Basic hardening.
WHAT TO DO FIRST
Keep the system updated.
WHY FIRST
Most compromises exploit known vulnerabilities with published fixes.
WHAT TO DO ABOUT SSH
Use keys, disable password authentication Disable direct root login Restrict source addresses where possible Consider a non-standard port, understanding it is obscurity rather than security
WHAT TO DO ABOUT SERVICES
Run only what is needed Bind to the loopback address anything that need not be public
WHY THAT SECOND POINT MATTERS
Databases exposed to the internet are attacked continuously.
WHAT TO CHECK
What is listening, and on which address.
WHAT TO CONFIGURE
A firewall denying inbound by default Brute-force protection Automatic security updates, where appropriate
WHAT TO AUDIT
User accounts and their shells Authorised keys Scheduled tasks sudo permissions
WHY SCHEDULED TASKS
They are a common persistence mechanism after a compromise.
WHAT TO MONITOR
Failed authentication attempts Changes to key files Unexpected listening ports
WHAT TO NEVER RELY ON
A single control.
WHAT TO DOCUMENT
What you changed, so it survives you.
