Linux server setup and hardening script: creates a new admin user, secures SSH, configures UFW firewall, installs Fail2Ban, enables automatic security updates, sets time zone, adds swap, and installs basic monitoring tools - ready for web application deployment.

new-linux-server-setup.sh

# ==============================
# New Linux Server Setup & Hardening
# Tried this on Ubuntu 24.04
# 25-08-2025
# ==============================

# ------------------------------------------
# 1. Update system packages
# ------------------------------------------
sudo apt update && sudo apt upgrade -y

# ------------------------------------------
# 2. Create a new user for administration
# ------------------------------------------
sudo adduser <username>
sudo usermod -aG sudo <username>

# ------------------------------------------
# 3. Copy your SSH keys to the new user
# ------------------------------------------
# Assuming you are logged in as root user with ssh key,
# since root login will be disbaled in following steps, 
# reuse same key for new admin user
sudo rsync --archive --chown=<username>:<username> ~/.ssh /home/<username>

# ------------------------------------------
# 4. Harden your SSH config
# ------------------------------------------
sudo nano /etc/ssh/sshd_config

# Make sure to change/add the following lines:
PermitRootLogin no # block root login
PasswordAuthentication no # disable ssh using password
Port <ssh port> # change ssh port from 22 to something un-common to evade bot scanners

sudo systemctl restart ssh

# Optional: verify new SSH port is open
sudo ss -tuln | grep <ssh port>

# if ssh port change doesn't reflect, restart following to services
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

# 5. Firewall setup using UFW
sudo ufw status verbose          # check current status
sudo ufw limit <ssh port>/tcp    # rate-limit SSH to prevent brute-force
sudo ufw allow 80/tcp            # HTTP
sudo ufw allow 443/tcp           # HTTPS
sudo ufw default deny incoming   # block all other incoming
sudo ufw default allow outgoing  # allow all outgoing
sudo ufw enable
sudo ufw status verbose

# ------------------------------------------
# 6. Optional hardening / recommended steps
# ------------------------------------------

# 6a. Fail2Ban - protects SSH and other services from brute-force attacks
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# 6b. Disable unnecessary services
sudo systemctl disable <service_name>
sudo systemctl stop <service_name>

# 6c. Set up automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# 6d. Timezone & locale (optional, recommended for logs & cron)
sudo timedatectl set-timezone <Your/Timezone>
sudo locale-gen en_US.UTF-8
sudo update-locale LANG=en_US.UTF-8

# 6e. Basic monitoring (optional)
sudo apt install htop iftop -y