Hardening your Pinebook Pro

[DrYak]

In addition, have also been hoping for a discussion of firewalls (UFW?) including best practices and setup/configurations recommendations and examples.  (I thought UFW often came installed with Debian but doesn't appear to be present in the PBP)

There are quite a few firewall-related packages in debian. But currently...

Code:

$ apt search firewall | grep 'installed'
wget/oldstable,oldstable,now 1.18-5+deb9u3 armhf [installed]

None of them is amon the list of installed application.

The new 'standard' (i.e.: most popularly installed everywhere, like pulseaudio or systemd) firewall is firewalld

There are tutorials for installing firewalld on debian 10 buster
and in my personal experience (Raspbian on a Pi3+) it more or less works the same on Debian 9:

• install the package
  
• use `firewall-cmd` to test some rules
  
• use `firewall-cmd --permanent` to store them in the permanent set to be loaded on next boot