel to the fixed names |
| Default boot | Omarchy (out of date, no firewall) | Debian, via remember_last_entry |
| Firewall | None; SSH open to any Wi-Fi | ufw active: only Tailscale allowed in |
How it was tested: two reboots. The first picked the new entry and showed 6.12.111. The second was left alone and still booted Debian. From the desktop, SSH over Tailscale connected.
Reference: files and commands to remember
Backups made today
| Machine | File | Original it protects |
|---|---|---|
| Desktop | /etc/default/grub.bak | GRUB settings before removing security=selinux |
| x360 | /boot/limine.conf.bak-2026-10-09 | Boot menu as it was this morning |
| x360 | /boot/limine.conf.bak-2026-10-09-b | Boot menu with the first 6.12.111 entry |
| x360 | /etc/apt/sources.list.bak-2026-10-09 | apt sources before the fix (if Step 1 was run) |
x360 boot menu entries (Limine)
Debian 13 (current kernel)bootsvmlinuz-debian-currentandinitrd.img-debian-current. Use this every day.Debian 13 (fallback 6.12.94)boots the old kernel. Use it only if the current one fails.- The encryption password prompt is hidden behind boot text. When it stops at
device-mapper: ioctl..., type the password and press Enter.
x360 kernel hook: /etc/initramfs/post-update.d/zz-limine-debian. It runs every time an initrd is built and copies the newest kernel to the fixed names. To run it by hand: sudo /etc/initramfs/post-update.d/zz-limine-debian $(uname -r)
Quick health checks
- Firewall:
sudo ufw status verbose - AppArmor:
sudo aa-status | head -4 - Listening ports:
sudo ss -tlnp - Running kernel:
uname -r - Wazuh agents (desktop):
sudo /var/ossec/bin/agent_control -l
Warnings
- Don’t run
sudo apt autoremoveon the x360 yet. It would remove the 6.12.94 fallback kernel. - On the desktop, start Docker containers with
-p 127.0.0.1:PORT:PORT. Docker bypasses ufw for published ports.
Remaining before the Spain trip
- Create an SSH key on the x360 and add it to the desktop, then test logging in over Tailscale
- Check Microsoft Defender (
mdatp) on the x360: set up, connected and running? - Update the Tails USB stick and test-boot it on the x360 (F9 at power-on)
- Optionally install a Wazuh agent on the x360 so the desktop can watch it while traveling
- Check HP’s support site for a BIOS newer than F.54 (December 2019)
- After several good boots: remove the 6.12.94 kernel and its fallback menu entry
- Decide whether to keep or remove Omarchy from the x360
- Harden SSH on the desktop (key-only logins, no passwords)
- Free up disk space on the HP 15 laptop (about 6.6 GB free)
- Add today’s changes to the Setup Changelog post
Lessons learned
- “Installed” is not “protected.” The AppArmor module was loaded but its service was off. Security updates were available but the source was missing. Always check that the protection is actually running.
- Test from the outside. A machine connecting to its own address always succeeds. Real firewall tests come from a second device.
- Read errors before results.
Permission deniedfollowed by0meant “couldn’t look,” not “nothing found.” - Know which machine you’re on. Two laptops and a desktop look alike in a terminal. Check the prompt,
hostnamectland/etc/os-releasebefore running commands. - Fix the cause, not just the symptom. Pointing the boot menu at 6.12.111 would have broken again next update. The hook makes it permanent.
- AWS DVA-C02 link: ufw’s deny-by-default with specific allow rules works like an EC2 security group.
- Black Hat Python link: a dropped connection times out instead of being refused, which is why scanners report such ports as “filtered.”