1. SSH lockdown
- Disable root login:
PermitRootLogin no - Force key-only auth:
PasswordAuthentication no - Change default port 22 → 2222 (reduces 99% scan noise)
- Fail2ban with sshd jail (maxretry 3, bantime 24h)
- 2FA with Google Authenticator (PAM module)
2. iptables / nftables firewall
- Default DROP on INPUT, ACCEPT only on required ports
- GeoIP filtering: block countries you have no legitimate traffic from
- Per-IP rate limiting
3. CrowdSec (modern fail2ban alternative)
Distributed threat intelligence community. Detects attacks and syncs bad IPs globally.
4. Automatic security updates
unattended-upgrades configured strictly for security only.
5. CIS Benchmark + Lynis audit
Run Lynis monthly. Aim for hardening score > 80.
Base commands
A few concrete commands to start hardening right away:
# SSH lockdown + fail2ban (comenzi reale)
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl reload ssh
sudo apt -y install fail2ban unattended-upgrades
sudo systemctl enable --now fail2ban
sudo lynis audit system # scor de hardening