In the past I was following a guide which I probably got from a Digital Ocean blog post (they have a lot of very good instructive guides). It eliminated passwo

In the past I was following a guide which I probably got from a Digital Ocean blog post (they have a lot of very good instructive guides). It eliminated password ssh logins (cert only), and I think it changed the default port (which I do always, just to cut out the lowest quality script kiddies). As I recall, it also changed some permissions on shared memory via fstab. And it did something regarding sudo or suid... I forget now. I also setup ufw firewall so at least I only allow incoming request to the specific services I intend to offer. All that said, my nginx logs would be full of sh*t from wordpress-related vulnerability scanners and whatnot, and it just personally offended me. I think I did try to setup fail2ban, but I don't recall the success of that. At this point it seems like there should be a "wizard" (not so unlike a linux console installation process) which asks you questions and adjusts configuration accordingly.