encrypted everything the way d-i does it (boot unencrypted – rest dm-crypt+LUKS). Check strong passphrase for encryption. Check seperate laptop ssh key. Check sshd only public daemon running. keylogin only. Check other stuff that ‘listens’ either killed or firewalled away.…