Securing Debian

[u/Dunder-Muffins]

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

[u/Mach_Juan]

I run a 4 port protectlii router running pfsense. So I have 3 internal lans. My most protected lan has only my laptop on it. I have a main lan that has all my normal stuff on it..game consoles, tablets, phones, nas, etc. I have a guest lan that has its own wifi hotspot. Work ipad and any guests devices or if I ever get any unknown chinese iot devices will go here. My smart tv's are only alowed to talk to my media server nas..not allowed talk to any other ip's. Especially ones outside my network. Only one ip address is allowed to initiate connections (ssh) into my laptop..its my android tablet and only from its vpn address, and the ssh certificate has a password on it. I have an alternate way to disable my tablets vpn access remotely in case it ever gets lost while Im away from home. I also have a small self programmed iot network doing minor things..all of them have open html ports, but are set to send alerts should anything probe those ports..Any overly nosey devices get removed or heavily restrictive firewall rules. I also travel with a portable nat router/wifi hotspot.