Knowledge Base

1. Install supported security updates and reboot if the kernel or core libraries require it.
2. Create a named administrative user and verify sudo access.
3. Install at least two controlled SSH public keys before restricting password or root login.
4. Allow the active SSH port in the firewall before enabling a default-deny policy.
5. Expose only required application ports and bind private services to loopback or a private address.
6. Enable time synchronisation, review authentication logs, and configure monitoring.
7. Create an off-server backup and test restoration.

Make one access-related change at a time and keep an authenticated session open until a second connection succeeds. Hardening copied blindly from another distribution can lock you out.