Essential Linux Tools After a Fresh Install: 5 Distros Compared

TL;DR: A fresh install is the most dangerous moment in a Linux box's life — everything is default, and defaults are lazy. This is the tooling pass we run on every new Ubuntu, Linux Mint, Debian, Arch, and Fedora machine in the lab: system monitoring (htop/btop, fastfetch), terminal productivity (tmux, ripgrep, fzf, bat), build tools, a firewall (ufw), snapshots (Timeshift), and desktop polish. Every package and command below was checked against the official repositories of all five distros — with availability notes where a package is missing — plus the gotchas that wasted our first hour.

The installer's progress bar hit 100% at 23:47. By 23:52 I was staring at a terminal with no htop, no tmux, no git — and, worse, a firewall that wasn't running at all. Fresh installs are the most dangerous moment in a Linux box's life: every service is default, every port is open, and the machine is one careless curl | sh away from becoming someone else's lab.

This is the tooling pass we run on every fresh box that lands in our lab — Ubuntu, Linux Mint, Debian, Arch, and Fedora. Same five goals every time: see what the machine is doing, work faster in the terminal, be able to build things, close the front door, and be able to roll back when you break something. Nothing exotic — just the difference between a lab and a liability. Every package name and command below was checked against the official repositories of all five distros before publishing. No invented packages, no "trust me" PPAs.

Why a Fresh Install Needs a Tooling Pass

Default installs are minimal by design — and that's the point. Ubuntu ships without htop, Mint without tmux, Debian without git, Arch with no firewall at all, and Fedora with a firewall that's configured but often forgotten. The first hour after install decides how painful the next two years will be: install the right tools now, and every later task (recon, debugging, backup, recovery) is a command away. Skip them, and you'll be apt install-ing your way through every single task, one missing package at a time.

Three package managers cover all five distros:

Learn the one that applies to you and the other two become pattern-matching. The tools themselves are the same everywhere — only the package names differ slightly (looking at you, openssh vs openssh-server).

The Core Toolkit, Category by Category

System Monitoring: htop, btop, and the Fastfetch Generation

You can't fix what you can't see. htop is the classic process monitor — interactive and colorful, and it ships on every distro. btop is its modern replacement: CPU/memory/disk/network graphs in one screen, mouse support, and a much prettier default. We install both — htop for muscle memory, btop for when we actually need to see what's happening.

For system info at a glance, neofetch was the community standard for years — but its upstream repo was archived in 2024, and Arch has since dropped it from the official repos. Its maintained successor is fastfetch, which is faster and still actively developed — and it's available on every distro here. Install fastfetch; treat neofetch as legacy.

Two disk tools complete the set: duf (a pretty df replacement for mounted filesystems) and ncdu (an interactive disk-usage explorer that finds the 40 GB of logs you forgot about).

Terminal Productivity: tmux, ripgrep, fzf, bat

These four change how you live in the terminal:

• tmux — terminal multiplexer. Your SSH session survives disconnects, your lab runs in detached panes, and you can split a screen into a monitor + a shell + a log tail. Non-negotiable for remote work.
• ripgrep (rg) — the grep replacement that respects .gitignore and searches a codebase in milliseconds. rg -i "apikey" . is our first move on any unfamiliar box.
• fzf — fuzzy finder. Pipe anything into it (history | fzf, find | fzf) and pick with a few keystrokes. Ctrl-R history search becomes genuinely usable.
• bat — cat with syntax highlighting, line numbers, and git diff awareness. Once you've seen a config file in color, you never go back.

The Non-Negotiables: git, curl, wget, vim, nano

No debate on this row: git for version-controlling your configs (dotfiles are a reinstall survival kit), curl and wget for transfers and API pokes, and both vim and nano — vim for when you need power, nano for when you need to edit a file at 3 AM without thinking. Yes, both. They weigh nothing.

Build Tools: build-essential vs base-devel vs @c-development

The same idea, three names. Every distro has a meta-package that pulls in the compiler toolchain (gcc, make, headers, and friends) so you can build software from source — which you will need, the moment a tool you want isn't packaged:

On Arch, base-devel is a meta-package in the core repo — and it conveniently depends on sudo, which is why the Arch install guide tells you to grab it early. On Fedora, the group ID is lowercase c-development; dnf5 matches group IDs, not display names, and the "Development Tools" lore from older tutorials no longer resolves (more on that in Gotchas).

Firewall & SSH: ufw, fail2ban, openssh-server

Here's where "fresh install" gets scary. Arch installs with no firewall at all. Ubuntu and Mint ship ufw but leave it disabled; Debian doesn't ship it — you install it (sudo apt install ufw). Fedora ships firewalld enabled by default — the one exception — but ufw is still available there if you prefer its simpler model.

Our rule: enable a firewall before you install anything that listens. ufw is the same package on all five distros. Pair it with openssh-server (called openssh on Arch) if the box needs remote access, and fail2ban if that SSH port will ever face anything but your own LAN.

