Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I would instead suggest the official guide; the Securing Debian Manual <https://www.debian.org/doc/manuals/securing-debian-manual/>


Please note that this official guide is more than 6 years old. It means a large parts of its content is obsolete.

For instance the chapter on web servers is far from today's best practices. It only mentions Apache http (nowadays Nginx is much more widespread), gives an advice about a default configuration which is no more default, and mentions a path that has changed in recent Debian installs. Even considering its age, the quality of this chapter is dubious: it forgets important points, like disabling .htaccess and directory listing, removing unused modules...

Modern tools are obviously missing from this guide: apparmor (though it was in use in 2017), nftables, systemd (unit settings that prevent /home access, prevent privilege escalation, etc)...


I read a bit more of this "official guide", and I'm surprised Debian hasn't deprecated it. Parts are still valuable today, but others are meaningless, and a few should be avoided.

From the changelog, the document had one minor update in 2017 and one in 2013. It was mostly written in 2001-2007. Much has changed over the last 15 years.


It might be a bit corporate now but a few years back I found the security aspects of the redhat admin training to be decent enough for most folk.


The article was explicitly targeted at “Debian 11 (Bullseye) or Ubuntu”.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: