4.5. Server Hardening

💡 First Principle: Every feature, service, and open port in a server is a potential attack surface. Hardening reduces attack surface by removing everything that isn't needed—unused services stopped, unnecessary ports closed, unneeded software uninstalled, and default configurations replaced with secure ones. A minimally configured server is harder to attack than a fully featured one.

The principle is "deny by default, permit by exception." Start from the assumption that nothing should be enabled, and add only what the server's role requires.