The essentials.
THE FIRST HOUR
Apply all updates Change default credentials Create a non-root user Set up key-based login and disable password authentication Configure the firewall Disable services you do not need
WHY IMMEDIATELY
Automated scanning finds new servers within minutes.
A server left with default settings is compromised quickly.
THE FIREWALL
Allow only the ports you need. Deny the rest by default.
Typically: remote access, web, and mail if you run it.
DISABLING ROOT LOGIN
Log in as a normal user and elevate when needed.
That removes the most commonly attacked account.
CHANGING THE REMOTE ACCESS PORT
Reduces automated noise. Not real security by itself, and it reduces log volume considerably.
FAIL-BAN TOOLS
Automatically block addresses making repeated failed attempts.
Worth installing.
WHAT TO DO AFTERWARDS
Verify you can still log in from a second session before closing the first.
Locking yourself out is a common and avoidable mistake.
