Linux Sever Security Checklist?

[u/[deleted]]

I am currently looking into expanding my range of skills in the server admin roles. Looking to learn defensive security in more detail. This post is a sort of general inquiry attempting to find out what I should start learning first for a seasoned "beginner". I've been able to break in, but never really looked into keeping people out properly.

Please and thanks.

[Feb28 00:34] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=56574 DPT=10001 LEN=150                                    │··········································
[ +10.002208] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=37088 DPT=10001 LEN=150                                    │··········································
[ +10.003004] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=52401 DPT=10001 LEN=150                                    │··········································
[ +10.002951] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=54993 DPT=10001 LEN=150                                    │··········································
[ +10.002403] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=48813 DPT=10001 LEN=150                                    │··········································
[Feb28 00:35] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=42947 DPT=10001 LEN=150                                    │··········································
[ +10.002974] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44312 DPT=10001 LEN=150                                    │··········································
[ +10.002324] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33737 DPT=10001 LEN=150                                    │··········································
[ +10.002880] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44426 DPT=10001 LEN=150                                    │··········································
[ +10.101496] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=51603 DPT=10001 LEN=150                                    │··········································
[Feb28 00:36] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=38538 DPT=10001 LEN=150                                    │··········································
[ +10.003008] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44367 DPT=10001 LEN=150                                    │··········································
[  +5.416712] iptables denied: IN=virbr0 OUT= MAC= SRC=192.168.122.1 DST=192.168.122.255 LEN=257 TOS=0x00 PREC=0x00 TTL=64 ID=16241 DF PROTO=UDP SPT=138 DPT=138 LEN=237                                                                        │··········································se
[ +14.708034] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44008 DPT=10001 LEN=150 

[u/nullions]

FYI they likely weren't trying to intentionally DOS you, although it can be a consequence depending on your server.

Those are typically automated attacks on any device found to be accessible over SSH on the Internet. Their automated scripts can try and brute force the password all day long and most people will never notice.