A quieter Linux box

Starting point

A fresh server is not a blank page — it is a set of defaults someone else chose. I wanted to see how much I could reduce the surface without making the machine painful to use.

The checklist I actually kept

• Key-only SSH, no root login, and a non-default port as one layer among several
• A named sudo user instead of daily work as root
• ufw with explicit allow rules, reviewed rather than assumed
• Unattended security updates, with a maintenance window I could explain
• systemctl list-unit-files and ss -tulpn: knowing what is listening before deciding what should be

What surprised me

The biggest improvement was not a clever configuration flag. It was writing down why each change existed, so a future version of me could tell the difference between a security decision and an accident.

Still learning

AppArmor profiles, auditd, and how to harden a box without turning every deploy into a ceremony.