VM Security

Two scripts do the work; this file is the procedure around them. Both live in scripts/ next to this file and are piped to the target over SSH, so nothing needs to be copied to the server.

• scripts/audit.sh — read-only. Changes nothing. Prints sections and [!] findings, then a summary. ~1–4 min (--no-verify skips the slowest part).
• scripts/harden.sh — idempotent. Steps: admin ssh fail2ban ufw updates sysctl journald alerts, selectable with --only / --skip.

Inputs to collect

Required, from the user only. The host IP, the admin username and the SSH key must be given by the user. Never take them from memory or notes, ~/.ssh/config, the files in ~/.ssh, or an earlier session, and never guess. These choose which machine gets locked down and who keeps access, so a wrong value can lock someone out of a server. If any of the three is missing from the request, ask for all the missing ones in one question, and don't connect until you have them: