Hardening de VPS Ubuntu: checklist completo

# Atualizar tudo imediatamente
apt update && apt upgrade -y && apt autoremove -y

# Instalar unattended-upgrades
apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

# Verificar configuração
cat /etc/apt/apt.conf.d/20auto-upgrades
# Deve conter:
# APT::Periodic::Update-Package-Lists "1";
# APT::Periodic::Unattended-Upgrade "1";

# Testar
unattended-upgrade --dry-run --debug | head -20

# Criar usuário de administração
adduser deploy
usermod -aG sudo deploy

# Copiar chave SSH do root para o novo usuário
mkdir -p /home/deploy/.ssh
cp ~/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

# TESTE O LOGIN EM OUTRO TERMINAL ANTES DE CONTINUAR
# ssh deploy@IP_DA_VPS

# Desabilitar root via SSH
sed -i 's/^PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl reload sshd

apt install -y ufw

ufw default deny incoming
ufw default allow outgoing

# Liberar SSH ANTES de ativar
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp

# Ativar
ufw enable
ufw status verbose

cat >> /etc/ssh/sshd_config << 'EOF'

PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
MaxSessions 5
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy
X11Forwarding no
AllowAgentForwarding no
EOF

sshd -t && systemctl reload sshd

apt install -y fail2ban

cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true
port = ssh
maxretry = 3
bantime = 86400
EOF

systemctl enable --now fail2ban

# Verificar estado do sistema
ss -tlnp          # portas abertas
last -n 10        # últimos logins
lastb | head -10  # tentativas falhas