Linux Base Setup v2.0

Modular, production-ready server hardening script for Debian/Ubuntu systems.

🖥️ Platform Support

Distributions

• ✅ Ubuntu: 20.04 LTS, 22.04 LTS, 24.04 LTS
• ✅ Debian: 11 (Bullseye), 12 (Bookworm)

Architectures

• ✅ AMD64/x86_64: Fully supported (primary platform)
• ✅ ARM64/aarch64: Fully supported (tested on Raspberry Pi 4, AWS Graviton)
• ⚠️ ARM32/armv7l: Limited support (basic features)

See PLATFORM_COMPATIBILITY.md for detailed compatibility information.

🚀 Quick Start

One-Line Install (Recommended)

curl -sSL https://raw.githubusercontent.com/crxnit/Linux-Base-Setup-2026/main/install.sh | sudo bash

After installation, run from anywhere:

sudo harden --dry-run    # Preview changes
sudo harden              # Run hardening

Manual Install

# Clone the repository
git clone https://github.com/crxnit/Linux-Base-Setup-2026.git
cd Linux-Base-Setup-2026

# Preview changes (dry run)
sudo ./harden.sh --dry-run

# Run with default configuration
sudo ./harden.sh

# Run with custom configuration
cp config/custom.conf.template config/custom.conf
nano config/custom.conf
sudo ./harden.sh --config config/custom.conf

✨ What's New

v2.1.x Improvements

• Multi-Architecture Support: Full support for AMD64, ARM64, and ARM32
• Platform Detection: Automatic distribution and architecture detection
• Essential Tools Auto-Install: Automatically installs sudo, curl, vim on minimal systems
• Improved Dry-Run Mode: No files created during preview, works on fresh systems
• Symlink Support: Works correctly when installed via /usr/local/bin/harden

v2.0 Features

• Modular Architecture: Clean separation of concerns with dedicated modules
• Configuration Files: Manage settings without editing scripts
• Dry-Run Mode: Preview all changes before applying
• Better Error Handling: Comprehensive error checking and rollback capability
• Enhanced Logging: Detailed, color-coded logging with timestamps
• Progress Indicators: Visual feedback for long-running operations
• Non-Interactive Mode: Full automation support for provisioning
• Modern Security: Updated SSH ciphers, CrowdSec, AppArmor, and more
• Comprehensive Testing: Pre-flight checks and validation

📋 Features

Core Hardening

• ✅ SSH Hardening

  • Custom port configuration
  • Disable root login and password authentication
  • Modern key exchange algorithms and ciphers
  • Optional two-factor authentication (2FA)
  • Connection rate limiting

• ✅ Firewall Configuration

  • UFW or firewalld support
  • Automatic SSH port allowance
  • Customizable port rules
  • Rate limiting for services

• ✅ Kernel Hardening (sysctl)

  • IP spoofing protection
  • SYN flood protection
  • ICMP broadcast/redirect protection
  • Kernel information restriction
  • Memory randomization (ASLR)

• ✅ User Management

  • Automated admin user creation
  • SSH key deployment
  • Password policy enforcement
  • Umask configuration

Security Tools

• 🛡️ CrowdSec: Modern, collaborative intrusion prevention with real-time threat intelligence
• 📊 Auditd: Comprehensive file integrity and system call auditing
• 🔍 RKHunter: Rootkit detection
• 🔐 Lynis: Security auditing (optional)
• 🗃️ AIDE: Advanced intrusion detection (optional)

System Configuration

• ⏰ Time Synchronization: Chrony or systemd-timesyncd
• 🔄 Unattended Upgrades: Automatic security updates
• 🏷️ Hostname Management: Auto-generated or custom hostnames
• 🚫 Protocol Filtering: Disable uncommon network protocols
• 🔒 AppArmor: Mandatory access control (optional)

📁 Project Structure

linux-base-setup-v2/
├── harden.sh                    # Main orchestration script
├── config/
│   ├── default.conf             # Default configuration
│   └── custom.conf.template     # Template for customization
├── modules/
│   ├── utils.sh                 # Utility functions
│   ├── user.sh                  # User management
│   ├── ssh.sh                   # SSH hardening
│   ├── firewall.sh              # Firewall configuration
│   ├── hardening.sh             # Kernel hardening
│   ├── security_tools.sh        # Security tool installation
│   └── updates.sh               # System updates & NTP
├── logs/                        # Execution logs
└── README.md

