VyOS Security Hardening Checklist

Checklist discipline. Every item is meant to be answered yes / no with evidence. Items marked critical are non-negotiable; items marked warn are judgement calls; items marked info are baseline expectations.

Items

• SSH key-only authentication enforced (severity: critical)
• Modern SSH algorithms (no DSA, no 3DES, no MD5) (severity: warn)
• Management source ACL enforced (severity: critical)
• API token scope limited to the minimum required (severity: warn)
• User accounts reviewed, unused removed (severity: info)
• Routing-protocol authentication in place (severity: critical)
• max-prefix on every BGP peer (severity: warn)
• Outbound BGP filter blocks internal prefixes (severity: critical)
• Inbound BGP filter applies IRR / RPKI / manual policy (severity: warn)
• Firewall default-deny, explicit allow for required services (severity: critical)
• Control-plane protected (CoPP / ACL / management VRF) (severity: critical)
• Software on the current LTS line (1.5 circinus) (severity: info)
• Firmware on NIC and BMC current (severity: info)
• Syslog forwarding to central, retention policy in place (severity: info)
• Incident response runbook current and tested (severity: warn)

Severity legend

• info: baseline expectation
• warn: judgement call; production-grade depends on context
• critical: non-negotiable; a missed critical item is a release blocker

Evidence retention

The completed checklist is evidence for the change ticket, the audit, and the post-incident review. Store it where it can be recovered if the router is lost.