SERVER HARDENING

One-line hardening for Ubuntu servers — built for Kamal hosts, generic enough for any box.

harden-server.sh

fresh server

Full baseline for a freshly provisioned box:

system update + unattended security upgrades, reboots only Sundays (and only if required)
deploy user with your SSH key; sshd locked to key-only auth (root stays available, key-only)
UFW (rate-limited SSH, 80, 443), fail2ban, kernel/network sysctl hardening
Docker from the official repo with live-restore on before the first container runs

curl -fsSL https://hardening.bithaiku.com/harden-server.sh | sudo bash

view source · configure with env vars, e.g. sudo SSH_PORT=2222 DEPLOY_USER=app bash

harden-existing-server.sh

server already running apps

Same baseline, minus anything that could take production down:

no blanket upgrade — pending security updates reported for your maintenance window
UFW additive only: existing rules and policies are never reset; asks before enabling
no user lockouts — warns about accounts that would lose access before key-only auth
Docker live-restore enabled last, via daemon reload; full restart only after a 5s Ctrl-C-able warning

curl -fsSL https://hardening.bithaiku.com/harden-existing-server.sh | sudo bash

view source

auto-updates.sh

updates only

Just unattended security upgrades plus the Sunday-if-required reboot. No firewall, ssh, user, or sysctl changes.

curl -fsSL https://hardening.bithaiku.com/auto-updates.sh | sudo bash

view source

Read before you run. These scripts reconfigure sshd and your firewall. Each is a single top-to-bottom bash file wrapped in main() (a truncated download executes nothing), but you should still look before piping to root:

curl -fsSL https://hardening.bithaiku.com/harden-server.sh -o harden-server.sh
less harden-server.sh
sudo bash harden-server.sh

And before closing your session afterwards, verify SSH still works from a second terminal.