vps-setup

A Claude Code skill for the initial setup and security hardening of a fresh Linux server (VPS, dedicated, or cloud instance).

Russian / Русский

What it does

Walks through 14 steps from a provider's welcome email to a production-ready, hardened server:

• Generate SSH key on the user's local machine first
• Connect as root, handle forced password change
• System update with non-interactive apt (no kernel/grub prompts)
• Create non-root user with sudo
• Install SSH key for the new user
• Test new-user login + sudo (critical checkpoint)
• Firewall (UFW: default deny incoming, allow outgoing, allow SSH)
• Kernel hardening (sysctl: rp_filter, syncookies, redirects)
• Time sync + base packages (chrony, curl, wget, git, ...)
• Configure local ~/.ssh/config for ssh {nickname} shortcut
• Quick audit
• Generate guide file with credentials and commands
• Re-verify ssh {nickname} works
• fail2ban + lock SSH (PermitRootLogin no, PasswordAuthentication no)
• Confirm ssh {nickname} still works after lockdown

Why this skill exists

Most beginner server-hardening guides lock down SSH (disable root login, disable password authentication) before verifying that key-based login works end-to-end. One typo in authorized_keys and the user is locked out of their server.

This skill defers the lockdown to the very last step, after the user has actually logged in successfully with their key from their own machine. The lockout class of beginner mistakes becomes impossible.

Cross-platform

• Server side: Debian / Ubuntu (the hardening commands)
• User's machine: macOS, Linux, or Windows 10/11 (PowerShell with built-in OpenSSH client)

Two execution modes

• Remote mode — Claude Code runs on the user's laptop, configures the remote server over SSH. This is the default.
• Local mode — Claude Code runs on the server itself. The skill defers SSH key generation until after base hardening, the user generates a key on their laptop later via SCP roundtrip, and only then is lockdown applied.

Audit mode

The skill also includes a separate audit reference (references/security-audit.md) with three tiers:

• Quick audit (~30 s): SSH lockdown status, open ports, failed-login count, firewall, fail2ban
• Extended (~2 min): Lynis, log review, package updates, kernel
• Full (~5 min): rkhunter, file-integrity, IDS, deeper analysis

Use this to audit an already-running server (e.g. "I've had this VPS for 3 months and saw a bunch of brute-force attempts in the logs").

Optional software reference

references/optional-software.md covers common follow-ups after hardening: Docker + Compose, Node.js (nvm), Python venv, Nginx + reverse-proxy template, Certbot/Let's Encrypt, PM2, swap.

Installation

One-line install

curl -fsSL https://raw.githubusercontent.com/AndyShaman/vps-setup-skill/main/install.sh | bash

Manual install

git clone https://github.com/AndyShaman/vps-setup-skill.git
cd vps-setup-skill
./install.sh

The installer copies skill/ to ~/.claude/skills/vps-setup/.

Usage

Once installed, just describe your situation to Claude Code:

• "Just bought a VPS at Hetzner, here's the email — secure it"
• "Купил впску, надо защитить"
• "Audit my server prod1, I see a lot of failed SSH attempts"

Claude Code will pick up the skill from your skills directory and walk you through it.

License

MIT — see LICENSE.