VPS Security Enhancement Scripts — Harden Your VPS from First Login to Incident Response
Test Report: This release passed a full aviation-grade test (126 tests, Docker Ubuntu 22.04, 100% pass rate after 3 bug fixes). See the Test Report for details.
Changelog (2026-09-02): 3 bugs found and fixed during v4.0.0 full test:
bigdata_security_audit.sh: removed unused SECTION_FILTER variable (SC2034)stig_compliance_check.sh: fixed printf %d receiving dual output from grep -c || echo 0 (invalid number error in severity breakdown)cis_benchmark_audit.sh: fixed JSON report invalid due to unescaped control characters (newline/tab/CR) in evidence and desc fields
A security-first interactive bash script for VPS hardening, with a scenario-driven handbook and cheatsheets included. One script, zero dependencies, one command to start — plus a real handbook that tells you why, not just how.
This is a living repo: the script and handbook expand by security direction over time. The current release ships a 3200-line interactive script + 20-chapter handbook + 4 cheatsheets. Future iterations add more depth per layer.
Quick Start
wget -O vps_security_enhance.sh https://raw.githubusercontent.com/0x10debug/vps-security-enhancement-scripts/main/vps_security_enhance.sh && chmod +x vps_security_enhance.sh && ./vps_security_enhance.sh
On a fresh server, select a1 Full Security Init — completes in ~10 minutes: system update → firewall → BBR → swap → Fail2Ban → kernel hardening.
After installing the global command, type secure-vps from anywhere to launch.
What It Does
The script (vps_security_enhance.sh) is organized by security layers, not by ops workflow:
| Zone |
Layer |
Features |
| A · Quick |
— |
Full security init (update + firewall + BBR + swap + Fail2Ban + kernel) |
| B · Access Security |
L4 Network |
SSH hardening, firewall (UFW/Firewalld), intrusion ban (Fail2Ban + CrowdSec with iptables/nginx/Cloudflare bouncers) |
| C · Defense in Depth |
L0-L3 |
Baseline scan, kernel hardening, audit & integrity (auditd/AIDE/Rkhunter/Lynis), password & access control |
| D · Secure Ops |
— |
Container security (Docker/Portainer/Watchtower/1Panel), security monitoring (Uptime Kuma), network diagnostics, system tools |
| E · Incident & Recovery |
L6 Detection |
Emergency triage (compromise check, login history, suspicious cron), forensic triage collection (read-only, evidence chain), performance & resource (BBR/swap/bench) |
| Z · Maintenance |
— |
Global command, self-update |
Security Layer Roadmap
The 7-layer architecture (L0 → L6) guides the iteration plan. Each layer maps to dedicated scripts and handbook chapters added over the 9-day iteration cycle:
| Layer |
Scope |
Status |
| L0 |
Compliance audit (CIS Benchmark, STIG) |
CIS + STIG audit scripts added |
| L1 |
Container & Kubernetes security |
Docker audit + Dockerfile hardener + K8s audit + runtime security (Falco/Tetragon) added |
| L2 |
Cloud platform CIS baselines (AWS/GCP/Azure) |
AWS + GCP + Azure CIS baseline audit added |
| L3 |
Data security (database hardening, big-data SSL/audit) |
Database hardening + Big data SSL setup + Big data security audit added |
| L4 |
Network & perimeter (zero-trust, WAF) |
Zero trust (WireGuard + Headscale) + WAF (Coraza + CRS v4) added |
| L5 |
Key & certificate security (TLS lifecycle, secret scanning) |
TLS lifecycle (acme.sh, 29 DNS providers, ECC+RSA, auto-renew, deploy hooks, monitoring) + Secret scanning (gitleaks + trufflehog, git history, CI integration) added |
| L6 |
Detection & response (CrowdSec, incident triage) |
CrowdSec deployment (install, scenarios, iptables/nginx/Cloudflare bouncers, email/webhook/Slack/Discord alerts, hub management, 15-check audit) + Incident triage forensic collection (read-only, order-of-volatility, evidence chain, 16-check audit, tar.gz archive + manifest) added |
See dev-docs/0015 for the full branch strategy.
Security Design
Three Iron Rules (built into the script)
- Snapshot → Validate → Rollback: Before modifying
sshd_config / daemon.json / sudoers, a timestamped snapshot is saved. Before restarting services, sshd -t / visudo -cf validation runs. If validation fails, automatic rollback — never locks you out.
- Linkage Consistency: When changing SSH port, Fail2Ban ban port is automatically synced. Rollback is also linked.
- Read-Only First: Scans and audits never modify the system. All destructive operations require confirmation.
Supply Chain Audit
| Risk Area |
Status |
Notes |
| Hardcoded secrets |
✅ Clean |
No passwords, keys, or IPs hardcoded |
| External script execution |
⚠️ Documented |
Docker install (get.docker.com), CrowdSec install, YABS, bench.sh, NextTrace, IPQuality, Fusion Monster — all from official sources, all require user confirmation |
eval usage |
✅ Safe |
Only used for package manager commands (eval "$PKG_INSTALL foo") — no user input reaches eval |
rm -rf usage |
✅ Guarded |
Only in Docker uninstall, requires double confirmation |
| Self-update mechanism |
✅ HTTPS |
Downloads from GitHub raw over HTTPS |
| Input validation |
✅ Present |
All interactive inputs validated before use |
| shellcheck |
✅ Clean |
Zero warnings at -S warning level |
Handbook (Included)
21 scenario-driven chapters organized by security layer. Each follows "Problem → Investigate → Fix → Verify":
| Chapter |
Topic |
Security Angle |
| 01 |
First Login Security |
First 30 minutes: assessment & hardening |
| 02 |
Security Baseline |
SSH, firewall, Fail2Ban/CrowdSec, kernel, Docker UFW bypass, password policy |
| 03 |
Incident Response |
"I've been hacked" first 10 minutes, compromise detection, recovery |
| 04 |
Security Monitoring |
TLS expiry, SSH unreachable, intrusion detection, log management |
| 05 |
Backup Security |
Backup as a safety net: credential protection, recovery drills |
| 06 |
Container Security |
Docker UFW bypass, isolation, resource limits |
| 07 |
Network Security Diagnostics |
Firewall, TLS, IP quality troubleshooting |
| 08 |
Resource Security |
Resource exhaustion defense, crypto performance |
| 09 |
CIS & STIG Compliance |
Automated compliance audit against CIS Benchmarks and DISA STIG |
| 10 |
Container Security Audit |
CIS Docker Benchmark audit + Dockerfile hardening (18 rules, auto-fix, SARIF) |
| 11 |
Kubernetes Security Audit |
CIS Kubernetes Benchmark audit (60+ checks, control plane + worker + policies + workload) |
| 12 |
Runtime Security |
Falco + Tetragon eBPF-based runtime detection and enforcement |
| 13 |
Cloud CIS Baseline |
AWS + GCP + Azure CIS Foundations Benchmark audit (40+ checks per provider) |
| 14 |
Database Hardening |
MySQL + PostgreSQL + Redis + MongoDB CIS benchmark audit + hardened config generation |
| 15 |
Big Data Security |
Hadoop/Kafka/HBase/Cassandra SSL/TLS setup + Hadoop/Spark security audit |
| 16 |
Network Zero Trust |
WireGuard + Headscale mesh VPN, ACL policy, CrowdSec integration, GeoIP filtering |
| 17 |
WAF Deployment |
Coraza + OWASP CRS v4, Caddy/Nginx/HAProxy integration, rule tuning, false positive handling |
| 18 |
TLS Automation |
acme.sh lifecycle management, DNS-01 vs HTTP-01, 29 DNS providers, ECC/RSA, auto-renew, deploy hooks, monitoring |
| 19 |
Secret Management |
gitleaks + trufflehog scanning, git history audit, CI/pre-commit integration, key leak emergency response |
| 20 |
CrowdSec Deployment |
CrowdSec vs fail2ban, engine + bouncer + scenario architecture, iptables/nginx/Cloudflare bouncers, email/webhook/Slack/Discord alerts, centralized console, 15-check audit |
| 21 |
Incident Response & Forensics |
NIST incident lifecycle, forensic triage methodology, order of volatility, evidence chain of custody, containment strategies, post-incident analysis |
Cheatsheets
5 one-page printable reference cards:
| Cheatsheet |
Content |
| security-commands.md |
Security-related command quick reference |
| container-security-commands.md |
Container security commands |
| systemd-commands.md |
Service management, journalctl, targets, timers |
| security-troubleshooting-tree.md |
7 decision trees: SSH fail, service unreachable, disk full, high CPU, container fail, slow website, suspicious activity |
| forensics-commands.md |
Forensic triage: process, network, filesystem, log, memory, persistence, evidence collection |
Script vs Modular: Which to Use?
| Need |
Use |
| Quick start, one command, menu-driven |
vps_security_enhance.sh (this repo) |
| Modular, CLI-driven, per-module control |
vps-bootstrap |
| CIS benchmark audit, drift detection |
security-audit |
Both vps_security_enhance.sh and vps-bootstrap cover SSH/firewall/Fail2Ban/kernel hardening — they're two entry points to the same capability. The script is for "I just want it done", the modular tools are for "I want to control each step and integrate with other tools".
System Requirements
- Ubuntu 20.04+ / Debian 10+ / CentOS 7/8 / AlmaLinux / Rocky Linux
- Root access, recommended on a clean system image
- Benchmark and speed tests generate significant network traffic
Credits
Benchmark and detection capabilities use: YABS · bench.sh · NextTrace · Fusion Monster · IPQuality · Lynis · Endlessh. Intrusion detection integrates CrowdSec. App deployment uses Docker and 1Panel official scripts.
- Contributing — how to report bugs, propose scripts or handbook chapters, and what CI requires
- Code of Conduct — Contributor Covenant v2.1
- Issues — bug reports and feature requests (templates provided)
- Pull Requests — PR checklist mirrors the CI gates (bash -n, strict shellcheck, gitleaks, no-Chinese policy)
License
MIT © 2026 0x10debug
它是一个安全优先的交互式 bash 脚本，用于加固全新的 VPS 或云服务器，并附有一本场景驱动手册和可打印的速查表，解释每项修复为什么重要，而不只是怎么运行。