Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have thought a bit about hardening a Debian squeeze file & VPN server lately.
Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root password and installed unattended-upgrades to keep us fresh on those security fixes.

What more should we do?

share|improve this question
unattended-upgrades is quite a bad idea. Your sysadmin should be keeping an eye on the mailing list and committing those fixes manually as needed. It promotes laziness and not keeping up to date with security issues. – Chris Down Feb 4 '12 at 13:30
Have you read the Securing Debian manual? – ierax Feb 4 '12 at 18:16
Nope, that's new to me. Thanks! – Industrial Feb 4 '12 at 21:03
up vote 4 down vote accepted

Have a quick read of the more general Hardening Linux question over on Security Stack Exchange

It includes guidance on removal of weak services, maintenance of security, links to SANS guidance etc., and while it is for general Linux, 90% of it will be absolutely appropriate for Debian.

share|improve this answer

I see no problems with unattended updates. They are better than no updates or late updates. If you can afford manual update - good luck if you run more than 50 servers...

It has been a long time I ran Debian, but I bet bastille is sill around. Just run it - it will help you along the way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.