Compliance benchmarks like the other user suggests are probably best. eg: CIS They're updated fairly regularly. However, take them with a grain of salt. The

Compliance benchmarks like the other user suggests are probably best. eg: CIS They're updated fairly regularly. However, take them with a grain of salt. They'll worry about things like TCPWrappers, but that's how we did firewalls before they existed. Needless in the days of iptables, ebtables, nftables, etc. Blogs tend to be recycled/dated recommendations with none/very little third party testing.