⚠ Supply-chain rule we never break: install from the official distro repositories only. Third-party PPAs, random curl | sh scripts, and AUR packages are how fresh boxes become botnet nodes. If a tool isn't in your distro's repos, check the project's official site for a maintained repository — and verify the signing key — before adding anything.

System Snapshots: Timeshift

Timeshift is Linux Mint's flagship backup tool, and it works on every distro here. It takes filesystem snapshots (rsync+hardlinks on ext4, or BTRFS snapshots) that let you roll the whole system back to a known-good state after a bad update, a broken driver, or a config edit gone wrong. On Mint it's preinstalled since version 19; on the others it's one install command away. Take the first snapshot before you change anything else — that's your "undo" button for the entire tooling pass.

Desktop Polish: gnome-tweaks, flatpak, firefox

On GNOME-based installs (Ubuntu, Debian, Fedora Workstation, and Arch with GNOME), gnome-tweaks unlocks the settings the default UI hides — fonts, window buttons, extensions. flatpak gives you sandboxed, distro-agnostic apps from Flathub, which is how we run GUI tools without polluting the base system. And firefox is the browser — with two distro-specific twists you need to know (see Gotchas: Ubuntu ships it as a snap wrapper, Debian ships firefox-esr).

Install Command Comparison: apt, pacman, dnf

Here's the full picture across all five distros. Every name below was verified against the official package pages (packages.ubuntu.com, packages.debian.org, archlinux.org/packages, packages.fedoraproject.org):

Read the table once, then run the one-liner for your distro below. That's the whole tooling pass, compressed into a single transaction.

The First-Boot Checklist, Step by Step

1. Update Before You Install Anything

Never install tools against a stale package index — you'll pull old versions and, on Arch, risk partial-upgrade breakage. Update first, on every family:

sudo apt update && sudo apt upgrade -y

sudo pacman -Syu

sudo dnf upgrade --refresh

On Fedora, use upgrade — update is a deprecated alias, and dnf5 has been nudging everyone toward the canonical form since Fedora 41. --refresh forces dnf to re-download repo metadata instead of trusting the cache.

2. Install the Core Toolkit

One command per family. This is the full list from the table above — monitoring, terminal, build tools, firewall, snapshots, desktop:

sudo apt install -y htop btop tmux git curl wget vim nano \
  build-essential ufw timeshift gnome-tweaks fastfetch \
  ripgrep fzf bat ncdu duf fail2ban openssh-server flatpak
# Ubuntu 22.04/24.04 LTS, Mint or Debian bookworm: remove 'fastfetch' or apt aborts the whole install

sudo pacman -S --needed htop btop tmux git curl wget vim nano \
  base-devel ufw timeshift gnome-tweaks fastfetch \
  ripgrep fzf bat ncdu duf fail2ban openssh flatpak firefox

sudo dnf install htop btop tmux git curl wget vim nano \
  @c-development ufw timeshift gnome-tweaks fastfetch \
  ripgrep fzf bat ncdu duf fail2ban openssh-server flatpak firefox

Notes: --needed on pacman skips packages you already have (idempotent re-runs). On Ubuntu 22.04/24.04 LTS or Mint, drop fastfetch — it only landed in Ubuntu 24.10+; use the PPA or the official GitHub .deb if you need it. On Debian, drop fastfetch if you're on bookworm — it landed in trixie (see Gotchas). And on Mint, timeshift is already there; apt will just say it's up to date. firefox isn't in these commands on purpose — Ubuntu's is a snap wrapper, Mint ships its own .deb, and Debian's is firefox-esr (see Gotchas).

3. Close the Front Door: Enable the Firewall

Before you install SSH, before you open a single port — enable ufw. The default policy is deny-incoming, allow-outgoing, which is exactly what a fresh box needs:

sudo ufw enable
sudo ufw allow OpenSSH
sudo ufw status verbose

allow OpenSSH uses the service name ufw already knows (port 22) — if your sshd runs on a custom port, use sudo ufw allow 8022/tcp instead. On Fedora, if you prefer firewalld, skip ufw and use sudo firewall-cmd --add-service=ssh --permanent. Either way: something must be filtering inbound traffic before this box talks to a network.

4. Take the First Snapshot

Now the undo button. Timeshift's CLI is as simple as its GUI:

sudo timeshift --create --comments "fresh-install-tooling" --tags O

--tags O marks it as an on-demand snapshot — the kind Timeshift keeps until you delete it. (The D tag is the trap: daily snapshots join the rotation and get pruned once you pass your daily retention count, so a tagged-D "keeper" quietly vanishes.) On BTRFS systems Timeshift uses native snapshots; on ext4 it uses rsync+hardlinks. Either way, this snapshot is your escape hatch for everything you do next.

5. Verify the Install

Five minutes of verification now saves an hour of "why is this missing" later. Each family has its own query command:

dpkg -l htop tmux git ufw timeshift
# "ii" in the first column = installed and configured

pacman -Q htop tmux git ufw timeshift

rpm -q htop tmux git ufw timeshift

dpkg -l prints a status column (ii = installed and configured), pacman -Q prints installed versions, and rpm -q prints the full NVR. Any package that comes back "not installed" is a typo in your install command — fix it now, not in three weeks.

