A public machine is being scanned from its first minute — that is not rhetoric, it is the default. So the first hour is not for installing things. It is for closing the door. Five moves, with strict dependencies.
In this pagefive moves in order, three classic lockouts. Not in this pageany of my own machines' configuration. Everything here is a placeholder.
| # | Move | Why it sits here |
|---|---|---|
| 1 | Confirm key login works | Everything after this can lock you out. This is your way back in |
| 2 | Create a non-root user with sudo | Must exist before root login is closed, or nobody can get in |
| 3 | Disable password login (and direct root login) | Scanners are overwhelmingly trying passwords. Highest-yield step |
| 4 | Firewall: default deny, open only what is needed | Set before installing services, or you will miss ports you just opened |
| 5 | Failure banning (fail2ban and similar) | Backstop. Limited value if the above is right, but it is cheap |
Every step removes a way in. Disable password login before setting up keys and for that window you have no way in at all — on a machine in someone else's datacentre.
One rule: confirm the new way in works before closing the old one. That holds for every later operations change too, not just the first hour.
Change the config, restart SSH, close the terminal — and the new config has an error, and that is that.
Correct form: keep your current session open and open a second connection to verify. Only when the new one works do you close the old. The old session is your safety line.
The instant the inbound policy flips to deny, your own SSH is denied with everything else.
Correct form: add the SSH allow rule, then change the default. Same shape — open the new door before closing the old one.
Create the user, disable root login, discover the new user can do nothing.
Correct form: verify immediately after creating — log in as the new user, run something requiring sudo, confirm it works, then close root.
All three have identical structure: the old path was closed before the new one was verified. Remember that and you need no specific commands from this page.
| Port | Open? |
|---|---|
| SSH | Yes — your only entrance |
| Services you genuinely serve publicly | Yes |
| Everything else | No |
Always-on agents, databases, admin panels should bind to localhost only, not to the public interface. Many programs default to listening on everything — which means one hole in the firewall exposes them.
Do both layers: bind locally (first) and firewall it too (second). With only the firewall layer, one mistaken rule exposes everything.
| Thing | How |
|---|---|
| System updates | At minimum enable automatic security updates. An unpatched machine makes the firewall moot |
| Log rotation | Previous page: day one, or the disk fills eventually |
| Know who logged in | Glance at the login records occasionally. No monitoring stack needed — just look |
You will open another box eventually — new provider, new region, or because this one died. At that point this note is worth far more than the ten minutes it cost.
One discipline while writing: steps only, no secrets and no real addresses. The note will likely end up in your backup, possibly in a repository. Write the variable parts as placeholders and substitute when using it — which is also the starting point for page 22's "rebuild in one command".