Linux VPS Hardening Script

A comprehensive Ubuntu server hardening script by Terra Consults.

Features

• System updates — Upgrades all packages before hardening begins
• Kernel hardening — Applies secure sysctl parameters (ASLR, BPF JIT hardening, restricted dmesg, etc.)
• Firewall (UFW) — Configures deny-by-default ingress; allows SSH, HTTP, and HTTPS
• Fail2Ban — Protects SSH with incremental banning (3 retries, 24 h ban, doubles on repeat offenders)
• SSH hardening — Prompts for a custom SSH port and optionally disables root login with a new sudo user
• Docker — Installs Docker CE from the official Docker repository
• Audit logging — Deploys auditd rules tracking privileged commands, auth events, and file changes
• AppArmor — Ensures AppArmor is installed and active
• Password policy — Enforces strong passwords via libpam-pwquality (min 12 chars, mixed character classes)
• Log retention — Configures journald, auditd, and logrotate with consistent weekly rotation
• Unattended upgrades — Enables automatic security updates
• Uncommon kernel modules disabled — Blocks dccp, sctp, rds, tipc, and USB mass storage
• Legal login banner — Sets /etc/issue and /etc/issue.net
• Lynis audit — Runs an initial system audit report at the end

Requirements

• Ubuntu (any supported LTS release)
• Root or sudo access

Usage

sudo bash harden-vps.sh

The script is interactive — it will prompt for:

1. A new SSH port
2. Whether to disable root login (and a new sudo username if so)

Notes

• /tmp noexec is intentionally skipped to maintain compatibility with Docker builds.
• Port 22 is kept open alongside your custom SSH port during setup. You can remove it manually once you have confirmed access on the new port.
• After the script completes, test SSH access in a new terminal before closing your current session.

License

MIT