Security

Fail2ban — ban status

fail2ban-client status               # list active jails
fail2ban-client status sshd          # detail for one jail
fail2ban-client set sshd unbanip X.X.X.X   # unban an IP

Firewall

ufw status verbose       # show all rules
ufw allow 8080/tcp       # open a port
ufw delete allow 8080    # close it again

Client isolation summary

SFTP   : chroot to /var/www/clients/<client> — cannot escape
PHP    : FPM pool per client, open_basedir enforced
MySQL  : dedicated user, single database — no cross-client access
Shell  : login shell is /usr/sbin/nologin — no interactive access

SSH hardening (applied)

PasswordAuthentication yes (for ubuntu admin)
PermitRootLogin        prohibit-password
ClientAliveInterval    30 (keepalives for poor connections)
SFTP clients           ForceCommand internal-sftp, no TCP forwarding

Check for listening services

ss -tulpn

View auth failures

journalctl -u sshd -n 50 --no-pager
journalctl -u postfix -n 50 --no-pager