A practical guide to securing your Linux server (Ubuntu/Debian) with UFW, Fail2ban, and Cloudflare Tunnel.
- UFW Firewall setup
- Fail2ban SSH protection
- Cloudflare Tunnel (zero-trust access)
- SSH hardening
- Security audit scripts
# Clone this repo
git clone https://github.com/moinsen-dev/server-hardening.git
cd server-hardening
# Run the hardening script (as root)
sudo ./scripts/harden.sh┌─────────────────────────────────────────┐
│ Cloudflare Access │ ← Layer 1: Auth (Email OTP)
├─────────────────────────────────────────┤
│ Cloudflare Tunnel │ ← Layer 2: No open ports
├─────────────────────────────────────────┤
│ UFW Firewall │ ← Layer 3: Port filtering
├─────────────────────────────────────────┤
│ Fail2ban │ ← Layer 4: Brute-force protection
├─────────────────────────────────────────┤
│ SSH Key Auth │ ← Layer 5: No passwords
└─────────────────────────────────────────┘
curl -fsSL https://raw.githubusercontent.com/moinsen-dev/server-hardening/main/scripts/harden.sh | sudo bashcurl -fsSL https://raw.githubusercontent.com/moinsen-dev/server-hardening/main/scripts/ssh-harden.sh | sudo bashcurl -fsSL https://raw.githubusercontent.com/moinsen-dev/server-hardening/main/scripts/audit.sh | sudo bashAfter running the hardening script, verify:
| Check | Command | Expected |
|---|---|---|
| UFW active | sudo ufw status |
Status: active |
| SSH only | sudo ufw status |
22/tcp ALLOW |
| Fail2ban running | sudo systemctl status fail2ban |
active (running) |
| SSH jail active | sudo fail2ban-client status sshd |
Currently banned: 0 |
| No root login | grep PermitRootLogin /etc/ssh/sshd_config |
no |
| Key auth only | grep PasswordAuthentication /etc/ssh/sshd_config |
no |
# Run audit
./scripts/audit.sh
# Or online scanners:
# - https://www.shodan.io/host/YOUR_IP
# - https://hackertarget.com/nmap-online-port-scanner/
# - https://securityheaders.com/MIT License - Use freely, stay safe!
PRs welcome! Found a security improvement? Open an issue.