Secure access
Threat-model the server
Identify exposed services, valuable data, privileged accounts, provider controls, and recovery paths before changing Ubuntu security settings.
8 minute lesson
A server is not secured by one hardening script. Start with what this machine runs and what would happen if it failed.
List public ports, applications, databases, credentials, backups, DNS, cloud-provider access, and people with administrative rights. Separate internet threats from a compromised application or stolen provider account. Choose controls from those paths.
A public blog VPS and a private database host need different controls. A stolen provider account can also bypass a carefully hardened SSH service.
Rank each path by reachable assets and recovery cost. This keeps the exercise practical: provider MFA may matter more than another SSH tweak when the console can replace the server.
Draw the lab VPS, provider console, DNS, backups, public ports, and administrator paths. Remove one assumed control, such as SSH or provider MFA, and record the remaining exposure and recovery path.
Lesson completed