A couple of small stuff…
* Never ever be logged in as root, there’s alot of stuff you can do by mistake
Compare these
rm -rf /
sudo rm -rf /
Anecdote: I know a certain administrator that shutdown a mail server by mistake, by typing “halt”... not remembering he was root
* If you’re only using the computer hands on, without any remote (ssh) accesses - turn ssh off
* Usually direct root access (read by default) isn’t allowed over ssh anyways, but if you have a weak password - a hacker could hack your account and use that to gain root privileges - so if you know the IP numbers that you’re going to connect from you can alter hosts.allow and hosts.deny to restrict, well, access.
$> man hosts.allow
$> man hosts.deny
$> sudo nano /etc/hosts.allow
sshd: 10.0.0.15: ALLOW
sshd: 192.168.1.1: ALLOW
$> sudo nano /etc/hosts.deny
sshd: ALL
This will only allow access from the IP numbers 10.0.0.15 and 192.168.1.1 - should be replaced with “real” ones.
Just my €0.02
Footnote: I never use su , only sudo - if I need “su -” I just “sudo [-i] sh”