Security Baseline Hub: What to Do in the First Hour After Provisioning

# The first hour sets the year's security level Indiscriminate scanning and brute force hit every new address every minute. What you do in the first hour after provisioning determines your security waterline for the next year. Security is not a purchased product — it is a set of default actions. ## Quick decision block - Just provisioned → run the first-hour checklist below, copy-paste ready - Suspect intrusion → jump to the four-step response and the three intrusion signals - Public-facing and DDoS-anxious → the protection & anti-D section - Running a panel (BT/1Panel) → the three panel hardening rules are mandatory ## First-hour checklist (copy and run) ```bash # 1) everyday user with sudo; stop living as root adduser deploy && usermod -aG sudo deploy # 2) key login: generate locally, push (verify key login BEFORE step 3!) ssh-keygen -t ed25519 -C "deploy@$(hostname)" ssh-copy-id deploy@ # 3) SSH hardening: no passwords, no direct root sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config systemctl restart sshd # 4) firewall: default-deny inbound, whitelist only what must be open ufw default deny incoming && ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp && ufw enable # 5) anti-brute-force + automatic security updates apt install -y fail2ban unattended-upgrades && systemctl enable --now fail2ban # 6) exposure self-check: nothing but 22/80/443 should listen publicly ss -tlnp ``` ## Least privilege and service convergence One low-privilege user per service; databases bind to localhost or internal addresses only (`bind 127.0.0.1`) — never public; app-to-DB accounts get only the tables they need, never root. Kill unused services and ports; re-run `ss -tlnp` on a schedule — every extra listener is extra surface. ## Three panel hardening rules 1. Change the default port; enable panel SSL and two-factor auth. 2. Bind an access whitelist (office/jump-host IPs) — a compromised panel equals a compromised box. 3. Act on panel update notices the same day: mass exploitation of panel vulns typically begins within hours of disclosure. ## Backups: 3-2-1 Three copies, two media, one off-site. Practical floor: daily database dump + site directory snapshot, encrypted, synced to object storage or a second server; **rehearse a restore quarterly** — an unverified backup is not a backup. A "backup" living on the same server gets encrypted alongside your data in a ransomware event. ```bash # minimal backup: dump + pack + off-site sync mysqldump --all-databases | gzip > /backup/db-$(date +%F).sql.gz tar czf /backup/site-$(date +%F).tar.gz /var/www rsync -az /backup/ backupuser@:/data/backup/ ``` ## Logs and audit Keep auth.log/secure (logins and privilege changes), web access logs, DB slow-query logs. Centralize them (even a daily packed upload off-site) and intrusion scoping shrinks from hours to minutes. Clocks must be right (`timedatectl` for timezone + NTP) — scrambled timestamps double forensics effort. Retention balances troubleshooting needs and compliance. ## Three intrusion signals - **Strange processes:** CPU pinned while traffic is flat; unknown names in `top` — mining malware is the usual suspect. - **An outbound connections:** `ss -antp` showing persistent connections to unknown IPs (mining pools favour ports 3333/5555/14444). - **Persistence traces:** unknown crontab/boot entries; unfamiliar successful logins in `last/lastb`. ## Four-step incident response 1. **Isolate:** firewall-cut everything except the management path; stop lateral spread. Do NOT reinstall yet — evidence evaporates. 2. **Preserve:** last/lastb, auth logs, crontab, `ss -antp` anomalies, files changed in 3 days (`find / -mtime -3`). 3. **Eradicate & harden:** rotate every credential (SSH keys, panel, DB, cloud API tokens); clean scheduled tasks and boot items; patch the entry hole. If cleanliness cannot be proven: migrate data, reinstall. 4. **Retrospect:** pin the intrusion path, fold the gap into your first-hour checklist, notify stakeholders where required. ## Protection & anti-DDoS If you have attack history or sit in a target industry (gaming, finance), buy DDoS-protected machines up front (20G–200G protection tiers) rather than bolting on a CDN afterwards. Web workloads can add CDN/WAF to hide the origin — execute with the DNS hub's origin-protection notes. ## Compliance basics Mainland-China servers need ICP filing; log retention must meet local regulation; personal data handling follows the applicable regime (PIPL/GDPR boundaries are mapped in the compliance piece). Compliance is a design input, not a post-mortem checkbox.