server-hardening

Harden Linux server security with firewalls, SSH lockdown, and automated updates for Kamal deployments.

Updated Jun 30, 2026

Search Tags:#security #linux #ssh #firewall #kamal #hardening

Ready to run

npx skills add https://github.com/donnfelker/kamal-skills --skill server-hardening

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: server-hardening
Source: https://github.com/donnfelker/kamal-skills/tree/main/skills/server-hardening
Command: npx skills add https://github.com/donnfelker/kamal-skills --skill server-hardening

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill addresses the complexity of securing Linux servers hosting Kamal deployments by automating security updates, firewall configuration, and SSH hardening without locking out the deployment agent.

Core Features & Use Cases

Automated Security: Configures unattended security updates and fail2ban to mitigate common attack vectors.
Safe Hardening: Provides a guided, interview-based workflow to lock down SSH and firewall ports while ensuring Kamal retains necessary access.
Use Case: Use this before moving a new application to production to audit existing security settings and apply industry-standard hardening practices with built-in rollback capabilities.

Quick Start

Run the server hardening skill to audit the current security posture of your production server and apply recommended lockdown measures.

Frequently Asked Questions about server-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I harden SSH and configure a firewall for a Linux server without locking out my deployment agent?▼

This skill hardens Linux server security by configuring firewalls, SSH access, and automated updates specifically for Kamal-managed environments to minimize attack surfaces while maintaining essential deployment agent connectivity.

What is the best way to automate security updates and fail2ban on production Linux servers?▼

Automating security updates and fail2ban on production Linux servers involves configuring unattended upgrades and intrusion prevention through a non-destructive hardening process that retains rollback capabilities.

Can I audit my existing server security posture before applying production hardening changes?▼

Yes, you can audit existing security settings before applying changes by running a non-destructive assessment that evaluates your current posture and recommends industry-standard lockdown measures.

Do I need standard Linux system utilities and bash to configure Kamal server hardening?▼

Yes, configuring Kamal server hardening requires bash, SSH, and standard Linux system utilities to perform non-destructive audits and apply security configuration changes to the production infrastructure.

When should I not use automated hardening scripts on my deployment infrastructure?▼

You should avoid automated hardening scripts without rollback capabilities when your deployment infrastructure requires maintaining specific open ports for Kamal agents, as unsafe lockdowns can sever essential connectivity.