Server Hardening and Baselines

Baseline checklist

• Use SSH keys instead of passwords.
• Disable password authentication and root login where possible.
• Enable automatic security updates.
• Configure a host-based firewall.

Example steps on Ubuntu

# Update packages
sudo apt update && sudo apt upgrade -y

# Install fail2ban and ufw
sudo apt install -y fail2ban ufw

# Allow SSH and HTTP/HTTPS
sudo ufw allow OpenSSH
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

Centralized logging and monitoring

Ship logs to a centralized logging solution and use metrics collection to track CPU, memory, disk, and network utilization.