The moment a server with a public IP boots, bots start probing it. SSH on the default port, weak passwords, and unpatched packages get found fast. None of this is paranoia — it is a background hum of the internet you need to quiet.
The security baseline
- ▸Disable password login and use SSH keys only
- ▸Change the SSH port or use a firewall to restrict it
- ▸Install automatic security updates
- ▸Set up a firewall and close everything you are not using
- ▸Configure fail2ban for repeated failed logins
Locking down the OS
Create a non-root user with sudo, never log in as root, and restrict who can even reach SSH. Services should run as their own unprivileged user — a compromised web server should not mean a compromised box.
Planning for the worst
Backups are a security control, not a comfort feature. Offsite, automated, and actually tested restores mean a ransomware scare becomes a 30-minute restore instead of a career-defining conversation.
At Axro, every box we stand up goes through this exact checklist before it sees traffic. If you want a server you never think about at 2am, this is where the work happens.
