Within 10 Minutes of Provisioning, Bots Will Attack Your Server

Every newly launched public IPv4 address receives thousands of automated SSH dictionary attacks per day attempting default credentials (e.g. root / admin / 123456). Hardening your operating system is step zero.

Production Hardening Checklist

  • Disable Password Authentication: Enforce 4096-bit Ed25519 SSH key pairs exclusively. Change default SSH port 22 to a non-standard port.
  • Configure Fail2ban: Automatically ban any IP address that fails authentication 3 times for 24 hours.
  • Strict UFW Rules: Allow incoming traffic only on Ports 80 (HTTP), 443 (HTTPS), and your custom SSH port. Block all other ports by default.
  • Automatic Security Updates: Enable unattended-upgrades so critical Linux kernel CVE patches apply automatically without manual intervention.