Honestly I think nowadays the best idea is to not mess with defaults for the most part, but I do: * Check open/listening ports and reconfigure or disable unnec

Honestly I think nowadays the best idea is to not mess with defaults for the most part, but I do: * Check open/listening ports and reconfigure or disable unnecessary services to limit attack surface. Do you really need an NTP server, or just a client? What about SNMP, you going to use that or do you use telegraf/metricbeat/whatever? * Harden configs for any remaining services. SNMPv3 only. SSH key/cert based auth only. Disable insecure ciphers or protocols. * Keep the distro PATCHED. So easy to pwn old ass sudo binaries, openssl versions, or kernels. Patch your shit. Can't overstate this. * send audit logs to a central log store, for post-intrusion forensics