[sdeziel]

3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)

4. Don't let your DB host make outbound connections (iptables/ip6tables)

[emmelaich]

> Don't let your DB host make outbound connections

Which can also be prevented with SELinux