attack surface

Everything reachable from outside: sockets listening on external addresses and ports the firewall lets through — and the services and accounts behind them. An audit starts with sudo ss -tlnp: which sockets listen and whose they are.