vps-harden

Secure your VPS in 2 minutes. One command, zero knowledge required.

npx vps-harden 194.68.0.12

[vps-harden]
  Target: 194.68.0.12

  ✓  1. Generate SSH key       ~/.ssh/vps_194_68_0_12_ed25519
  ✓  2. Copy key to server     [email protected]
  ✓  3. Create user            deploy (sudo)
  ✓  4. Change SSH port        22 → 2222
  ✓  5. Verify new port        [email protected]:2222 OK
  ✓  6. Close port 22          Port 22 closed
  ✓  7. Disable password auth  Password auth disabled
  ✓  8. Disable root login     Root login disabled
  ✓  9. Setup firewall         ufw on (2222, 80, 443)
  ✓ 10. Install fail2ban       fail2ban on port 2222

  ════════════════════════════════════════════════════
  ✓ Server hardened successfully!

  Connect with:
  ssh -i ~/.ssh/vps_194_68_0_12_ed25519 -p 2222 [email protected]

  Save this command. Port 22 is closed.
  ════════════════════════════════════════════════════

What it does

1. Generates SSH key locally (ed25519, named after your server)
2. Copies key to server via password auth
3. Creates non-root user with passwordless sudo
4. Changes SSH port (default: 2222)
5. Verifies new port works before closing old one
6. Closes port 22 — only after verification
7. Disables password auth — key-only access
8. Disables root login — use your new user
9. Sets up UFW firewall — allows SSH, HTTP, HTTPS
10. Installs fail2ban — brute-force protection

Safety first

The tool never locks you out:

• Port 22 stays open until the new port is verified
• Password auth stays on until key auth is confirmed
• Every step has automatic rollback on failure
• If anything fails, previous steps are undone in reverse order

Install

# Run instantly (no install)
npx vps-harden 194.68.0.12

# Or install globally
npm i -g vps-harden

Options

# Custom username and port
vps-harden 194.68.0.12 --username admin --port 3322

# Use existing SSH key
vps-harden 194.68.0.12 --key ~/.ssh/id_ed25519

# Preview without making changes
vps-harden 194.68.0.12 --dry-run

# Non-interactive (CI/scripts)
vps-harden 194.68.0.12 --password "rootpass" --username deploy

| Flag | Default | Description | |------|---------|-------------| | --password | prompt | Root password | | --username | deploy | New username | | --port | 2222 | New SSH port | | --key | auto-generate | Existing SSH key path | | --dry-run | false | Preview without changes |

Requirements

• Node.js 18+
• macOS or Linux (local machine)
• Ubuntu/Debian VPS with root SSH access

After hardening

Your server is now protected with:

• Non-standard SSH port (bots scan port 22)
• Key-only authentication (no password brute-force)
• Non-root user (limits damage if compromised)
• UFW firewall (only SSH, HTTP, HTTPS open)
• fail2ban (auto-bans repeated failed logins)

Why not a bash script?

| | vps-harden | Bash scripts | |---|---|---| | Install | npx (instant) | curl \| bash (scary) | | Runs from | Your machine | On the server | | SSH key gen | Automatic | Manual | | Safety | Verify before close | Hope for the best | | Rollback | Automatic | None | | UI | Interactive TUI | Raw output |

License

MIT