24-Hour Hack Risk Window
If you get a new dedicated server and leave default settings, you'll see the first brute force attack within 8 hours on average.
First 24 hours are critical. Follow this checklist:
Hours 0-2: Basic Security
1. Change root password (16+ chars). 2. Change SSH port (22 → custom, e.g., 2244). 3. Enable SSH key-based auth, disable password auth.
Hours 2-6: Firewall and Network
4. Configure UFW firewall. 5. Install Fail2ban (3 failed attempts = 1-hour ban). 6. Verify DDoS protection active (EuroVDC includes DDoS on all dedicated servers).
Hours 6-12: System Hardening
7. Disable unnecessary services (telnet, FTP). 8. Enable auto security updates (unattended-upgrades). 9. Install SSL certificate (Let's Encrypt).
Hours 12-18: Monitoring & Backup
10. Set up log monitoring (logwatch → corporate email). 11. First full backup (offsite copy mandatory). 12. Configure uptime monitoring (5-min ping, SMS alert).
Hours 18-24: Advanced
Bonus: 2FA for SSH, AIDE intrusion detection, SELinux/AppArmor enforce mode.
Test: Run Lynis audit, hardening index should be 85+.
Common Mistakes: "I'll do it later" (10x harder to fix), using root for production (create sudo user), single backup copy (offsite + local required).
EuroVDC support team can help with domain + SSL + VPN setup on dedicated servers.