## Base

- ssh hardening
- fail2ban
- autoupdate

## User and Groups

- Group: `sftpusers`
- User: `sftpuser` (default) (`sudo useradd -G sftpusers -s /sbin/nologin sftpuser`)
- Path: `/home/sftpuser` for user key file

## Notes

- each user needs pub keys set in its home path `/home/<user>/.ssh/authorized_keys`
- each user will be logged on to the sftp path `/sftp`
- the default `sftpuser` has as shell `/sbin/nologin` so that it can not login via ssh
- each user needs to be in the group `sftpusers` for sftp access.
- users in the `sftpusers` group can not login via ssh
- created group `admins` for ssh access. Only via Pub Key auth