[mschuster91]

Random addition: disable root SSH login, disallow password-based SSH login (switch to private key), maybe also add two-factor SSH authentication e.g. with a hardware key, or Google Authenticator or whatever.

[mnkypete]

Thanks to all, I guess I'll stick to these basics first!