How to increase the security of vds server?

Question

linux

Good day. The question concerns the server setup itself. I have a server on Ubuntu 16. Authorization via ssh - only by keys, without a password; access for root is closed; the port for connecting via ssh/sftp has been changed; password access is closed; ufw firewall works. What else can I do to maximize the security of my server? Is it possible and difficult at the current level of security to hack the server and gain access to the data on it?
Please give advice on how to reduce the chance of hacking to zero.

Answer 1

taking into account the fact that hacking almost always goes through the application and not ssh, protect it
with me for 10 years and thousands of servers have never picked up a complex password or key with ssh,
changing the port for ssh only creates inconvenience for yourself

Answer 2

Fail2ban and other brute force protections. Protecting the VDC itself is half the battle, it is important to protect the service that runs on it.

Answer 3

It is very easy to reduce the chance of hacking to zero. Raise the server at home / in the office, turn off the Internet - profit!
And so: a) firewall rules should allow administrative access only to admins, that is, filtering by ip at least, I would raise vpn for such purposes, b) fail2ban is a good thing, c) checking the input data on the service.
+ Never forget about backup.

Answer 4

Is it possible and difficult at the current level of security to hack the server and gain access to the data on it?

Whom to puzzle. Depends on the level of a particular specialist.
Ask to test your server on this forum . Get a detailed analysis, possibly with further recommendations.

Answer 5

I advise you to familiarize yourself with this: https://xakep.ru/2014/10/02/paranoid-linuxoid/
Also configure or block dns, as the Chinese love these ports.
It is better to change ports that look outward, because the Chinese brute force the standard ports on the machine, and this is extra traffic and load.
You can deploy a meerkat on the server to visually see the incoming traffic to the server.

Answer 6

Maximum? Hire the most intelligent administrator.