simple_vps_harden.sh

#!/bin/bash

# Check if running as root
if [ "$(id -u)" -ne 0 ]; then
    echo "This script must be run as root" >&2
    exit 1
fi

# Prompt for custom workflow
echo "Do you want to customize user creation and SSH key setup? (y/n)"
read -r customize
if [ "$customize" != "y" ] && [ "$customize" != "n" ]; then
    echo "Invalid input, please enter y or n" >&2
    exit 1
fi

# 1. Update system
apt update
apt upgrade -y

# 2. Create non-root user and SSH keys (non-custom mode)
if [ "$customize" = "n" ]; then
    # Prompt for username
    echo "Enter new username:"
    read -r username
    if [ -z "$username" ]; then
        echo "Username cannot be empty" >&2
        exit 1
    fi

    # Create user and grant sudo privileges
    if ! adduser --gecos "" "$username"; then
        echo "User creation failed" >&2
        exit 1
    fi
    usermod -aG sudo "$username"

    # Create SSH directory
    mkdir -p /home/"$username"/.ssh
    if [ ! -d /home/"$username"/.ssh ]; then
        echo "Failed to create SSH directory" >&2
        exit 1
    fi
    chmod 700 /home/"$username"/.ssh
    chown "$username":"$username" /home/"$username"/.ssh

    # Generate SSH key pair
    if ! ssh-keygen -t ed25519 -C "$username@vps" -f /home/"$username"/.ssh/id_ed25519 -N ""; then
        echo "SSH key generation failed" >&2
        exit 1
    fi
    chmod 600 /home/"$username"/.ssh/id_ed25519
    chown "$username":"$username" /home/"$username"/.ssh/id_ed25519
    chown "$username":"$username" /home/"$username"/.ssh/id_ed25519.pub

    # Automatically add public key to authorized_keys
    echo "# Automatically adding public key to ~/.ssh/authorized_keys"
    cat /home/"$username"/.ssh/id_ed25519.pub >> /home/"$username"/.ssh/authorized_keys
    if [ $? -ne 0 ]; then
        echo "Failed to add public key to authorized_keys" >&2
        exit 1
    fi
    chmod 600 /home/"$username"/.ssh/authorized_keys
    chown "$username":"$username" /home/"$username"/.ssh/authorized_keys

    # Display public and private key contents
    echo "Please save the following SSH key contents to a secure location:"
    echo "===== Public Key (automatically added to /home/$username/.ssh/authorized_keys, save to client or other servers) ====="
    cat /home/"$username"/.ssh/id_ed25519.pub
    echo "===== Private Key (save to client's ~/.ssh/id_ed25519, do not lose) ====="
    cat /home/"$username"/.ssh/id_ed25519
    echo "===== Save the above keys immediately, the private key will be deleted from the server ====="

    # Delete private key file
    rm /home/"$username"/.ssh/id_ed25519
    if [ $? -eq 0 ]; then
        echo "Private key file deleted from server, ensure you saved the private key."
    else
        echo "Failed to delete private key file, please manually remove /home/$username/.ssh/id_ed25519" >&2
    fi
else
    echo "Custom workflow selected, please manually create a non-root user and configure SSH keys."
fi

# 3. Configure SSH security
sed -i '/^PermitRootLogin/s/.*/PermitRootLogin no/' /etc/ssh/sshd_config || echo 'PermitRootLogin no' >> /etc/ssh/sshd_config
sed -i '/^ChallengeResponseAuthentication/s/.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config || echo 'ChallengeResponseAuthentication no' >> /etc/ssh/sshd_config
sed -i '/^PasswordAuthentication/s/.*/PasswordAuthentication no/' /etc/ssh/sshd_config || echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config
sed -i '/^UsePAM/s/.*/UsePAM no/' /etc/ssh/sshd_config || echo 'UsePAM no' >> /etc/ssh/sshd_config
service sshd reload

# 4. Configure UFW firewall
apt install ufw -y
ufw allow OpenSSH
ufw default deny incoming
ufw default allow outgoing
ufw enable

# 5. Install and enable Fail2Ban
apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

# 6. Configure automatic security updates
apt install unattended-upgrades -y
echo 'Unattended-Upgrade::Automatic-Reboot-Time "02:00";' >> /etc/apt/apt.conf.d/50unattended-upgrades
systemctl reload unattended-upgrades.service

echo "VPS hardening script completed. In non-custom mode, public key was automatically added to /home/$username/.ssh/authorized_keys."
if [ "$customize" = "y" ]; then
    echo "Please manually complete non-root user creation and SSH key configuration."
fi