10 Things to Do After Installing Linux

A fresh Linux install is a blank slate. The default configuration gets you running, but a handful of targeted steps will make the system stable, secure, and genuinely pleasant to use. Work through these ten tasks in order — most take under five minutes each.

1. Apply All Pending Updates

Repositories often ship newer packages than the installer ISO contained. Sync and upgrade before doing anything else.

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade -y

Fedora / RHEL / Rocky

sudo dnf upgrade --refresh -y

Arch

sudo pacman -Syu

Reboot afterward if the kernel or firmware was updated. On systemd systems you can check whether a reboot is needed:

[ -f /run/reboot-required ] && echo "Reboot required" || echo "No reboot needed"

2. Install Proprietary Drivers

Open-source drivers cover most hardware well, but NVIDIA GPUs and some Wi-Fi adapters need proprietary firmware for full performance.

Debian / Ubuntu — automatic detection

sudo ubuntu-drivers install

On Debian without ubuntu-drivers, enable non-free firmware and install via apt:

sudo apt install firmware-linux nvidia-driver

Fedora — RPM Fusion required

sudo dnf install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
  https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
sudo dnf install akmod-nvidia

Arch

sudo pacman -S nvidia nvidia-utils

After installing NVIDIA drivers, reboot and verify the GPU is active:

nvidia-smi

Output will list driver version and GPU name. On Wayland, also confirm GBM_BACKEND=nvidia-drm is set if you see a blank screen after login.

3. Enable the Firewall

Ubuntu ships with ufw; Fedora and RHEL use firewalld. Both sit on top of nftables on modern kernels. Enable and verify.

Ubuntu / Debian (ufw)

sudo ufw enable
sudo ufw status verbose

Fedora / RHEL / Rocky (firewalld)

sudo systemctl enable --now firewalld
sudo firewall-cmd --state

Arch (choose one)

# ufw
sudo pacman -S ufw
sudo systemctl enable --now ufw
sudo ufw enable

The default policies — deny incoming, allow outgoing — are correct for a desktop. Only open ports you explicitly need.

4. Install Multimedia Codecs

Patent-encumbered codecs (H.264, AAC, MP3) are excluded from many default installs. Add them so your browser and media player work out of the box.

Ubuntu

sudo apt install ubuntu-restricted-extras

Debian

sudo apt install libavcodec-extra ffmpeg

Fedora

sudo dnf install gstreamer1-plugins-{bad-\*,good-\*,base} gstreamer1-plugin-openh264 \
  gstreamer1-libav lame\* ffmpeg --exclude=gstreamer1-plugins-bad-free-devel

Arch

sudo pacman -S gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ffmpeg

5. Set Up Automatic Security Updates

Security patches should not wait for you to remember to run them. Configure unattended upgrades for the security pocket only — leave feature updates manual.

Debian / Ubuntu

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Fedora / RHEL / Rocky

sudo dnf install dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer

Arch

Arch does not ship a supported partial-update mechanism. Use a cron job or systemd timer to run pacman -Syu unattended, but be aware full upgrades can occasionally require manual intervention.

6. Configure a Backup Solution

Data loss on a system you have just configured is painful. Set up at least one backup before adding personal files.

Timeshift is the simplest choice for system snapshots using btrfs subvolumes or rsync.

# Debian/Ubuntu
sudo apt install timeshift

# Fedora
sudo dnf install timeshift

# Arch (AUR)
yay -S timeshift

Launch timeshift-gtk (or timeshift --wizard in a terminal) to pick snapshot type and schedule. For home-directory backups to a separate drive or remote location, Déjà Dup (GNOME Backups) integrates directly with the desktop:

sudo apt install deja-dup    # Debian/Ubuntu
sudo dnf install deja-dup    # Fedora

7. Install Essential Applications

The default app selection covers basics, but most users need a few extras. Install in one shot rather than one at a time.

A practical baseline set

# Debian/Ubuntu
sudo apt install vim curl wget git htop neofetch flatpak gnome-software-plugin-flatpak

# Fedora
sudo dnf install vim curl wget git htop neofetch flatpak

# Arch
sudo pacman -S vim curl wget git htop neofetch flatpak

Enable Flathub for the widest Flatpak app catalog:

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

8. Harden SSH (If You Use Remote Access)

If your machine is ever accessed remotely, disable password authentication and use key-based login instead. Generate a key pair on the client machine first:

ssh-keygen -t ed25519 -C "[email protected]"

Copy the public key to the server:

ssh-copy-id user@server_ip

Then on the server, edit /etc/ssh/sshd_config and set:

sudo sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Confirm you can still log in with your key before closing your current session.

9. Set Your Hostname and Timezone

A meaningful hostname makes logs readable; the correct timezone keeps scheduled jobs and log timestamps accurate.

sudo hostnamectl set-hostname my-workstation

# List available timezones
timedatectl list-timezones | grep America

# Set yours
sudo timedatectl set-timezone America/New_York

# Verify
timedatectl status

Sample output (will vary):

               Local time: Mon 2025-06-09 14:32:01 EDT
           Universal time: Mon 2025-06-09 18:32:01 UTC
                 RTC time: Mon 2025-06-09 18:32:01
                Time zone: America/New_York (EDT, -0400)

10. Review systemd Services and Disable Unnecessary Ones

Many packages install and enable background services automatically. Audit what is running and disable anything you do not need to reduce attack surface and shorten boot time.

# List all enabled services
systemctl list-unit-files --state=enabled --type=service

# Check boot time breakdown
systemd-analyze blame

Common candidates for disabling on a desktop that has no local print jobs, no Bluetooth, or no NFS mounts:

sudo systemctl disable --now cups bluetooth avahi-daemon

Re-enable any service you need later with sudo systemctl enable --now <service>. Never disable services blindly — read what each one does first.

Verification Pass

Run this quick checklist to confirm everything took effect after a final reboot:

• sudo apt list --upgradable (or dnf check-update) returns nothing.
• nvidia-smi or lspci -k | grep -A2 VGA shows your GPU and its driver.
• sudo ufw status or sudo firewall-cmd --state shows active / running.
• A test video in Firefox or mpv plays without errors.
• timedatectl status shows the correct timezone and NTP service: active.

Troubleshooting

NVIDIA — black screen after driver install on Wayland

Add nvidia_drm.modeset=1 to your kernel command line in /etc/default/grub, then run sudo update-grub (Debian/Ubuntu) or sudo grub2-mkconfig -o /boot/grub2/grub.cfg (Fedora). This is required for the NVIDIA GBM backend used by modern compositors.

ufw blocks a service you just installed

Use named profiles where available: sudo ufw allow 'Nginx Full'. For arbitrary ports: sudo ufw allow 8080/tcp. Always be as specific as possible — prefer port + protocol over opening a wide range.

dnf-automatic timer not firing

Check systemctl status dnf-automatic.timer and confirm apply_updates = yes is set in /etc/dnf/automatic.conf if you want it to actually install (not just download) updates.