Digital Fortress Guide

# On your local machine
ssh-keygen -t ed25519
ssh-copy-id root@your_vps_ip

# Inside /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

sudo apt install libpam-google-authenticator -y
google-authenticator

tail -f /var/log/auth.log     # Watch login attempts live
grep "Failed password" /var/log/auth.log

# In /etc/ssh/sshd_config
Port 2222    # Use a non-standard port to avoid bots

# In /etc/fstab
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

sudo apt install clamav clamav-daemon -y
sudo freshclam
clamscan -r /home

iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

sudo apt install rkhunter -y
sudo rkhunter --check

# In /etc/sysctl.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Verify DNSSEC
delv @1.1.1.1 google.com

find / -perm /4000 -type f 2>/dev/null

sudo nano /etc/issue.net
# Add: "Authorized Access Only! All activity is logged."

sudo aa-status
sudo apt install apparmor-profiles -y

sudo apt install libpam-pwquality -y

cat ~/.bash_history

# Restrict Ctrl+Alt+Del
systemctl mask ctrl-alt-del.target