Setting one up.
WHAT TO DO IN ORDER
Create the server Secure access immediately Apply all updates Install only what is needed Configure the firewall Configure the application Set up backups Set up monitoring
WHY SECURE ACCESS FIRST
A new server is scanned within minutes of existing.
WHAT THAT MEANS
Change default credentials, disable password authentication where possible, and use keys.
WHAT TO INSTALL
The minimum the application requires.
WHY
Every package is exposure and maintenance.
WHAT TO CONFIGURE
Automatic security updates, where appropriate A firewall allowing only what is needed Time synchronisation Log rotation
WHAT TO DOCUMENT
Every decision and every command.
WHAT TO PREFER
A script performing the setup, rather than manual commands.
WHY
So it can be repeated identically, and so the record is the script itself.
WHAT TO VERIFY
That only intended ports are reachable, from outside.
WHAT TO TEST
Rebuilding from nothing.
