Secure Linux laptops, installed and hardened on Lenovo ThinkPad
We install and harden Linux on Lenovo ThinkPad laptops and workstations: full-disk encryption, Secure Boot, locked-down firmware, hardware security keys, and encrypted backups. You get a machine that is ready for daily work and built to keep your data private if it is lost, stolen, or attacked.
A laptop is the most exposed computer you own
Servers sit in locked data centers behind firewalls. Your laptop travels in a bag, connects to hotel Wi-Fi, gets left in meeting rooms, and holds your client files, your credentials, and access to everything else.
A hardened Linux workstation deals with that reality on three levels: what happens if the device is lost or stolen, what happens if it is attacked over the network, and what happens if malicious software gets onto it.
Who this is for
- Lawyers, consultants, and accountants who carry confidential client data
- Journalists, researchers, and NGOs who need to protect sources and unpublished work
- Developers and system administrators whose laptop holds the keys to production systems
- Founders and executives with access to finances, contracts, and strategy
- Anyone who wants a private, fast, long-lived computer without bundled telemetry
Why Lenovo ThinkPad
We standardize on ThinkPad because the hardware cooperates with security work instead of fighting it:
- Certified Linux support on many models, with drivers that work out of the box
- Firmware updates from Linux through LVFS and
fwupd- no Windows partition needed to patch the BIOS - TPM 2.0, Secure Boot, and granular BIOS controls including supervisor passwords and port lockdown
- Repairable hardware with replaceable drives and batteries, so a machine stays useful for many years
We set up machines for clients in France, Switzerland, and Germany - new ones, and we also give older ThinkPads a second life with a fresh drive and a clean, hardened installation.
How the setup works
- Threat conversation. Who or what are you protecting against - theft, opportunistic malware, a targeted attacker? The answer shapes every choice that follows.
- Hardware check. Model, firmware version, drive health, and compatibility. We advise on a purchase if you do not have a machine yet.
- Installation and hardening. Encrypted install, firmware lockdown, system hardening, authentication, and backups.
- Migration. Your documents, mail, passwords, and browser data are moved over from the old system.
- Handover. We walk you through daily use, updates, backup, and what to do if the laptop is lost. You get written documentation of the setup.
Honest limits
Hardening raises the cost of an attack; it does not make a device invulnerable. A hardened laptop will not protect you if you approve a phishing prompt or install untrusted software with administrator rights. That is why handover includes a practical session on working habits, and why this service fits naturally with broader IT security consulting and a properly secured office network.
What a Hardened Setup Includes
Full-Disk Encryption
Everything on the drive is encrypted with LUKS2. A lost or stolen laptop is a hardware loss, not a data breach.
- Encrypted system, home, and swap
- Unlock with passphrase, TPM, or hardware key
- Recovery key stored safely off the device
Firmware & Boot Security
Encryption does little if someone can boot the machine from a USB stick or tamper with the bootloader. We lock the chain from power-on to login.
- Secure Boot enabled and verified
- Supervisor password and locked boot order
- Firmware updates through LVFS and fwupd
System Hardening
A default installation is built for convenience. We reduce the attack surface without making the machine painful to use.
- Firewall with default-deny inbound rules
- Mandatory access control and sandboxed applications
- Automatic security updates and minimal installed services
Strong Authentication
Passwords alone are not enough for the accounts that matter. We set up hardware-backed sign-in for the device and your online services.
- Hardware security keys for login, sudo, and SSH
- Password manager configured and populated
- MFA on email, cloud, and banking accounts
Encrypted Backups
Strong encryption makes backups essential - lose the key or the drive and the data is gone for good. Backups are part of every setup.
- Automatic, encrypted, versioned backups
- Local and off-site copies
- A restore test before handover
Privacy & Secure Connectivity
Network-level protection for working from hotels, trains, and client offices.
- VPN to your office or your own server
- Encrypted DNS and tracker blocking
- Hardened browser profiles for work and private use
Secure Linux on Lenovo: common questions
Why install Linux on a Lenovo ThinkPad?
ThinkPads have some of the best Linux hardware support of any laptop line. Lenovo certifies many models for Ubuntu and Fedora and publishes firmware updates through the Linux Vendor Firmware Service, so the BIOS and device firmware can be patched from Linux itself. They are also robust, repairable, and easy to find new or refurbished.
Which Linux distribution do you install?
It depends on who will use the machine. For most professionals we install Ubuntu LTS, Debian, or Fedora, because they combine timely security updates with long-term stability. On servers and older machines we also work with CentOS and its successors, and we still maintain legacy Unix systems.
Is Linux really more secure than Windows or macOS?
No operating system is secure by default in every situation. What Linux offers is full control: no bundled telemetry, a small and auditable set of installed software, strong built-in encryption, and fast security updates. A carefully hardened Linux workstation has a noticeably smaller attack surface than a typical default installation of any system.
Can I still use my usual applications?
Most everyday work runs natively: web, email, office documents, video calls, password managers, development tools. Before installation we go through the software you rely on and identify anything that needs a web version, an alternative, or an isolated Windows virtual machine.
What happens if I forget my encryption passphrase?
Without the passphrase or the recovery key, the data cannot be recovered - by you, by us, or by anyone else. That is the point of encryption. This is why every setup includes a recovery key stored separately and a tested backup.
Can you secure a laptop I already own?
Yes. We can reinstall and harden an existing ThinkPad, including older models, after backing up your data. We check the hardware first - drive health, battery, firmware version - and tell you if the machine is worth the effort.
Do you set up several laptops for a team?
Yes. For teams we build a documented, repeatable configuration so every machine is set up identically, and new laptops can be provisioned the same way later.
Need a laptop you can trust with sensitive work?
Tell us what you do, what you need to protect, and which machine you have or want. We will propose a setup that matches your actual risk - not more, not less.