Started off by

  1. Enabling unattended updates
  2. Enable only ssh login with key
  3. Create user with sudo privileges
  4. Disable root login
  5. Enable ufw with necessary ports
  6. Disable ping
  7. Change ssh default port 21 to something else.

Got the ideas from networkchuck

Did this on the proxmox host as well as all VMs.

Any suggestions?

  • theRealNilz02@alien.topBEnglish
    1·
    10 months ago

    Unattended updates are a recipe for trouble. I’d never enable that.

    I have no public services apart from 2 OpenVPN servers. To access everything else I connect to one of the OpenVPNs and use the services through the VPN routings.

    The VPN can only be accessed if you possess a cert and key. I could even implement 2fa but for now SSL auth works securely enough.

    • phein4242@alien.topBEnglish
      1·
      10 months ago

      I run unattended-upgrades on all the debian/ubuntu deployments I manage. One of the deployments even has automatic reboots enabled. I still do major upgrades by hand/terraform, but the process itself works flawless in my experience.