To Do List

• Have designated admin(s) who are responsible
• Set up fail2ban or other automated penetration detection and response
• Set up automated monitoring of system resources and alerts when significant thresholds are reached
• Make sure alerts (e.g. unattended-upgrade's "reboot required" emails) are delivered to admin(s) reliably (e.g. forward root's local Unix mail to their Gmail inbox)
  • https://cloud.google.com/compute/docs/tutorials/sending-mail/using-mailgun - except in step 13, can install much lighter-weight heirloom-mailx package instead of mailutils
  • http://blog.bobbyallen.me/2013/02/03/how-to-redirect-local-root-mail-to-an-external-email-address-on-linux/
• Drop packets originating from unrecognized networks, e.g. anything that isn't Google (so we can SSH in), and for Quiver anything that doesn't come from the CDN whose domain is being fronted
• Set up mitigations for denial of service attacks
• Set up a tool like https://github.com/google/grr
• Make sure anyone whose DigitalOcean/AWS/etc account has access to the server has 2FA set up (or at least a strong password)
• Set up 2FA on the servers. Rotate root passwords periodically.