sudo apt install -y ufw fail2ban unattended-upgrades curl htop

One-shot bootstrap install of the core hardening stack: ufw (the uncomplicated firewall), fail2ban (an auto-banning intrusion guard for brute-force attacks), unattended-upgrades (automatic security patches), plus curl and htop for diagnostics. Each ships with sane defaults so you can enable them one by one. This keeps the later setup steps to configuration only.