paulgit-server-tools

A collection of server hardening and administration scripts for Ubuntu 24.04.

---

Scripts

harden_ssh.sh

Hardens the OpenSSH daemon by replacing sshd_config with a security-focused configuration. The original config is backed up before any changes are made.

What it does:

• Disables root login and password authentication (public key only)
• Restricts SSH access to a single named OS user
• Limits authentication attempts, grace time, and concurrent sessions
• Disables X11 forwarding, agent forwarding, TCP tunnelling, and MOTD banners
• Restricts ciphers, MACs, and key exchange to modern algorithms only
• Validates the new config with sshd -t before reloading the daemon
• Automatically restores the backup if any step fails

Requirements: Ubuntu 24.04, openssh-server, must be run as root.

One-liner — download and run:

curl -fsSL https://code.paulg.it/paulgit/paulgit-server-tools/raw/branch/main/scripts/harden_ssh.sh | sudo bash -s -- --user YOUR_USERNAME

Replace YOUR_USERNAME with the OS user that should retain SSH access.
Before running, ensure that user has a public key in ~/.ssh/authorized_keys.

Options:

--user <username>   OS user to allow SSH access (prompted if omitted)
--dry-run           Print the config that would be written; make no changes
-h, --help          Show help and exit

Preview before applying:

bash harden_ssh.sh --user YOUR_USERNAME --dry-run

---

Disclaimer

No warranties are given for correct function. Always verify you can still SSH in from a second terminal before closing your existing session.