A repeatable baseline to apply to every new box before it does real work. Think of it as the minimum bar.
The checklist
| Area | Action |
|---|---|
| Updates | unattended-upgrades for security patches |
| Users | No shared accounts; sudo per-user; strong policy |
| SSH | Keys only — see SSH Hardening |
| Firewall | Default-deny inbound — see Firewall with ufw and nftables |
| Services | Disable what you don't run |
| Time | systemd-timesyncd / chrony (logs need accurate time) |
| Logging | Centralize / monitor — see Intrusion Detection with a Network Scanner |
| Backups | Encrypted & tested — see Encrypted Backups with restic |
Quick wins
sudo apt install unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades
systemctl list-unit-files --type=service --state=enabled # audit running services
ss -tlnp # what's listening? close what shouldn't beReduce the attack surface
# disable a service you don't need
sudo systemctl disable --now avahi-daemonPrinciple: least privilege + least surface. A service that isn't running can't be exploited. App-layer hardening: Apache Web Server Hardening Guide, Securing a Public PHP App.