1. SSH lockdown
- Disable root login:
PermitRootLogin no - Force key-only auth:
PasswordAuthentication no - Schimba portul default 22 → 2222 (reduce 99% scan zgomot)
- Fail2ban cu jail sshd (maxretry 3, bantime 24h)
- 2FA cu Google Authenticator (PAM module)
2. Firewall iptables / nftables
- Default DROP pe INPUT, ACCEPT doar pe porturile necesare
- GeoIP filtering: blocheaza tarile de unde NU ai trafic legitim
- Rate limiting per IP (limit-burst 10/min)
- Logging connection attempts in jurnal separat
3. CrowdSec (alternativa moderna la fail2ban)
Comunitate distribuita de threat intelligence. Detecteaza atacuri (SSH, HTTP, FTP) si sincronizeaza IP-uri rele global. Mai inteligent decat fail2ban static.
4. Automatic security updates
unattended-upgrades cu config strict pentru security only. Notificari email la upgrade-uri.
5. CIS Benchmark + Lynis audit
Ruleaza Lynis lunar: lynis audit system. Aim pentru hardening score > 80. Apply manual fixes pentru issue-urile high.
6. AppArmor / SELinux
Debian: AppArmor enabled by default. Profile pentru aplicatii sensibile (nginx, mysql).
7. File integrity monitoring
AIDE sau Tripwire — alertare la modificari binare critice.
8. Centralized logging
Trimite syslog la SIEM Wazuh / Graylog. Retentie 90 zile minim pentru audit forensic.