Exposure
- only required services listen on network interfaces
- administrative access is restricted and auditable
- firewall policy reflects intended service exposure
Identity
- privileged accounts are controlled
- sudo policy is least-privilege
- stale accounts and keys are removed
System integrity
- security updates have an owned process
- service configuration is version controlled where practical
- filesystem permissions and sensitive mounts are reviewed
- logs are retained and protected appropriately
Quick commands
ss -lntup
getent passwd
sudo -l
systemctl --failed
journalctl -p warning -b