vps-setup-and-hardening

name	vps-setup-and-hardening
description	Workflow for 'Surgical Scrubbing' and hardening a used or fresh VPS to ensure a zero-trust environment before deployment.
version	1.0.0
author	Hermes Agent
license	MIT
platforms	["linux"]
metadata	{"hermes":{"tags":["vps","linux","hardening","security","devops"]}}

VPS Setup & Hardening

Use this skill when inheriting a VPS (e.g., from a friend or a repurposed instance) to ensure no legacy users, keys, or services compromise the new stack.

The "Surgical Scrub" Workflow

1. Identity Audit & Purge

Identify and remove non-system users to ensure you are the only human operator.

• Audit: grep -v "/sbin" /etc/passwd (Look for unexpected users in /home).
• Purge: userdel -r <username> for any ghost accounts.

2. SSH Lockdown

Prevent unauthorized access via legacy SSH keys.

• Wipe Keys: echo "" > /root/.ssh/authorized_keys (Immediately removes all existing key-based access).
• Password Update: Set a strong root password if not already done.
• Key Rotation: Immediately generate a new SSH key pair and add your public key to the now-empty authorized_keys.

3. Network Hardening (UFW)

Establish a default-deny posture.

• Allow SSH: ufw allow 22/tcp (CRITICAL: do this before enabling).
• Enable: ufw --force enable.
• App-Specific Ports: Open only necessary ports (e.g., 80, 443) as the stack is deployed.

4. System Refresh

Ensure the OS is patched and clean.

• Update: apt update && apt upgrade -y.
• Clean: apt autoremove -y.

Technical Patterns

Non-Interactive Setup

When automating this via a remote agent, use sshpass for initial password-based entry until keys are rotated:

sshpass -p 'password' ssh -o StrictHostKeyChecking=no root@<ip> 'command'

Monorepo Deployment Pitfall

When deploying from monorepos (like the automindlab-stack), the docker-compose.yaml is often NOT in the root.

• Discovery: Use find . -name "compose.yaml" to locate the specific deployment slice.
• Execution: Always specify the file path: docker compose -f path/to/compose.yaml up -d.

Verification

• Check active ports: netstat -tulpn or ss -tulpn.
• Verify users: cut -d: -f1 /etc/passwd.
• Test firewall: Try accessing a blocked port from an external IP.