How to respond to a security incident

1. Contain — block the offender if known:

   sudo ufw deny from <offending-ip>
   sudo fail2ban-client status sshd

2. Evidence — do not destroy logs:

   sudo journalctl -u sshd --since "1 week ago" | grep Accepted
   sudo last -20
   sudo journalctl --since "24 hours ago" -p err --no-pager | tail -100

3. Rotate credentials that may be exposed: SSH keys, DB passwords, API tokens, app admin passwords (Vaultwarden is source of truth).
4. Audit:

   sudo aa-status
   ps auxf
   sudo ss -lntp

5. Document timeline, IPs, accounts touched, and actions taken.
6. Prefer moving admin SSH behind Tailscale/VPN long-term (security model).