I used to skip the post-install hardening — “it's just a throwaway VPS” — until one caught a brute-force storm that ate three days. Now the same fifteen minutes of prep happens on every box, home or cloud. Here is the list, in the order I actually run it.
1. Create a drop-in user before anything else
Never work as root, and never leave root SSH-open. Create a sudo user, copy your key, then disable password auth and root login.
useradd -m -s /bin/bash alex
usermod -aG sudo alex
ssh-copy-id alex@SERVER
# then in /etc/ssh/sshd_config: PermitRootLogin no, PasswordAuthentication no2. Lock SSH down properly
Change the port only for nuisance reduction — it does not stop a determined scanner. The things that matter are key-only auth, a reasonable timeout, and fail2ban for the noise.
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
# service ssh reload3. Firewall: deny inbound by default
ufw is fine for a single host. Allow ssh, then whatever you actually publish. Everything else is dropped and logged.
sudo ufw allow 22/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose4. Keep it patched, quietly
unattended-upgrades for security fixes; livepatch if you cannot tolerate reboots. Set an expectation that you reboot at least once a month regardless.
5. Run an audit and mean it
Lynis gives a score and a checklist. Read the suggestions once, apply the ones that fit, and ignore the rest. A report you never act on is worse than none.
The goal is not a perfect score. It is that the easy wins are done before someone else finds the holes for you.