Server Security Init Skill

Skill by ara.so — Security Skills collection.

This skill guides you through safely initializing and hardening fresh Ubuntu/Debian SSH servers. It implements a staged bootstrap flow: selecting or generating local SSH keys, requiring public-key login before remote changes, creating a non-root sudo user, changing the SSH port, disabling root/password login, configuring UFW firewall, setting up fail2ban, and verifying no lockout conditions exist.

What This Skill Does

The server-security-init skill provides guidance for:

• Public-key SSH bootstrap without exposing root passwords in commands, logs, or config files
• Staged SSH hardening with verified non-root sudo login before disabling old access paths
• UFW firewall setup with default-deny inbound policy and explicit port allowances
• Fail2ban jail configuration for SSH brute-force protection with management IP exceptions
• Debian 12/systemd socket checks to prevent ssh.socket from silently keeping SSH on the old port
• Server-side verification using ss -ltnp, sshd -T, systemctl, and ufw status
• Recovery checks for fail2ban bans, firewall mistakes, and SSH listener mismatches

Installation