My home servers have generally a lot smaller attack surface, as only a few ports are actually routed to them, so in theoey I could get away with a more relaxed approach. But I’m also a big believer in defense-in-depth, so I follow the same rules of thumb:

• iptables (or equivalent) that drops anything incoming that isn’t wanted. It also rejects anything going out that isn’t planned for.
• any public facing service (except ssh) gets its own user
• disable root login via ssh
• ssh login with key only on any user in sudoers

If I was on my laptop and not my phone I would post a screenshot with a P just for you

Well, there’s a footnote on my end: Me taking the drives home is a bit of a grey area, as the procedures say that the drives are to be mechanically destroyed when no longer needed. It doesn’t specify needed by whom. And I do attack them with my angle grinder, so it’s in accordance with company policy.

And yes, my employer knows and is OK with it. We go through a ridiculous amount of drives due to large storage needs, so pragmatism tends to trump bureaucracy.

I usually scavenge old drives from work. On one hand they’re a bit smaller than I’d like them to be, but on the other hand they’re free except from the minor work and documentation involved in ensuring that no company related data remain.

Yup, there’s no kinkshaming here

deleted by creator

Used it in the past, and it’sa pretty alright desktop OS. It would work as a server OS, but that’s not really its main focus.

It’s debian based, so might as well go for actual debian.