> It shows that you do not understand the core issue and what the main purpose of such tools is, how they function , etc. The people who write those guides don

> It shows that you do not understand the core issue and what the main purpose of such tools is, how they function , etc. The people who write those guides don't either. I almost never see mention of things like OSSEC or running a WAF or even a basic IDS/IPS. Just lots of naive "hackers get in through passwords, dont use passwords in ssh and enable fail2ban." That's on top of security via obscurity like changing port numbers. Uh, what? Security needs to have a layered onion approach: Network> IDS/IPS, Firewall Server> OSSEC, SELinux, smart permissions, WAF, AV Storage/Filesystem> Backups, tripwire DB> Hashed passwords, etc Software> Patching schedule, writing secure software from day 1, not giving into to team/client demands for insecurity Monitoring> OSSEC alerts, nagios/zabbix alerts, tripwire alerts, etc Once you get used to a security stack, this stuff comes easy. The problem is cheap VPS's have turned devs into sysadmins who just plant a naked linux box on the web, turn on fail2ban, and call it a day.