---
slug: "secure-server-setup-skills"
source_type: "readme"
source_url: "https://cdn.jsdelivr.net/gh/mikr13/secure-server-setup-skills@main/README.md"
repo: "https://github.com/mikr13/secure-server-setup-skills"
source_file: "README.md"
branch: "main"
---
# VPS Security Skills

[![Skills Standard](https://img.shields.io/badge/skills-agent--skills-blue)](https://agentskills.io/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

A comprehensive collection of agent skills for hardening VPS servers against common security threats. Based on industry best practices and real-world attack prevention strategies.

## 🎯 What is This?

This repository contains [Agent Skills](https://agentskills.io/) for securing Virtual Private Servers (VPS). These skills enable AI coding assistants to automatically configure server security following proven hardening techniques.

**Within 60 seconds of spinning up a new VPS, someone is already trying to break in.** Automated bots constantly scan the entire internet looking for vulnerable servers. These skills help you secure your server before attackers find it.

## 📦 Available Skills

| Skill | Description |
|-------|-------------|
| [auto-updates](https://github.com/mikr13/secure-server-setup-skills/tree/HEAD/secure-server-setup/auto-updates/) | Configure automatic security updates to patch vulnerabilities |
| [ssh-hardening](https://github.com/mikr13/secure-server-setup-skills/tree/HEAD/secure-server-setup/ssh-hardening/) | Disable root login, enforce SSH keys, create non-root users |
| [firewall-configuration](https://github.com/mikr13/secure-server-setup-skills/tree/HEAD/secure-server-setup/firewall-configuration/) | Set up UFW firewall with default-deny policies |
| [fail2ban-setup](https://github.com/mikr13/secure-server-setup-skills/tree/HEAD/secure-server-setup/fail2ban-setup/) | Automatically ban IPs showing brute-force behavior |
| [backup-strategy](https://github.com/mikr13/secure-server-setup-skills/tree/HEAD/secure-server-setup/backup-strategy/) | Implement automated backups with off-server storage |

## 🚀 Quick Start

### Installation

**Using Skills CLI:**

```bash
# With npm
npx skills add mikr13/secure-server-setup-skills

# Or with Bun
bunx skills add mikr13/secure-server-setup-skills
```

**Using Context7 CLI:**

```bash
# With npm
npx ctx7 skills install /mikr13/secure-server-setup-skills

# Or with Bun
bunx ctx7 skills install /mikr13/secure-server-setup-skills
```

### Usage with AI Assistants

Once installed, prompt your AI assistant:

```
Harden my new Ubuntu VPS server with all security best practices
```

Or target specific security areas:

```
Set up SSH hardening and firewall on my server
```

```
Configure automatic backups to AWS S3
```

## ✅ Emergency 10-Minute Hardening

No time for the full security setup? Here's the absolute minimum you should do on a new VPS:

```bash
# Update everything
sudo apt update && sudo apt upgrade -y

# Create non-root user
adduser deployer && usermod -aG sudo deployer

# Basic firewall
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

# Fail2ban with defaults
sudo apt install fail2ban
sudo systemctl enable fail2ban

# Disable root password login
sudo passwd -l root
```

**Then:** Set up SSH keys, disable password authentication, and configure proper backups as soon as possible.

## 📋 VPS Security Checklist

Use this checklist for every new VPS:

- [ ] Update all packages
- [ ] Enable automatic security updates
- [ ] Create non-root user with sudo
- [ ] Set up SSH key authentication
- [ ] Disable password authentication
- [ ] Disable root login
- [ ] Configure firewall (UFW)
- [ ] Install Fail2ban
- [ ] Disable unnecessary services
- [ ] Set up off-server backups

## 🎓 Why These Skills?

### The Problem

Most VPS instances have the same critical mistakes:

1. **Not updating the system** - Running known-vulnerable software
2. **Logging in as root** - One typo can destroy everything
3. **Using password authentication** - Passwords can be brute-forced
4. **No firewall** - Every port accessible to the internet
5. **No brute-force protection** - Bots hammering login attempts 24/7
6. **Running unnecessary services** - More attack surface
7. **No backups** - Can't recover from compromise

### The Solution

These skills fix all of these issues systematically:

- **Auto-updates**: Patches known vulnerabilities automatically
- **SSH hardening**: Keys instead of passwords, no root access
- **Firewall**: Default deny, whitelist required services only
- **Fail2ban**: Three strikes and you're banned for an hour
- **Backups**: Quick recovery if something goes wrong

## 🏗️ Skill Structure

Each skill includes:

```
skill-name/
├── SKILL.md              # Main skill documentation with YAML frontmatter
├── scripts/              # Executable setup/automation scripts
│   └── setup-*.sh       # Automated configuration scripts
└── references/           # Detailed reference documentation
    └── *.md             # In-depth guides and troubleshooting
```

## 🔧 Manual Implementation

If you prefer to implement these manually without AI assistance, each skill's `scripts/` directory contains ready-to-run bash scripts:

```bash
# Run any setup script
sudo bash secure-server-setup/auto-updates/scripts/setup-auto-updates.sh
sudo bash secure-server-setup/ssh-hardening/scripts/setup-ssh-hardening.sh
sudo bash secure-server-setup/firewall-configuration/scripts/setup-firewall.sh
sudo bash secure-server-setup/fail2ban-setup/scripts/setup-fail2ban.sh
sudo bash secure-server-setup/backup-strategy/scripts/backup-full.sh
```

## 📚 Learn More

- **Agent Skills Standard**: [agentskills.io](https://agentskills.io/)
- **Skills Marketplace**: [skills.sh](https://skills.sh/)
- **Vercel Skills FAQ**: [Agent Skills Explained](https://vercel.com/blog/agent-skills-explained-an-faq)

## 🤝 Contributing

Contributions are welcome! To suggest improvements:

1. Open an issue to discuss your idea
2. Fork this repository
3. Create a feature branch
4. Submit a pull request

All skills must follow the [Agent Skills Standard](https://agentskills.io/specification).

## 📄 License

MIT License - see [LICENSE](https://github.com/mikr13/secure-server-setup-skills/tree/HEAD/LICENSE) file for details.

## 🙏 Acknowledgments

Security practices based on:

- Original Twitter thread by [@brankopetric00](https://x.com/brankopetric00/status/2017283246254436501)
- Industry standard hardening guidelines
- OWASP security recommendations
- Real-world VPS deployment experience
- CIS Benchmarks for Linux

## ⚠️ Security Notice

These skills implement defense in depth - multiple layers of security working together. No single measure is perfect, but combined they significantly reduce your attack surface.

**Most attackers are lazy.** They're looking for default passwords, unpatched software, and misconfigured services. Make your server slightly harder than the next one, and they'll move on.

---

**Remember:** Security is not a one-time setup. Regular updates, monitoring, and testing are essential for maintaining a secure server.