A NanoApps Tool for Ubuntu Servers

Server hardening.
One script.

Take a bare Ubuntu server from first boot to hardened production baseline in under five minutes. No manual config files, no forgotten steps.

Get the Script
Read the Docs

What It Does

Everything a fresh server needs, applied automatically.

Sudo User

Creates a named sudo user with a secure password. Root login is disabled immediately after so there is no window where the server sits exposed.

SSH Hardening

Disables root login, limits auth to your user only, and optionally installs an SSH public key from a URL you provide. Password auth is disabled automatically when a key is used.

UFW Firewall

Enables UFW with a deny-all inbound policy. Only port 22 (SSH) is opened. Add your own ports after setup once you know what services you are running.

Fail2Ban

Monitors SSH login attempts and automatically bans IPs after 5 failed tries within 10 minutes. Bans last one hour. Stops brute-force attacks cold.

Auto Security Updates

Configures unattended-upgrades to apply security patches automatically. Non-security updates are left for you to apply manually. No auto-reboot.

Custom MOTD

Replaces the default login message with a clean status dashboard showing uptime, memory, disk, IP addresses, last login, pending updates, active services, and Fail2Ban status.

Also Included

The details that are easy to forget.

After the big security items are locked down, the script handles the small configuration tasks that would otherwise sit on a to-do list forever.

  • System packages updated to latest before hardening begins
  • Hostname set to whatever you choose
  • Timezone configured (defaults to America/Winnipeg)
  • IPv6 disabled via sysctl
  • Post-install verification checks every step
  • Automatic reboot on clean pass, cancelled if issues found

Quick Start

Three commands from fresh server to hardened.

# Log in as root, then run:
curl -fsSL https://nanoapps.ca/scripts/server-setup/serversetup.txt -o serversetup.sh
chmod +x serversetup.sh
./serversetup.sh

The script prompts for a username, password, optional SSH public key URL, hostname, and timezone before making any changes. A summary is shown and you must confirm before anything runs.

Ready to harden your server?

Download the script and run it on any fresh Ubuntu server. Requires root. Tested on Ubuntu 22.04 and 24.04.

Download Script
Read the Docs

Powered by