# Vps Bootstrap

> Use when provisioning, benchmarking, and hardening a fresh Linux VPS node with SSH security, UFW firewall, Fail2ban, BBR acceleration, and hardware health inspection.

- Skill: `shali10/vps-bootstrap` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add shali10/vps-bootstrap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shali10/vps-bootstrap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: shali10 (https://skillmd.com/u/shali10)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/shali10/vps-bootstrap

---


# Fresh Linux VPS Bootstrap & Security Hardening

## Overview

A battle-tested initialization and security baseline suite for new Linux VPS nodes (Debian/Ubuntu/AlmaLinux). It automates **hardware & network benchmarking, BBR+FQ TCP acceleration, UFW firewall rules, Fail2ban brute-force protection, SSH key authentication enforcement, and system package updates**.

## When to Use & When NOT to Use

### When to Use
- Initializing a brand-new VPS instance right after purchase/reinstall.
- Establishing standard security baselines on exposed cloud VMs.
- Auditing CPU speed, disk I/O, swap, and three-network routing quality.

### When NOT to Use
- Managing container-internal virtual filesystems where kernel tuning (BBR/Swap) is restricted by host hypervisors.
- Production systems with active complex iptables routing that could be overwritten by naive UFW enable.

## Standard Initialization Pipeline

```bash
# 1. Update packages & install essential tools
apt-get update && apt-get install -y ufw fail2ban curl wget git htop jq iotop

# 2. Enable BBR + FQ TCP Congestion Control
cat << 'EOF' >> /etc/sysctl.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF
sysctl -p

# 3. Configure UFW Firewall (Never lock out SSH!)
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment 'SSH Port'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
ufw --force enable

# 4. Configure Fail2ban for SSH Protection
cat << 'EOF' > /etc/fail2ban/jail.local
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 86400
findtime = 600
EOF
systemctl restart fail2ban
```

## Common Pitfalls

1. **Locking out SSH during UFW enable**: Always explicitly run `ufw allow <YOUR_SSH_PORT>/tcp` BEFORE running `ufw enable`.
2. **Debian 12/13 auth.log missing for Fail2ban**: Debian 12+ defaults to `systemd-journald` instead of `rsyslog`. Set `backend = systemd` in `/etc/fail2ban/jail.local` if `/var/log/auth.log` does not exist.
3. **Docker bypassing UFW**: Docker by default manipulates `iptables` directly and bypasses UFW rules. Bind container ports to `127.0.0.1:<port>` or configure `DOCKER-USER` chain rules.

## Verification Checklist

- [ ] `sysctl net.ipv4.tcp_congestion_control` returns `bbr`.
- [ ] `ufw status verbose` shows active status with open SSH port.
- [ ] `fail2ban-client status sshd` confirms active jail.
- [ ] Root password login is disabled in `/etc/ssh/sshd_config` (`PasswordAuthentication no`).