I wouldn’t recommend using anti-virus software. It usually creates a lot more overhead, plus it usually mimics existing solutions already in linux. The only viruses I have ever caught using an anti-virus software on Linux are the test viruses to see if all is working fine.

Anyway, here’s my 20+ enterprise experience recommendations with Linux :

• enable secure boot: will disable launching non-signed kernel modules (prevent root kits)
• enable firewall: and inly allow ports you really need.
• SELinux: it is getting better, and it will prevent processes to access resources out if their scope. It can be problematic if you don’t know it (and it is complex to understand). But if it doesn’t hinder you, don’t touch it. I do not know AppArmor, but it is supposed to be similar.
• disable root over ssh: or only allow ssh keys, or disable ssh altogether if you do not need it.
• avoid using root: make sure you have a personal account set up with sudo rights to root WITH password.

Adhering to these principles will get you a long way!

Thank you for the advice!

Firewall on Linux is something I still don’t understand, and explanations found on Internet have always confused me. Do you happen to know some good tutorial to share? Or maybe one doesn’t need to do anything at all in distros like Ubuntu?

Regarding ssh: you only mean incoming ssh, right?

ebtables and iptables can be very complex. And I failed my 1st RHCE exam because of them. But once you learn, you will never unlearn, as they are quite beautifully crafted. You just need to get into the mindset of the people who wrote the tools…

Look into firewalld It has a rather simplified cli interface: firewall-cmd

The manpages will tell you a lot.

firewall-cmd —add-service=ssh Will open the ports for your ssh daemon until you reload your firewall or reboot your system firewall-cmd —permanent —add-service=ssh Will open the ssh ports until you remove them

firewall-cmd —list-all Will show you the current firewall config