```
# Command to see if someone is trying to gain access to you server over SSH.
    tail -n 10 -f /var/log/auth.log

# Update your system
    sudo apt update && sudo apt upgrade -y      #Update and Update your system

# Change Root Password - Need to be in the system as root.
    sudo su
    passwd

#Create New User
    sudo useradd -m -s /bin/bash miker && sudo passwd miker #you will be prompted to enter in the password
        # -m creates a home account and -s sets the shell you will be using

# Add QEMU agent if on Proxmox
    sudo apt install qemu-guest-agent -y

# Add new user to the groups
    sudo cat /etc/sudoers to see what the admin and sudo groups are    # THey are typically %admin and/or %sudo
        sudo usermod -aG sudo, adm, admin, docker (username)    #add user to admin or sudo group.
        groups (username) # verify your account was added

# Ensure unattend upgrades is installed
    sudo apt install unattended-upgrades
    sudo dpkg-reconfigure --priority=low unattended-upgrades  #set the install to unattended
    sudo nano /etc/apt/apt.conf.d/50unattended-upgrades   # Edit file to add additional unattended upgrade features
        uncomment the -updates line, to recieve all pckage upgrades as well.

# Timezone
    Update timezone in Ubuntu servers.
        sudo dpkg-reconfigure tzdata

# Set up Secure SSH Keys and Passwords
    cd ~/.ssh && ls -a          # Go into your ssh directory and ensure that you have a id_rsa.pub on your workstation.
    ssh-copy-id <username>@ip_address   # Copy your public key to your server

# Use ONLY if you need to create a new keygen
    ssh-keygen -t rsa  # run in your home directory

#Lock down server access through SSH
    sudo nano /etc/ssh/sshd_config           # This is your sshd server system-wide configuration file
        PasswordAuthentication yes      # Change to no, this will disable SSH password authentication.
        PermitRootLogin yes             # Change to no, this will Disable remote root access, stop users from signing into your server.
        AllowUsers (Your username you created)
        AddressFamily inet              # This will disable IPv6 access

    sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
        PasswordAuthentication yes      # Change to no, this will disable SSH password authentication.

    clear          # Restart your ssh service
        Leave your current window open and launch a new terminal window to ensure you can get into the system.

# Enable additional security features


# Set Up UFW Firewall within the server if the VPS provide does not offer one.

    sudo ss -tualp                      # show which ports are open on your server (needed if you plan to use UFW)
    sudo apt install ufw                # Install the UFW firewall
        sudo ufw allow ssh              # Add to allow port 22 within your firewall
        sudo ufw allow http             # add to allow port 80 within your firewall
        sudo ufw allow https            # Add to allow port 443 within your firewall
    # use the same command to add other ports that will be needed.

    sudo ufw enable                     # When complete, use this command to enable the firewall.
                                        # If you need to, use this command to disable "sudo ufw disable" to deactivate the firewall if necessary.
# Install Fail2ban
    # This server log application will automatically adjust your firewall to block an attacker’s IP address if it identifies any signs of an attack.
        # Those blocks can stay in place permanently or for a period of your choosing.

    sudo apt install fail2ban -y        # Use this command to install Fail2ban:
    sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local  # configuration file code:
    sudo service fail2ban restart     # restart the application to start running
    sudo fail2ban-client status sshd
```