Would it be a good idea to change the name of the root account to
something completely random that only I would know? As most attempts
are being made on the root user, having the username is half the
battle won already? Is this a good or bad idea?
For the OS, a much more secure solution would be to not allow root any SSH access at all. You should login as an unprivileged user that has the ability to su or sudo. Also all ssh access should be by private key, not passwords.
If you're interested in reducing the amount of traffic that comes through from these cracking attempts you can run ssh on a non standard port (this isn't a security measure, but it is an effective method of staying under the radar and keeping some unwanted traffic from ever hitting your machine).
Also, you can use a service like http://www.fail2ban.org/ that will monitor failed login attempts and ban IPs.
For application level access (things like CMSs etc) it's nice if you can stay away from default urls (like /admin or /administrator) and run off non-standard ports keeps you off the radar somewhat. Those don't increase security but once again can shift a lot of traffic away from those areas.
Security wise steering clear of default username (admin/root etc) and default passwords is a good idea. Also with CMS/Application logins, restricting I.P and using methods similar to fail2ban are a good idea.
Regarding ports: Should I be closing ports for FTP and SSH and only
opening them when I want to connect to the server myself, is this
something that is normally done? Is there also any way of restricting
SSH connections to a single IP and only allowing one connection at a
- Restricting access to specific IPs is a good idea
- If you were paranoid you could open ports only when you needed to use them, however this could be inconvenient to implement
- You can restrict access to the port SSH runs on through your firewall
- You can restrict access to the SSH service via sshd_config, something like AllowUsers user@ip