Server Setup & Hardening
Initial Setup
- Update system packages
- Create non-root user with sudo
- Disable root SSH login
- Configure SSH key authentication (disable password)
- Change SSH port from default 22
- Configure UFW firewall (allow only needed ports)
Firewall Rules
- 443/tcp: HTTPS (always)
- 22/tcp or custom: SSH (your IP only)
- 80/tcp: HTTP (redirect to HTTPS)
- Block everything else by default
Security
- Fail2ban for brute-force protection
- Automatic security updates (unattended-upgrades)
- Log rotation configured
- Swap file for memory overflow
Monitoring
- System metrics: htop, df, free
- Log monitoring: journalctl
- Uptime monitoring: external service