1. SSH lockdown
- Disable root login:
PermitRootLogin no - Force key-only auth:
PasswordAuthentication no - Change default port 22 → 2222 (reduces 99% scan noise)
- Fail2ban with sshd jail (maxretry 3, bantime 24h)
- 2FA with Google Authenticator (PAM module)
2. iptables / nftables firewall
- Default DROP on INPUT, ACCEPT only on required ports
- GeoIP filtering: block countries you have no legitimate traffic from
- Per-IP rate limiting
3. CrowdSec (modern fail2ban alternative)
Distributed threat intelligence community. Detects attacks and syncs bad IPs globally.
4. Automatic security updates
unattended-upgrades configured strictly for security only.
5. CIS Benchmark + Lynis audit
Run Lynis monthly. Aim for hardening score > 80.