Gotchas & Rabbit Holes

1. neofetch Is Dead Upstream — Arch Dropped It

We installed neofetch on a fresh Arch box out of habit and got error: target not found: neofetch. The upstream repo was archived in 2024, and Arch removed the package from the official repos — the search now returns only fastfetch and friends. On Arch, fastfetch is the answer. If you really want neofetch, it survives in the AUR — but read the warning below before you build anything from there.

⚠ AUR packages are community-built and not reviewed by Arch maintainers. Building from the AUR means running makepkg on a PKGBUILD you should read first — treat it like running any third-party script. For a system-info tool, fastfetch from the official extra repo does the job without the supply-chain risk.

2. Ubuntu's "firefox" Is a Snap Wrapper

On Ubuntu, apt install firefox installs a transitional package (version 1:1snap1-0ubuntu5 in noble) that pulls in the Firefox snap. The apt package is a wrapper — the real browser is a snap, and you manage it with snap, not apt. It works fine for most people; if you want a classic .deb, Mozilla maintains an official APT repository — but that's a third-party repo, so verify the signing key before adding it. Mint, by contrast, ships Firefox as a real .deb from its own repos.

3. Debian Ships firefox-esr, Not firefox

On Debian the package is firefox-esr — the Extended Support Release. The source package is named firefox, but the only installable binary is firefox-esr; there's no firefox package to install (unlike Ubuntu's snap wrapper). So: sudo apt install firefox-esr. Same browser, slower release cadence, longer support window.

4. Debian Doesn't Give You sudo by Default

This one bit us on a minimal Debian install: no sudo, and your user isn't in the sudo group. Bootstrap it from the root shell:

su -
apt update && apt install -y sudo
usermod -aG sudo your-username
exit
# log out and back in for the group change to apply

Ubuntu and Mint preconfigure sudo during install; Fedora adds your first user to the wheel group automatically. Arch is the other special case: base-devel pulls in sudo, but you must uncomment the %wheel ALL=(ALL:ALL) ALL line in visudo and add your user to wheel before sudo actually works.

5. dnf5 Group Names Are Case-Sensitive

Every Fedora tutorial written before 2024 says sudo dnf group install "Development Tools". On dnf5 (Fedora 41+), that fails with No match for argument: Development Tools — display names no longer resolve, dnf5 matches lowercase group IDs. For the compiler toolchain use sudo dnf install @c-development (C Development Tools and Libraries, which is what this article's one-liner pulls in); add @development-tools only if you also want the general helper set (gettext, git, patch, subversion). Both verified working on Fedora 41/42-era systems.

6. Fedora's wget Is a Shim

Since Fedora 40, dnf install wget installs a shim package (the wget2-wget shim in F40; wget1-wget re-added in F41) that provides the wget command — the classic wget package was split as wget2 became the default. The command works exactly as you expect; just don't be confused when rpm -q wget answers package wget is not installed — the shims are named wget1-wget/wget2-wget. Query by file instead: rpm -qf /usr/bin/wget shows you which shim owns the binary.

7. fastfetch Isn't in Debian bookworm

Debian 12 (bookworm) predates fastfetch's packaging — it landed in trixie, and it's not in bookworm-backports either. On bookworm, either skip it (neofetch is still packaged there) or grab the official GitHub .deb. Don't add random PPAs for a system-info tool; it's not worth the supply-chain risk.

The short version

• Same five goals on every distro — monitoring (htop/btop), terminal speed (tmux, ripgrep, fzf, bat), build tools, a firewall, and snapshots. The package names differ slightly; the job is identical.
• Update before you install — apt update && apt upgrade, pacman -Syu, or dnf upgrade --refresh first, every time. Stale indexes are how fresh boxes get old, vulnerable packages.
• Enable the firewall before anything listens — Arch ships none, Ubuntu and Mint ship ufw disabled, Debian needs a manual install, Fedora ships firewalld. sudo ufw enable is the cheapest security control on this entire page.
• Snapshot before you break things — Timeshift's first snapshot is your undo button for the whole tooling pass. Take it before installing anything else.

The keeper

The tools that matter after a fresh install are the ones that survive the next reinstall. Version-controlled dotfiles, a snapshot you can roll back to, and a firewall that's actually enabled — those are the three things that turn a fresh install from a liability into a lab. The rest is just apt, pacman, and dnf spelling the same word in three dialects.

Go deeper

• DNS & Nameserver Resolution on Linux: A Complete Guide — the first networking task you'll hit on that fresh box, explained end to end
• Netcat (nc) Command Examples on Linux — the swiss-army tool to add to your fresh toolkit when the lab work starts
• Podman on Linux & Termux: Full Tutorial — once the base system is tooled up, containers are the next layer

Last verified: August 17, 2026 — all package names checked against packages.ubuntu.com, packages.debian.org, archlinux.org/packages, and packages.fedoraproject.org.