How to secure a server after gaining root access via SSH?

After gaining root access via SSH, it is important to take immediate measures to protect the server:

1. Change the root password to a strong and unique one.
2. Restrict SSH access:
   • Disable direct root login (PermitRootLogin no in /etc/ssh/sshd_config).
   • Use SSH key authentication instead of passwords.
   • Limit access by IP (through firewall or SSH settings).
3. Update the system and install security patches.
4. Configure a firewall (e.g., ufw, iptables) to restrict incoming connections.
5. Install and configure intrusion detection and monitoring tools (e.g., fail2ban).
6. Check and restrict user and service permissions.

Example of disabling root login via SSH:

sudo nano /etc/ssh/sshd_config
# Find the line PermitRootLogin and change it to:
PermitRootLogin no
sudo systemctl restart sshd

These measures will help minimize the risks of server compromise after gaining root access.