Enable, Configure & Secure Linux on a Chromebook

This guide walks you through turning on Linux (Crostini) on your Chromebook, adjusting its settings, and locking it down with basic security practices. You’ll end up with a working terminal and a container you can install apps in, without leaving your ChromeOS comfort zone.

What You’ll Need

A Chromebook that supports Linux (most models from 2019 onward; check Settings > About ChromeOS > “Linux development environment”).
At least 2 GB of free storage (more if you plan to install large apps).
An internet connection for the initial download.
About 15 minutes of time.

Step-by-Step

Enable Linux – Open Settings (gear icon) > Advanced > Developers > “Linux development environment”. Click “Turn on”. Follow the setup wizard; it will download the Linux container and open a terminal window when done.
Update the system – In the terminal, run sudo apt update then sudo apt upgrade -y. This ensures you have the latest security patches and package lists.
Set a strong user password – The default user is your Google account name, but you can change the password with passwd. Choose something unique and not reused elsewhere.
Configure firewall – Install a simple firewall: sudo apt install ufw. Then enable it with sudo ufw enable. By default, UFW blocks incoming connections, which is a good baseline. You can allow specific ports later if needed (e.g., sudo ufw allow 22 for SSH).
Enable automatic security updates – ChromeOS updates the Linux container automatically, but you can also set up unattended-upgrades: sudo apt install unattended-upgrades and then edit /etc/apt/apt.conf.d/20auto-upgrades to ensure both “Update-Package-Lists” and “Unattended-Upgrade” are set to “1”.
Harden SSH (if you use it) – If you need remote access, install openssh-server (sudo apt install openssh-server) and edit /etc/ssh/sshd_config to disable password authentication (PasswordAuthentication no) and use key-based login instead. Restart the service with sudo systemctl restart ssh.
Limit sudo access – The default user has full sudo rights. If you want to reduce risk, create a limited user: sudo adduser limited and add them to the sudo group only if needed. Use the limited user for daily tasks.
Back up your container – Go to Settings > Advanced > Developers > “Linux development environment” and click “Back up” to save your container to a file. Do this regularly.
Keep an eye on storage – Linux uses a virtual disk that grows as you install things. You can check usage with df -h. If it gets too large, consider removing unused packages with sudo apt autoremove.

Common Mistakes

Forgetting to update after enabling – skipping apt update leaves you with outdated packages.
Disabling the firewall entirely because it blocks something – instead, allow specific ports.
Using the same password as your Google account – if the Linux container is compromised, that password could be reused.
Installing unnecessary services (like a web server) and leaving them running – only install what you need.
Not backing up before major changes – a simple mistake can wipe your container.

Tips

Use sudo apt list --upgradable to check for updates regularly.
Set a custom Linux username during setup if you prefer not to use your Google name.
If you don’t need the terminal often, you can shut down Linux from Settings > Advanced > Developers > “Linux development environment” > “Stop Linux”.
For extra security, consider using a VPN inside the container if you handle sensitive data.
Learn basic commands like ls, cd, and sudo to feel more comfortable.

Troubleshooting

Linux won’t enable – Make sure your Chromebook model supports it. Check the official list or try updating ChromeOS. If it still fails, powerwash (factory reset) and try again.
Terminal opens but commands are slow – This is normal on first run. Give it a few minutes. If it persists, check free memory with free -h.
Can’t install packages – Run sudo apt update again. If you get “Unable to locate package”, the package name may be wrong or the repository needs updating.
Firewall blocks something you need – Use sudo ufw status to see rules. To allow a port, run sudo ufw allow 8080 (replace with the port).
Container won’t start – Go to Settings > Advanced > Developers > “Linux development environment” and click “Stop Linux”, then try again. If that fails, restart the Chromebook.
Out of space – Delete unused files with sudo apt clean and sudo apt autoremove. You can also expand the disk in Settings > Advanced > Developers > “Linux development environment” > “Change disk size”.

Frequently Asked Questions

Is Linux on Chromebook the same as a regular Linux PC?

Mostly yes. You get a full Debian-based container with a terminal and the ability to install packages, but it runs inside ChromeOS, so hardware access is limited (e.g., USB devices need extra setup).

Can I run graphical Linux apps?

Yes, many GUI apps work. They appear in a separate window, and you can pin them to your shelf. Install them via sudo apt install (e.g., GIMP, LibreOffice).

Will enabling Linux slow down my Chromebook?

It uses some RAM and CPU, but only when the container is running. If you don’t use it, you can stop it from Settings to free resources.

How do I uninstall Linux?

Go to Settings > Advanced > Developers > “Linux development environment” and click “Remove”. This deletes all files in the container, so back up first.

Can I access my Google Drive from Linux?

Yes, you can mount Google Drive using the Files app and share it with Linux. In the Files app, right-click a folder and choose “Share with Linux”.

Is it safe to use sudo regularly?

It’s fine for system administration, but avoid running untrusted scripts with sudo. Always review what a script does before executing it.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →