What is this?
It is a security-first interactive bash script for hardening a fresh VPS or cloud server, bundled with a scenario-driven handbook and printable cheatsheets that explain why each fix matters, not just how to run it.
It is a security-first interactive bash script for hardening a fresh VPS or cloud server, bundled with a scenario-driven handbook and printable cheatsheets that explain why each fix matters, not just how to run it.Is this just a script, or is there more to it?It is three things in one release: a 3200-line interactive bash script, a chapter-based handbook, and a set of cheatsheets, and the project grows all three over time as new security layers are added.
It is three things in one release: a 3200-line interactive bash script, a chapter-based handbook, and a set of cheatsheets, and the project grows all three over time as new security layers are added.How do I get it running on my server?On a fresh server, run the script and pick menu option 'a1 Full Security Init', which finishes in about 10 minutes covering system update, firewall, BBR, swap, Fail2Ban and kernel hardening. After installing the global command once, you can just type secure-vps to launch it again from anywhere.
On a fresh server, run the script and pick menu option 'a1 Full Security Init', which finishes in about 10 minutes covering system update, firewall, BBR, swap, Fail2Ban and kernel hardening. After installing the global command once, you can just type secure-vps to launch it again from anywhere.Do I need to install anything before running it?No, the script is designed with zero dependencies — you just need root access on a supported Linux distro; everything the script needs (Docker, CrowdSec, etc.) is only pulled in on demand when you choose those features.
No, the script is designed with zero dependencies — you just need root access on a supported Linux distro; everything the script needs (Docker, CrowdSec, etc.) is only pulled in on demand when you choose those features.Could hardening SSH settings lock me out of my own server?The script is built to avoid that: before touching files like sshd_config, daemon.json or sudoers it saves a timestamped snapshot and validates the change (sshd -t, visudo -cf) before restarting any service, rolling back automatically if validation fails.
The script is built to avoid that: before touching files like sshd_config, daemon.json or sudoers it saves a timestamped snapshot and validates the change (sshd -t, visudo -cf) before restarting any service, rolling back automatically if validation fails.Which operating systems does it support?Ubuntu 20.04+, Debian 10+, CentOS 7/8, AlmaLinux, and Rocky Linux, run with root access, ideally on a clean system image.
Ubuntu 20.04+, Debian 10+, CentOS 7/8, AlmaLinux, and Rocky Linux, run with root access, ideally on a clean system image.How is this different from the author's vps-bootstrap tool?This script is the 'menu-driven, I just want it done' entry point covering SSH, firewall, Fail2Ban and kernel hardening in one run, while vps-bootstrap is a modular CLI for controlling each step separately and integrating with other tooling.
This script is the 'menu-driven, I just want it done' entry point covering SSH, firewall, Fail2Ban and kernel hardening in one run, while vps-bootstrap is a modular CLI for controlling each step separately and integrating with other tooling.What does the included handbook actually cover?21 scenario-driven chapters following a Problem → Investigate → Fix → Verify format, spanning first-login security and incident response up through Kubernetes audits, cloud CIS baselines, TLS automation, and CrowdSec deployment.
21 scenario-driven chapters following a Problem → Investigate → Fix → Verify format, spanning first-login security and incident response up through Kubernetes audits, cloud CIS baselines, TLS automation, and CrowdSec deployment.What is the long-term roadmap for this project?It follows a 7-layer plan (L0 compliance audits through L6 detection and response), adding scripts and handbook chapters for containers, cloud CIS baselines, databases, zero-trust networking, TLS/secret management, and incident forensics over time.
It follows a 7-layer plan (L0 compliance audits through L6 detection and response), adding scripts and handbook chapters for containers, cloud CIS baselines, databases, zero-trust networking, TLS/secret management, and incident forensics over time.Will running an audit or scan ever change my system?No — scans and audits are strictly read-only by design, and any destructive action, like the Docker uninstall path, requires an explicit double confirmation before it runs.
No — scans and audits are strictly read-only by design, and any destructive action, like the Docker uninstall path, requires an explicit double confirmation before it runs.What are similar projects?wazuh, acme.sh, ProxmoxVE, lynis, azerioid-stack-manager, prowler, kubeshark, openvpn-install
wazuh, acme.sh, ProxmoxVE, lynis, azerioid-stack-manager, prowler, kubeshark, openvpn-installWhich topics is it in?security-hardening, incident-response, compliance, vps, network-security, bash, tls, sysadmin, cybersecurity, security-tools, shell, kubernetes
security-hardening, incident-response, compliance, vps, network-security, bash, tls, sysadmin, cybersecurity, security-tools, shell, kubernetes