i set up firewall rules but are they all correct? ports 80, 443, 22 — what else should i close?

dont keep ssh port 22 open, change the port to 2222 etc. but still install fail2ban. if theres no mail, dont open smtp/imap at all.. then just keep 80 443 2222 open close the rest...

ufw commands: ufw default deny incoming, ufw allow 80/tcp, ufw allow 443/tcp, ufw limit 2222/tcp (rate limiting ssh), ufw deny 3306/tcp (block mysql external). check: ufw status numbered. enable logging: ufw logging on, level medium. ssh config (/etc/ssh/sshd_config): port 2222, permitrootlogin no, pubkeyauthentication yes, passwordauthentication no (key-based). restart: systemctl restart sshd. internal communication: iptables rules or security groups (cloud provider level).

simplest setup: close port 22 from the internet only open it from the office ip... or change the port make it 2222. never open mysql port 3306 only localhost. like http https are normal, don't open anything else. that's it get the simple stuff done.

firewall tiers: perimeter (isp level), network (router firewall), host (host-based firewall). for web server: host firewall (ufw) + cloud security group (if cloud). ssh access: bastion host behind vpn, or ip whitelist. database access: internal network only, never external. logging for all rejected packets — siem integration is ideal. rate limiting ssh + tcp syn flood protection.

port 22 open = inviting hackers 😂 change the port install fail2ban done... anyway mail ports? if not needed close them, why would you open them...

You're right. Payment information changes are never verified through the channel they came from.

If it's your first time, start small; scaling comes later. Of course, it varies if your situation is different.

to get into the details: Processes without records never improve because you don't know what to fix.

good luck with that.

i went through the same thing.

I partly agree, partly disagree. When you try to change everything at once, nothing settles.

Everything goes well for the first three months; problems arise in the fourth. If you post the result here, it will help others too.

we experienced almost the exact same thing last year. i mean the biggest time-waster for us was not knowing who had the final say.

if permission and scope aren't in writing, don't start that test... of course, it varies if your situation is different.

I agree. Security isn't absolute; it's about making attacks not worth the effort.

Of course, it varies if your situation is different.

I went through the same thing. If it's your first time, start small; scaling comes later.

If I were you, Id go this route.

We've heard this a lot, but it never happened like that for us. Payment information changes are never verified through the channel they came from.

Most incidents start with a leaked password, not a vulnerability. If I were you, I'd go this route.

Noted, thanks.

Ive been down this road let me tell you. If 2FA is on a stolen password alone is useless.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. If I were you, I'd go this route.

Let me summarize what's been said so far. The biggest time-waster for us was not knowing who had the final say.

An untested backup is not a backup. Of course, it varies if your situation is different.

I'll try it.

I've been down this road, let me tell you. Taking notes for two weeks yields better results than a six-month estimate.

Processes without records never improve, because you don't know what to fix. I'm also curious if anyone does it differently.