Linux server baseline

The baseline every Linux server should ship with.

Keep it patched automatically. Run a host firewall that denies by default.

Turn on audit logging so you have evidence after an incident. Ban the brute forcers automatically.

Boring, every one of them, and together they stop the large majority of real-world compromises.

# los comandos

root@srv:~# apt install unattended-upgrades -ycopiar

automatic security patches: ON

root@srv:~# ufw default deny incoming; ufw allow 22,443/tcp; ufw enablecopiar

firewall active, default-deny

root@srv:~# systemctl enable --now auditdcopiar

audit logging on

root@srv:~# apt install fail2ban -ycopiar

banning brute-force IPs automatically