A freshly provisioned server starts receiving SSH probes within minutes of its IP going live; honeypot studies show most exposed machines are attacked within a day. The good news: the defences that matter are a short, boring, one-hour checklist, not a security research project. This guide walks the eight steps in order (users and SSH keys, firewall baseline, automatic updates, fail2ban, time sync, a listener audit, and logging) with the exact commands for Debian/Ubuntu and the RHEL family, plus an honest list of what not to waste your first hour on.