>should I use PSAD or CrowdSec? Use a free solution, never used these. Are they even current? -ssh is a way to access the server (pub key is preferred way)

>should I use PSAD or CrowdSec? Use a free solution, never used these. Are they even current? -ssh is a way to access the server (pub key is preferred way) -ufw is a frontend to iptables -fail2ban blocks based on regex rules. (needs tweaking) For web, you'll need port 80, 443 open, and a port for ssh, default is 22. I would change ssh port to something higher as there are many bots that scan all of these known ports. Monitor your logs, and check for activity. access.log, syslog etc.