Reducing the attack surface

Every running service is something an attacker can probe. Hardening starts by removing what you don't need.

See what's listening

sudo ss -tulpn

For each port, ask: does this need to be reachable from the internet? A web server needs 80 and 443. A database almost never needs to be public.

Bind internal services to localhost

In MariaDB's config:

bind-address = 127.0.0.1

Redis, Memcached and admin panels should also listen only on 127.0.0.1 or a private network.

Default-deny firewall

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp
sudo ufw enable

Restrict SSH to your office IP if it's fixed: ufw allow from 198.51.100.7 to any port 22.

Remove unused software

sudo apt purge telnetd ftp rsh-server
sudo apt autoremove