Ubuntu 24.04 hardening scripts and deployed config snapshots for the m-noris Hetzner VPS (46.225.119.135).
One-shot hardening script. Run as root on a fresh Ubuntu 22.04/24.04 server.
sudo bash harden.sh [--admin-user USERNAME] [--ssh-port PORT] [--skip-updates]What it does:
| Step | Action |
|---|---|
| OS updates | apt upgrade (skip with --skip-updates) |
| fail2ban | Installs, enables SSH jail (3 attempts → 24h ban) |
| Admin user | Creates non-root sudo user, copies root SSH keys |
| SSH | Key-only auth, root login off, configurable port |
| Nginx | Drops TLS 1.0/1.1, server_tokens off, security headers |
| Docker | Audits containers exposing ports on 0.0.0.0 (UFW bypass risk) |
| UFW | Deny-all inbound, allow SSH / 80 / 443 |
Default admin user: jf_admin. Default SSH port: 22.
Reference copies of files deployed on the server. Edit here, then push to server manually or via the deploy commands below.
configs/
├── fail2ban/
│ └── jail.local → /etc/fail2ban/jail.local
├── ssh/
│ └── 99-hardening.conf → /etc/ssh/sshd_config.d/99-hardening.conf
├── nginx/
│ ├── nginx.conf → /etc/nginx/nginx.conf
│ ├── conf.d/ → /etc/nginx/conf.d/
│ └── sites-enabled/ → /etc/nginx/sites-enabled/
├── services/ → /opt/m-noris/<service>/docker-compose.y[a]ml
│ ├── umami-docker-compose.yml
│ ├── listmonk-docker-compose.yml
│ ├── n8n-docker-compose.yml
│ ├── chatwoot-docker-compose.yml
│ ├── formbricks-docker-compose.yml
│ └── postiz-docker-compose.yaml
└── motd/
└── 01-m-noris → /etc/update-motd.d/01-m-noris
# Example: push updated nginx site config
scp configs/nginx/sites-enabled/app.conf postiz:/etc/nginx/sites-enabled/
ssh postiz "nginx -t && systemctl reload nginx"
# Example: push MOTD update
scp configs/motd/01-m-noris postiz:/etc/update-motd.d/01-m-noris
ssh postiz "chmod +x /etc/update-motd.d/01-m-noris"| Provider | Hetzner |
| OS | Ubuntu 24.04 LTS |
| IP | 46.225.119.135 |
| SSH alias | postiz |
| Services | Umami · Listmonk · n8n · Chatwoot · Formbricks · Postiz |