Stock secureblue post-install. After Unwoke USB or rebase you still do most of this (their Secure Boot key, kargs, ujust audit-secureblue, USBGuard). Overlay extras: our Post-install. Canonical: secureblue.dev/post-install.
Post-install
Subscribe to secureblue release notifications
Subscribing to release notifications is documented here.
Enroll Secure Boot key
The secureblue Secure Boot key should automatically enroll after installation. If you have Secure Boot enabled in your BIOS, you will get a prompt during boot. In this prompt, select Enroll MOK and enter the password secureblue. If this fails or doesn't appear for whatever reason, you can manually enroll the key with the command below.
ujust enroll-secureblue-secure-boot-key
Kernel arguments
If you installed secureblue through the ISO installer, a stable set of kernel arguments is already preinstalled. Otherwise - for example if you rebased onto secureblue or securecore - you need to manually apply the kernel arguments to your system by running:
ujust set-kargs-hardening
In either case, it is recommended that you consult our <a href="secureblue/articles/kargs/">Kargs article</a> for additional information and guidance on tuning kernel arguments to your needs.
Validation
To validate your secureblue setup, run:
ujust audit-secureblue
On Unwoke SecureBlue — the stock snippet above is theirs. Use this as well or instead:
ujust audit-unwoke
ujust unwoke-statusStock audit still applies (their kernel, USBGuard, kargs). Also run the overlay check so trampoline / flavor / no leftover store are covered. Check health.
Read the FAQ
A lot of technical issues are covered in the FAQ. For new users, the following topics are particularly important to read:
- Why is Bluetooth disabled? How do I enable it?
- Why doesn’t my Xwayland app work?
- An app I use won’t start due to a malloc issue. How do I fix it?
- Why don’t my appimages work?
- How do I install my VPN?
- Why am I unable to start containers?
Flatpak Permissions Tuning
Consult our Flatpak article for guidance on tuning Flatpak permissions.
Disable booting from USB
Some manufacturers allow firmware changes from live systems.
To access your device's BIOS/UEFI screen to disable booting from USB, you can run:
ujust bios
Setup USBGuard
This will generate a policy based on your currently attached USB devices and block all others, then enable usbguard.
ujust setup-usbguard
Create a separate wheel account for admin purposes
Creating a dedicated wheel user and removing wheel from your primary user helps prevent certain privilege escalation attack vectors and password sniffing. You don't need to log in using your wheel user to use it for privileged operations. When logged in as your non-wheel user, Polkit will prompt you to authenticate as your wheel user as needed, or when requested by calling run0.
Running the command below will automatically setup an admin account and ask you to select a password for it.
ujust create-admin
On Unwoke SecureBlue — the stock snippet above is theirs. Use this as well or instead:
ujust set-admin-split add NAME
# or skip the first-boot prompt: ujust set-admin-split offUnwoke already asks for a daily (non-wheel) user before GDM/SDDM. Stock create-admin still exists if you skipped that. Wheel is blocked from the greeter. Daily user.
Configure system DNS
The command below will interactively set up system DNS resolution for Unbound, and optionally set the resolver for Trivalent via management policy. Choose Configure global DNS.
ujust dns-selector
If you intend to use a VPN, use the system default DNS. You may also have to use systemd‑resolved with <code>ujust dns-selector resolver resolved</code>. This will ensure your system uses the VPN provided resolver to prevent DNS leaks. Especially avoid setting the Trivalent DNS over HTTPS policy in this case.
Toggle MAC address randomization
Toggle system-wide MAC address randomization in NetworkManager between random and permanent using the command below. Disabling MAC randomization can help with network compatibility issues, especially in enterprise or captive portal environments. Enabling it improves privacy by preventing tracking across networks.
ujust toggle-mac-randomization
Bash environment lockdown
To mitigate LD_PRELOAD attacks, run the command below. Note that this is only effective against opportunistic malware and is a weak stopgap until we develop improved SELinux policies for the home directory.
ujust toggle-bash-environment-lockdown
LUKS Hardware-Unlock
There are two options available for hardware-based unlocking. You can either enroll FIDO2 or TPM2 for your LUKS volume. FIDO2 enrollment is preferable if you own a hardware security key. It\'s recommended that you choose only one of these, and not both at the same time.
LUKS FIDO2 Unlock
To enable FIDO2 LUKS unlocking with your FIDO2 security key, run:
ujust setup-luks-fido2-unlock
LUKS TPM2 Unlock
If you have an AMD CPU, check your firmware settings to make sure it is using a dedicated TPM device or a Pluton Chip. If not and it is using an fTPM (firmware TPM), skip this step. If you do not know what this means or are unsure, just skip this step.
To enable TPM2 LUKS unlocking, run:
ujust setup-luks-tpm-unlock
Type Y when asked if you want to set a PIN.
Trivalent Flags
The included Trivalent browser has some additional settings in chrome://flags you may want to set for additional hardening and convenience (can cause functionality issues in some cases).
On Unwoke SecureBlue — the stock snippet above is theirs. Use this as well or instead:
ujust set-trivalent-network-sandbox on # default on *-trivalent
ujust set-trivalent-referrers onOn *-trivalent, JIT-less / no WebGL / extension block / NSS may already be forced by overlay policy. Origin uses ujust set-brave-*. Do not Bubblejail Trivalent. Trivalent flavor.
You can read about these settings in the Trivalent post-install instructions.