DEV Community

Cover image for Server Hardening Toolkit: Automated Linux & CloudLinux Security Scripts
Tarek Mohamed
Tarek Mohamed

Posted on

Server Hardening Toolkit: Automated Linux & CloudLinux Security Scripts

#linux #devops #security #bash

Deploying a fresh Linux VPS or dedicated server without comprehensive hardening leaves it vulnerable to automated SSH brute-force bots, kernel exploits, and open port scans within minutes.

server-hardening-toolkit is a battle-tested collection of automated Bash and Ansible scripts designed to securely configure production servers in under 5 minutes.

GitHub logo seotarek / server-hardening-toolkit

Production-tested Bash and Ansible automation scripts for Linux, CloudLinux, and web server security hardening.

Server Hardening Toolkit 🛡️

License: MIT Bash Linux Security

Production-tested modular automation scripts for Linux, CloudLinux, and web server security hardening.

Developed by Tarek Mohamed (@seotarek)

📌 Included Modules

  1. scripts/harden-ssh.sh:

    • Disables root SSH login.
    • Enforces public-key authentication only.
    • Sets strict brute-force thresholds (MaxAuthTries 3).
    • Automatically tests configuration syntax before restarting sshd.

  2. scripts/setup-firewall.sh:

    • Configures ufw with rate-limiting on SSH.
    • Default deny incoming, allow outgoing.
    • Opens only ports 80, 443, and custom SSH port.

  3. scripts/sysctl-tuning.sh:

    • Hardens kernel network parameters against SYN floods, IP spoofing, and malicious ICMP redirects.

🚀 Quick Usage

git clone https://github.com/seotarek/server-hardening-toolkit.git
cd server-hardening-toolkit

# Make executable
chmod +x scripts/*.sh

# Run hardening scripts (requires root)
sudo ./scripts/harden-ssh.sh
sudo ./scripts/setup-firewall.sh 22
sudo ./scripts/sysctl-tuning.sh
Enter fullscreen mode Exit fullscreen mode

📜 License

Licensed under the MIT License.


View on GitHub


🛡️ What Does It Harden?

  1. SSH Hardening: Disables root login, enforces Ed25519 public key authentication, changes standard ports, and configures aggressive Fail2ban jails.
  2. Kernel & Sysctl Tuning: Protects against SYN flood attacks, disables IP forwarding, and restricts access to kernel dmesg logs.
  3. Automated Firewall (UFW / CSF): Locks down all ports by default, allowing only necessary web and management traffic.
  4. CloudLinux & LVE Optimization: Configures resource limits (CPU/RAM/IO) to prevent single-tenant server overload.

View the scripts and contribute on GitHub:
👉 https://github.com/seotarek/server-hardening-toolkit

Top comments (0)