You need to secure the system as a whole (SSH, sudo, logs, firewalls, SELinux) and then each individual component (db access). For example, here's my thread on

You need to secure the system as a whole (SSH, sudo, logs, firewalls, SELinux) and then each individual component (db access). For example, here's my thread on basic firewalld configuration[0] (yes I know firewalld is not Ubuntu's default, but it's in the repository and can be used). There is a lot to go through for a comment answer. I think little bit of Google will reveal some decent Ubuntu articles. I'll say at least this. Scratch root access completely, and set up an admin account with SSH-keys auth. That would be a good start to replace password-access. If you want to be more confident in system configuration, I wrote a book on the topic[0]. It uses enterprise Linux rather than Ubuntu, so I can teach SELinux too (which is actually a big security improvement). [0] https://twitter.com/strzibnyj/status/1480494670299815939 https://twitter.com/strzibnyj/status/1480494670299815939 [1] https://deploymentfromscratch.com https://deploymentfromscratch.com