Started off by
- Enabling unattended updates
- Enable only ssh login with key
- Create user with sudo privileges
- Disable root login
- Enable ufw with necessary ports
- Disable ping
- Change ssh default port 21 to something else.
Got the ideas from networkchuck
Did this on the proxmox host as well as all VMs.
Any suggestions?
True, and 100% agree except I forgot to mention
1.) The fortigate has a known list of botnet command and control servers that are blocked 2.) I only allow them to access their home server domain names for the only purpose of allowing for firmware updates. They are not capable of accessing any other domains or IPs