⚙️ Configuration

Using Configuration Files

1. Create custom configuration:

cp config/custom.conf.template config/custom.conf
nano config/custom.conf

2. Modify settings:

# Example custom.conf
ADMIN_USERNAME="johndoe"
SSH_PORT=2222
FIREWALL_TYPE="ufw"
UFW_ALLOWED_PORTS="22/tcp,80/tcp,443/tcp,3000/tcp"
TIMEZONE="America/New_York"

3. Run with custom config:

sudo ./harden.sh --config config/custom.conf

Key Configuration Options

Setting	Default	Description
SSH_PORT	2222	Custom SSH port
SSH_PASSWORD_AUTH	no	Allow password authentication
FIREWALL_TYPE	ufw	Firewall type (ufw/firewalld/none)
INSTALL_CROWDSEC	true	Install and configure CrowdSec
INSTALL_AUDITD	true	Install and configure Auditd
ENABLE_UNATTENDED_UPGRADES	true	Enable automatic security updates
NTP_SERVICE	chrony	NTP service (chrony/systemd-timesyncd)

See config/default.conf for complete list of options.

🎯 Usage Examples

Interactive Mode (Default)

sudo ./harden.sh

Script will prompt for:

• Admin username
• Passwords
• SSH key deployment
• Hostname
• Timezone
• Optional features

Non-Interactive Mode (Automation)

# Configure in custom.conf
INTERACTIVE=false
ADMIN_USERNAME="admin"
HOSTNAME="web-server-01"
TIMEZONE="UTC"

# Run
sudo ./harden.sh --non-interactive

Dry Run (Preview Changes)

sudo ./harden.sh --dry-run

Shows what would be changed without applying modifications.

Skip Specific Components

# Skip updates and firewall
sudo ./harden.sh --skip-updates --skip-firewall

# Skip security tools
sudo ./harden.sh --skip-crowdsec --skip-auditd

Custom Configuration

# Use specific config file
sudo ./harden.sh --config /path/to/myconfig.conf

# Combine with other options
sudo ./harden.sh --config config/custom.conf --dry-run

🔒 Security Levels

Basic Hardening

# config/custom.conf
CONFIGURE_SSH=true
SSH_PORT=2222
CONFIGURE_FIREWALL=true
INSTALL_CROWDSEC=true
CONFIGURE_SYSCTL=true

Medium Security

# Add to basic configuration
INSTALL_AUDITD=true
INSTALL_RKHUNTER=true
CONFIGURE_PASSWORD_POLICY=true
PASSWORD_MIN_LENGTH=12
DISABLE_UNCOMMON_PROTOCOLS=true

High Security

# Add to medium configuration
SSH_PASSWORD_AUTH="no"
CONFIGURE_APPARMOR=true
DISABLE_USB_STORAGE=true
PASSWORD_MIN_LENGTH=16
CROWDSEC_ENROLL=true              # Enroll in CrowdSec Console for shared threat intelligence
CROWDSEC_ENROLL_KEY="your-key"    # Get from app.crowdsec.net
# Enable 2FA during interactive setup

🎨 Server Type Configurations

Web Server

UFW_ALLOWED_PORTS="22/tcp,80/tcp,443/tcp"
FIREWALL_TYPE="ufw"
INSTALL_CROWDSEC=true
ENABLE_UNATTENDED_UPGRADES=true

Database Server

UFW_ALLOWED_PORTS="22/tcp,3306/tcp,5432/tcp"
FIREWALL_TYPE="ufw"
CONFIGURE_APPARMOR=true
INSTALL_AUDITD=true

Development Server

UFW_ALLOWED_PORTS="22/tcp,80/tcp,443/tcp,3000/tcp,8000/tcp,8080/tcp"
INSTALL_DOCKER=true
CONFIGURE_SYSCTL=true

⚠️ Important Warnings

Before Running

1. Backup Access: Ensure you have alternative access to the server
2. Test Environment: Test on a non-production server first
3. Firewall Rules: Verify required ports are in allowed list
4. SSH Keys: Have your SSH public key ready
5. Documentation: Review log files after completion

