Ttgjyuk

I am surprised to find so little information about what I would consider a serious breach of privacy and security.

It appears ubuntu-report is sending very unique information about your system - like a fingerprint, if not stopped with shell commands. See here: https://www.howtogeek.com/349844/how-to-stop-ubuntu-from-collecting-data-about-your-pc/

update: answer below argues that permission is asked before actually sending this information.

But now, I also frown upon a fresh minimal Ubuntu image connecting to the internet upon login. When logging in to the console, a Message of the Day (MOTD) is displayed. Something like this:

ubuntu login: ubuntu
Password:
Last login: <date>
Welcome to Ubuntu 18.04.1 LTS (...)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

 System information as of <date>

 System load: 0.08 (..)
 Usage of /: 4.9% (..)

 Get cloud support with Ubuntu Advantage Cloud Guest:
 http://www.ubuntu.com/business/services/cloud

0 packages can be updated.
0 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. 
Check your Internet connection or proxy settings

Perhaps I am being paranoid, but I think it is unacceptable that a mere login would send anything to the internet. If you do a connection to 'changelogs.ubuntu.com' every time you login on the shell, that can lead to potential security and privacy concerns. Am I the only one who is surprised about this and finds this unacceptable?

My question is: how can I safely use Ubuntu without compromising security or privacy?

In particular, my concern is with sending anything to the internet without permission. I don't want things to automatically connect or check or update to the internet in any way, unless I give the command to do that, with sudo apt update for example.

I tried playing with /etc/update-motd.d scripts but I could not find the script that was the culprit. I am kind of annoyed that I wasted a good hour on this stuff and still don't trust my Ubuntu system with ethernet/internet until this issue is resolved properly.

Ok this question contains contains some inaccurate information.

• The package Ubuntu Report does not get installed if users uncheck the option during installation.


• Even after giving permission during installation, it again asks for permission before sending any data and let users see the data to be sent and provide with permanent deny option.


• The data it collects is general hardware and OS configuration related data which helps the development of Ubuntu. It does not collect any sensitive data (like IP address or real location). See it's GitHub page for an example.


• The data is completely anonymized (can't be used to identify a single machine) and one time only. It does not send data on every login.

If you do a connection to 'changelogs.ubuntu.com' every time you login on the shell, that can lead to potential security and privacy concerns. Am I the only one who is surprised about this and finds this unacceptable?

I don't know about Ubuntu Server, but I'm pretty sure you can stop checking for updates at shell login. Don't know about the second question, it's just an update check!

I don't want things to automatically connect or check or update to the internet in any way

Not an option on 21st century PC ecosystem. If you want something like that, better use a default-deny firewall or something like that.

Every ubuntu desktop installation I have done I noticed it sending data to IPs owned by Canonical by default. This traffic seems to be rather constant. I could swear during the installation I specifically tell it not to send any data back to canonical.

I am about to wipe the Ubuntu install (16.04->18.04) to track an issue not related to this one. for the sake of this thread I will document all the options I selected and then will look at the network traffic.