Revisiting server hardening

Two months ago I wrote down my baseline for hardening a fresh Linux install . Non-root user, SSH lockdown, UFW, fail2ban, unattended-upgrades, the Docker firewall hole. It was fine as far as it went. But it didn&rsquo;t go far enough. Last week I spun up a new VPS (Debian 13 this time, not Ubuntu) and found six I&rsquo;d missed the first time around. Post-quantum SSH is also ready and takes one…