New server check list?

Ssh settings, kernel hardening, user permissions

Luckily Ansible can automate that :)

Haven't wrapped my head Around ansible got any resources I could use?

Depends....

sysctl settings / limits should be mentioned in addition to the other stuff

Edit:
OH. And don't forget SystemD... You need to set everything there if your distro uses it.

Or serverless 😉

@dan-pud That works, but knowing how to set up a server is a must for most developers. Also, it's expensive and sometimes very limiting. But it has its use cases

@dan-pud but that isn't as much fun :(

@nitehound I've learned it through trial and error, perhaps this one helps:
https://docs.ansible.com/ansible/...

And then go to the heading 'Create and Run Your First Network Ansible Playbook'

Also setup fail2ban for SSH

molly-guard, don't want to end up rebooting the server instead of your local machine

Also help yourself and setup a minimal system with all the common things you need and appropriate hardening, make a template of it somehow, reuse that for new systems.
You can even do this when working with ansible, just leave the things out you want ansible to handle, but there are still things you'll have to do on that systems, like enabling ssh and adding your ansible public key, you're hopefully using. You could go further and bootstrap bare metal too automagically too, but that'll need other tools

Change ssh port

@PaszaVonPomiot That is just security through obfuscation and mostly useless, as a simple port scan reveals your ssh service in seconds. :/

@ScriptCoded
Agree it's a good thing to know. However 99% of the time it's unnecessary. In my experience it's also cheaper. Taking into account total cost of ownership, not just compute time is something most people don't include when saying it's more expensive.

@dan-pud What do you mean with costs of ownership? Maintenance?

@ScriptCoded
Most expensive thing is usually people's time. Would you rather a 100k engineer look after a bunch of servers or be building new features into your products to increase your products value?
When you're Facebook, Netflix, etc. it makes sense to employ teams of people to do that. But for most companies it's far better business value to employ developers and use a serverless architecture.
Most people only look at 'per request' and don't factor in the cost (engineers time) to look after servers. That's total cost of ownership

@dan-pud Sure, that makes sense. Though want to be doing PDF conversion with Open Office, how would you do that? Of course there are cases when "server less" is useful and possible cheaper than maintaining plain old servers, but let's say that a small company wants to hire a developer/engineer/fullstack. That person better know how to configure a server.

There is a REST API that will do that for you:
v2.convertapi.com/convert/docx/to/pdf
That's the point of serverless! There is no business value in writing that code yourself. Use a service. (Unless pdf conversion is your business)
It's like agile. Do the things that provide business value.

@dan-pud It might not be wise to use an service like that for sensible data....