@teratology @amanda

> What would you do to secure a base random OS install on a VPS or home server?

This is a really broad question.

> Turn everything off, key-only login.

That, plus kill anything that tries to log in. People like fail2ban, I just use awk scripts.

> I know doas is preferred over sudo as well.

Not materially different. The problem with Unix is there's a root anyway.