Menu
Workflow for 'Surgical Scrubbing' and hardening a used or fresh VPS to ensure a zero-trust environment before deployment.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Durable knowledge-vault reference for the Prismtek/Buddy talking-host lip-sync workflow.
Configure, extend, or contribute to Hermes Agent.
Use when reviewing betting-model pipelines, sports prediction datasets, backtests, expected value math, and model-risk controls without placing bets.
Use when planning, drafting, repurposing, and promoting content across YouTube, X, and Twitch while keeping posting, DMs, replies, deletions, and account changes approval-gated.
Use when turning approved bookmarks and linked articles into ranked research digests, summaries, and next actions using read-only browser or API adapters.
Use when preparing concise pre-call context briefs from approved notes, prior conversations, public signals, project status, and open questions.
| name | vps-setup-and-hardening |
| description | Workflow for 'Surgical Scrubbing' and hardening a used or fresh VPS to ensure a zero-trust environment before deployment. |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| platforms | ["linux"] |
| metadata | {"hermes":{"tags":["vps","linux","hardening","security","devops"]}} |
Use this skill when inheriting a VPS (e.g., from a friend or a repurposed instance) to ensure no legacy users, keys, or services compromise the new stack.
Identify and remove non-system users to ensure you are the only human operator.
grep -v "/sbin" /etc/passwd (Look for unexpected users in /home).userdel -r <username> for any ghost accounts.Prevent unauthorized access via legacy SSH keys.
echo "" > /root/.ssh/authorized_keys (Immediately removes all existing key-based access).authorized_keys.Establish a default-deny posture.
ufw allow 22/tcp (CRITICAL: do this before enabling).ufw --force enable.Ensure the OS is patched and clean.
apt update && apt upgrade -y.apt autoremove -y.When automating this via a remote agent, use sshpass for initial password-based entry until keys are rotated:
sshpass -p 'password' ssh -o StrictHostKeyChecking=no root@<ip> 'command'
When deploying from monorepos (like the automindlab-stack), the docker-compose.yaml is often NOT in the root.
find . -name "compose.yaml" to locate the specific deployment slice.docker compose -f path/to/compose.yaml up -d.netstat -tulpn or ss -tulpn.cut -d: -f1 /etc/passwd.