Complete the server security review

Server security is maintenance, not a one-time installation step. Make the review repeatable after every meaningful infrastructure change.

Everything in this course collapses into one operating loop: check access, check exposure, check updates, check evidence, and prove recovery still works.

A checklist with evidence attached

Reconcile accounts and keys, listeners and firewall rules, packages and services, file permissions, secret inventory, alerts, backup restores, and incident contacts. For each line, capture the command output that proves the state — not a checkbox:

access:    getent group sudo matches admin roster           2026-08-03  flavio
ssh:       sshd -T shows permitrootlogin no                 2026-08-03  flavio
exposure:  ss -lntup matches map (22, 80, 443 only)         2026-08-03  flavio
updates:   apt list --upgradable empty, kernel current      2026-08-03  flavio
secrets:   /etc/blog/env root:blog 640, rotated in Q3       2026-08-03  flavio
alerts:    sudoers-change alert fired in test               2026-07-28  flavio
restore:   pg restore drill, 14 min, row counts match       2026-07-20  flavio

A checklist that only records “done” becomes stale quickly. Evidence such as fingerprints, package versions, listener output, alert tests, and restore times makes the review repeatable.

Date every artifact and name its owner. A passing result has limited value after accounts, packages, firewall rules, or deployment architecture change without another review.

Exceptions are findings with deadlines

Record exceptions with an owner and deadline. “Port 8080 open for the migration, close by Aug 15, owner marco” is a managed risk. The same open port with no note is drift, and drift is where the previous lessons’ work quietly erodes.

Close the loop on the lab

Remove the lab server when the course is complete, then verify from the outside that it is really gone:

nc -vz 203.0.113.10 22
# nc: connect to 203.0.113.10 port 22 (tcp) failed: Operation timed out

A “deleted” server that still answers means something is still running, still billed, and still attackable.

Run the final review and save non-secret evidence for access, exposure, updates, permissions, alerts, and recovery. Introduce one disposable mismatch, prove the review catches it, then remove the lab server and verify it no longer responds.