Shrinking the attack surface of a Debian or Ubuntu server: locking down remote access, confining processes, recording who did what, blocking abuse, and keeping the system patched without leaking secrets.
5 topics
A default Debian or Ubuntu install is reasonably safe, but "reasonably safe" is not a security posture. Every open port, every process running as root, and every package you never patch is a path an attacker can walk. Hardening is the deliberate work of closing those paths one at a time, then proving they stayed closed.
This chapter works from the outside in. It starts at the network edge with SSH, the single most-attacked service on most servers, then moves to mandatory access control with AppArmor and SELinux, the audit trail that tells you what happened, automated tools that ban hostile clients, and finally the unglamorous discipline of patching and secret management that quietly prevents most real-world breaches.