skills.rest
thefear078
thefear078COMMUNITY
Explore all skills by this author →
𝕏@thefear078GitHub

harden-vps

Harden Ubuntu and Debian VPS servers through phased SSH, firewall, and monitoring configuration.

15|3|Updated Jul 9, 2026
Search Tags:#docker#ssh#fail2ban#server audit#linux security#vps hardening#ufw firewall
One-click install
npx skills add https://github.com/thefear078/cursor-kit-for-ai --skill harden-vps-thefear078
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: harden-vps
Source: https://github.com/thefear078/cursor-kit-for-ai/tree/main/plugins/security/skills/harden-vps
Command: npx skills add https://github.com/thefear078/cursor-kit-for-ai --skill harden-vps-thefear078

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? New or running Linux servers ship with insecure defaults — password SSH logins, open ports, unpatched packages, and Docker containers that silently bypass the firewall. This Skill provides an ordered, dependency-aware hardening workflow so you lock down access before anything else and never lock yourself out. ## Core Features & Use Cases - Phased Hardening Workflow: Five ordered phases covering SSH access, UFW firewall rules, attack surface reduction, application-layer controls, and detection/recovery. - Docker Exposure Trap Detection: Identifies the common mistake where docker run -p bypasses UFW, with loopback binding fixes and external nmap verification commands. - Audit Mode for Existing Servers: Runs the phases as read-only checks with triage commands for public listeners, SSH config, failed logins, and pending security updates. - Use Case: You just provisioned an Ubuntu VPS to host a Dockerized SaaS app. Follow the phases to create a deploy user, disable password auth, configure UFW, bind database ports to loopback, and set up fail2ban and monitoring before going live. ## Quick Start Ask the AI to harden your new Ubuntu VPS for production, starting with SSH key-only access and a default-deny firewall, and to verify open ports from outside afterward.

Frequently Asked Questions about harden-vps

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a new Ubuntu VPS for production?▼

Secure a new Ubuntu VPS in dependency order: create a sudo deploy user with SSH keys, disable password and root login in sshd_config, enable UFW with default-deny incoming, install unattended-upgrades and fail2ban, then verify open ports externally with nmap before disconnecting.

Why does Docker bypass UFW firewall rules?▼

Docker writes its own iptables rules, so `docker run -p 5432:5432` exposes the port publicly even when UFW denies it. Fix this by binding ports to loopback in compose files ("127.0.0.1:5432:5432") or removing `ports:` and relying on the internal compose network.

How do I audit an existing Linux server for security issues?▼

Audit an existing server by listing public listeners with `ss -tlnp | grep -v 127.0.0.1`, checking SSH password and root login settings, reviewing UFW status and Docker iptables rules, inspecting recent logins with `last` and `lastb`, and listing pending security updates with apt.

What should I do after a suspected server compromise?▼

After a suspected compromise, do not clean the box in place. Snapshot it for forensics, rotate every credential the server held, rebuild from scratch, and restore data from tested backups, since cleaning against a competent attacker is unreliable.

Should I change the default SSH port for security?▼

Changing the SSH port only reduces log noise from scanners; it is not a real security control. Key-only ed25519 authentication with disabled password login provides the actual protection, and SSH behind WireGuard or Tailscale is a stronger option for admin-only reachability.

Related Skills

Explore More Software Engineering Skills→
mikr13mikr13
6

ssh-hardening

Harden SSH on Linux VPS servers by enforcing key-based authentication and disabling root login.

Community
Advanced
jtucker9jtucker9

hetzner-setup

Provision Hetzner Cloud servers with SSH hardening, Docker, Caddy, and backups.

Community
Advanced
kiurakkukiurakku
15

waf-review

Review Cloudflare WAF rules, rate limits, bot management, and origin exposure for edge security gaps.

Community
Intermediate
baphledbaphled
1

virtual

Provision and manage VPS instances across DigitalOcean, Linode, Hetzner, and Vultr.

Community
Intermediate