My checklist to secure a VPS, enforced by an Ansible playbook.

* Disable SSH root login

* Disable password login and use only certificates

* Enable fail2ban

This have been worked for more than ten years and never been hacked.

I never understand the need for port knocking.