Installing Linux

Start with a minimal install — no desktop environment, no unnecessary packages. Every package on a server is something that eventually needs a security patch.

dnf install -y dnf-automatic
systemctl enable --now dnf-automatic-install.timer

Set a static IP, disable root SSH login, and enable a firewall (firewalld on RHEL-family systems) before this box does anything else. These four things — minimal install, automated patching, no root SSH, firewall on — cover a surprising share of "how did this get compromised" stories.