What are useful guidelines for Craft CMS security on VPS (virtual private servers)?
This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there. 

Their instructions are tilted towards Ubuntu as far as specifics, but should fit for any Linux VPS.

Recording the links here so we don't lose the patterns. I agree with them because they're actually the same as what I came up with personally in arranging VPS security, and they say what's needed clearly and concisely.

https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers

and to complete on automatic security updates, 

https://blog.mafr.de/2015/02/26/ubuntu-unattended-upgrades/

IT's quite worth reading the comments also on each of these, particularly the second. I like the so-often Germanic completeness there, if would suggest that auto-reboot is not just for personal servers. 

You can control time-of-day via the auto-cron setting, and if you need 100% uptime, this is very likely better managed (and likely only actually possible for many scenarios) by providing more than one load-balanced server, updating them in a sequence, which again the cron portion could be one way of handling.