VPS Security Skills

A comprehensive collection of agent skills for hardening VPS servers against common security threats. Based on industry best practices and real-world attack prevention strategies.

🎯 What is This?

This repository contains Agent Skills for securing Virtual Private Servers (VPS). These skills enable AI coding assistants to automatically configure server security following proven hardening techniques.

Within 60 seconds of spinning up a new VPS, someone is already trying to break in. Automated bots constantly scan the entire internet looking for vulnerable servers. These skills help you secure your server before attackers find it.

📦 Available Skills

Skill	Description
auto-updates	Configure automatic security updates to patch vulnerabilities
ssh-hardening	Disable root login, enforce SSH keys, create non-root users
firewall-configuration	Set up UFW firewall with default-deny policies
fail2ban-setup	Automatically ban IPs showing brute-force behavior
backup-strategy	Implement automated backups with off-server storage

🚀 Quick Start

Installation

Using Skills CLI:

# With npm
npx skills add mikr13/secure-server-setup-skills

# Or with Bun
bunx skills add mikr13/secure-server-setup-skills

Using Context7 CLI:

# With npm
npx ctx7 skills install /mikr13/secure-server-setup-skills

# Or with Bun
bunx ctx7 skills install /mikr13/secure-server-setup-skills

Usage with AI Assistants

Once installed, prompt your AI assistant:

Harden my new Ubuntu VPS server with all security best practices

Or target specific security areas:

Set up SSH hardening and firewall on my server

Configure automatic backups to AWS S3

✅ Emergency 10-Minute Hardening

No time for the full security setup? Here's the absolute minimum you should do on a new VPS:

# Update everything
sudo apt update && sudo apt upgrade -y

# Create non-root user
adduser deployer && usermod -aG sudo deployer

# Basic firewall
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

# Fail2ban with defaults
sudo apt install fail2ban
sudo systemctl enable fail2ban

# Disable root password login
sudo passwd -l root

Then: Set up SSH keys, disable password authentication, and configure proper backups as soon as possible.

📋 VPS Security Checklist

Use this checklist for every new VPS:

• Update all packages
• Enable automatic security updates
• Create non-root user with sudo
• Set up SSH key authentication
• Disable password authentication
• Disable root login
• Configure firewall (UFW)
• Install Fail2ban
• Disable unnecessary services
• Set up off-server backups

🎓 Why These Skills?

The Problem

Most VPS instances have the same critical mistakes:

1. Not updating the system - Running known-vulnerable software
2. Logging in as root - One typo can destroy everything
3. Using password authentication - Passwords can be brute-forced
4. No firewall - Every port accessible to the internet
5. No brute-force protection - Bots hammering login attempts 24/7
6. Running unnecessary services - More attack surface
7. No backups - Can't recover from compromise

The Solution

These skills fix all of these issues systematically:

• Auto-updates: Patches known vulnerabilities automatically
• SSH hardening: Keys instead of passwords, no root access
• Firewall: Default deny, whitelist required services only
• Fail2ban: Three strikes and you're banned for an hour
• Backups: Quick recovery if something goes wrong

🏗️ Skill Structure

Each skill includes:

skill-name/
├── SKILL.md              # Main skill documentation with YAML frontmatter
├── scripts/              # Executable setup/automation scripts
│   └── setup-*.sh       # Automated configuration scripts
└── references/           # Detailed reference documentation
    └── *.md             # In-depth guides and troubleshooting

🔧 Manual Implementation

If you prefer to implement these manually without AI assistance, each skill's scripts/ directory contains ready-to-run bash scripts:

# Run any setup script
sudo bash secure-server-setup/auto-updates/scripts/setup-auto-updates.sh
sudo bash secure-server-setup/ssh-hardening/scripts/setup-ssh-hardening.sh
sudo bash secure-server-setup/firewall-configuration/scripts/setup-firewall.sh
sudo bash secure-server-setup/fail2ban-setup/scripts/setup-fail2ban.sh
sudo bash secure-server-setup/backup-strategy/scripts/backup-full.sh

📚 Learn More

• Agent Skills Standard: agentskills.io
• Skills Marketplace: skills.sh
• Vercel Skills FAQ: Agent Skills Explained

🤝 Contributing

Contributions are welcome! To suggest improvements:

1. Open an issue to discuss your idea
2. Fork this repository
3. Create a feature branch
4. Submit a pull request

All skills must follow the Agent Skills Standard.

📄 License

MIT License - see LICENSE file for details.

🙏 Acknowledgments

Security practices based on:

• Original Twitter thread by @brankopetric00
• Industry standard hardening guidelines
• OWASP security recommendations
• Real-world VPS deployment experience
• CIS Benchmarks for Linux

⚠️ Security Notice

These skills implement defense in depth - multiple layers of security working together. No single measure is perfect, but combined they significantly reduce your attack surface.

Most attackers are lazy. They're looking for default passwords, unpatched software, and misconfigured services. Make your server slightly harder than the next one, and they'll move on.

---

Remember: Security is not a one-time setup. Regular updates, monitoring, and testing are essential for maintaining a secure server.