Like so many others, I'm an intermediate web developer who is starting to get into the security side of things and I'm looking to start running a Linux VPS (Debian). For years, I've resisted the move to VPSs because of the security implications. There are many, many guides available on the internet and even questions on this StackExchange.
However, I'm still uncertain if what these guides recommend is sufficient. To be clear, here is what I consider as "standard advice":
- Regular system updates
- Regular backups
- Disabling root access, create limited user account (with
- Harden SSH access (use key files, disable root logins, change port, listen on only one inet protocol
- Use Fail2Ban
- Remove unused network-facing services (ex: samba, lp, Xserver)
- Configure a firewall
- Configure an intrusion detection system (ex: OSSEC, Tripwire)
- Run regular malware checks (maldet, ClamAV, rkhunter)
- Disable IPv6 (I'm not sure about this one)
/bootread-only (I'm not sure about this one either)
For further information, my use case is the following: a server that holds very sensitive personal information and messages and would be a potentially desirable target for attacks. In this case, is the "standard advice" enough?
P.S. I'm aware that the best thing to do would probably be to hire a security expert, but I'm working pro-bono for a non-profit and they don't have the budget for it.