How to Secure a Linux Server
This guide contains (at least) inaccurate statements. It&#x27;s oversimplifying and omitting important things while putting emphasis on some exotic details where defaults would be sane enough.<p>&quot;One key, the public key, can only encrypt data, not decrypt it&quot; - this is cryptographically inaccurate. One should use it that way, though.<p>&quot;Identity is verified by encrypting and decrypting data that both the client and server know&quot;. That&#x27;s not how signing works. The crucial part of the process is to first establish an encrypted channel, then choose something random (not used previously) and finally verify the signature is correct. What exactly would be the data that &quot;both the client and server know&quot;?<p>&quot;If you&#x27;re sure there is nobody listening between the client you&#x27;re on and your server, you can use ssh-copy-id to transfer and append the public key&quot;. Almost never happens unless you&#x27;re in the server room, connected point-to-point. But then the remark about someone listening doesn&#x27;t make sense. And not a single word about verifying server&#x27;s fingerprint in the whole guide.<p>&quot;Keep in mind doing this means you can&#x27;t use the key for automation because you&#x27;ll have no way to send the passphrase in your scripts&quot;. Unless you use an ssh-agent.<p>&quot;umask is a Bash built-in which means a user can change their own umask setting&quot;. Wrong implication here. umask is a syscall. It doesn&#x27;t matter what you use to call it. And what if you&#x27;re using a different shell?<p>Suggesting painful default umask instead of just doing `chmod go-rwx $HOME` and adjusting &#x2F;etc&#x2F;adduser.conf is debatable.<p>Making this guide &quot;distribution agnostic&quot; is IMHO futile and there already are some distribution-specific guides like <a href="https:&#x2F;&#x2F;debian-handbook.info&#x2F;" rel="nofollow">https:&#x2F;&#x2F;debian-handbook.info&#x2F;</a>.