Here's my checklist (some of these are the default on Ubuntu): - disabled root account password - ssh rejects root, allows only key-based auth, listens on

Here's my checklist (some of these are the default on Ubuntu): - disabled root account password - ssh rejects root, allows only key-based auth, listens on non-standard port - fail2ban is installed and active - firewall is enabled and all ports are "closed" by default