I'm not the best person at this, but I do the following on any machine I deal with which does not sit behind a firewall: 1. Disable root logins via ssh (as not

I'm not the best person at this, but I do the following on any machine I deal with which does not sit behind a firewall: 1. Disable root logins via ssh (as noted above by bbb). 2. Move ssh port from port 22 to something nonstandard. According to my logs, the number of idiots who try brute-force attacks on my machines dropped from 4/day to 0. 3. Put an iptables script into /etc/init.d and make sure it runs on startup at the normal multiuser run levels (on Debian, the command is something like /sbin/update-rc.d, but I don't remember exactly). I looked into more sophisticated firewall packages which generate iptables rules, but found them rather complicated, and probably overkill (YMMV). I essentially blocked all incoming traffic except on the nonstandard ssh port and ports 80 and 443. Services which use ports other than 80, 443, and ssh should run on a privately routed network, or, at minimum, on a separate network interface with draconian access rules. iptables is pretty easy to use once for this stuff you get the hang of it.