During Execution

1. DO NOT CLOSE your current SSH session
2. Test new SSH connection from separate terminal before disconnecting
3. Verify firewall allows SSH on new port
4. Confirm SSH key authentication works

Critical Steps

# After script completion, from ANOTHER terminal:
ssh -p <NEW_PORT> <ADMIN_USER>@<SERVER_IP>

# Verify you can:
1. Connect with SSH key
2. Escalate to sudo
3. Access required services

# Only then close original session

📊 Logging and Monitoring

Log Files

# Main execution log
/var/log/hardening/hardening-YYYYMMDD_HHMMSS.log

# Backup directory
/var/backups/hardening-YYYYMMDD_HHMMSS/

# Completion report
/var/backups/hardening-YYYYMMDD_HHMMSS/completion_report.txt

Monitoring Commands

# View CrowdSec status
sudo cscli metrics
sudo cscli decisions list
sudo cscli alerts list

# View auditd logs
sudo ausearch -k identity
sudo ausearch -k sshd_config

# View firewall status
sudo ufw status verbose
# or
sudo firewall-cmd --list-all

# View SSH connections
sudo journalctl -u sshd -n 50

# Run security audit
sudo lynis audit system

🔧 Troubleshooting

SSH Connection Issues

# Test SSH config
sudo sshd -t

# Check SSH service
sudo systemctl status sshd
sudo journalctl -u sshd -n 50

# Verify firewall
sudo ufw status
sudo ufw allow <PORT>/tcp

Firewall Lockout

# If locked out, access via console/KVM and:
sudo ufw disable
sudo ufw allow <SSH_PORT>/tcp
sudo ufw enable

Restore from Backup

# Find backup
ls -la /var/backups/hardening-*/

# Restore SSH config
sudo cp /var/backups/hardening-*/sshd_config /etc/ssh/sshd_config
sudo systemctl restart sshd

🚦 Exit Codes

Code	Description
0	Success
1	General error
2	Invalid arguments
3	Not running as root
4	Unsupported distribution
5	Pre-flight check failed

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test thoroughly
5. Submit a pull request

📝 License

MIT License - see LICENSE file for details

🙏 Credits

• Original script: linux-base-setup v1.0
• Modernized and modularized: v2.0
• Security best practices from CIS Benchmarks and NIST guidelines

📞 Support

• Issues: https://github.com/crxnit/Linux-Base-Setup-2026/issues
• Discussions: https://github.com/crxnit/Linux-Base-Setup-2026/discussions
• Documentation: https://github.com/crxnit/Linux-Base-Setup-2026/wiki

🔖 Version History

v2.2.5 (Current)

• 2FA Grace Period: 15-minute grace period for SSH 2FA
  • No TOTP prompt if successfully authenticated within last 15 minutes
  • Uses pam_timestamp.so to track recent authentications
  • Reduces friction for frequent SSH sessions

v2.2.4

• Fixed SSH 2FA: Public key + TOTP without password prompt
  • Comments out @include common-auth in PAM to disable password
  • Authentication flow: public key first, then TOTP code only
  • Added KbdInteractiveAuthentication yes for newer OpenSSH versions

v2.2.3

• Improved Post-Install Instructions: Clear guidance for activating sudo access
  • Shows exec su -l $USER command to activate sudo without logout
  • Simplified Quick Start instructions with sudo prefix
  • Reordered steps for better workflow

v2.2.2

• Sudoers Configuration: Automatically adds users to sudo group
  • If run via sudo, adds the invoking user to sudo group
  • If run as root, adds all regular users (UID >= 1000) to sudo group
  • Prevents "user is not in the sudoers file" errors

v2.2.1

• Enhanced Install Script: Full automation for fresh minimal installations
  • Runs apt update && apt upgrade before installation
  • Automatically installs essential tools (sudo, curl, git, vim, gnupg, ca-certificates)
  • Creates sudo group if missing
  • Clear progress indicators during installation

v2.2.0

• CrowdSec Integration: Replaced Fail2Ban with CrowdSec for modern intrusion prevention
  • Collaborative threat intelligence from global community
  • Automatic IP reputation checking
  • Support for iptables and nftables bouncers
  • Optional CrowdSec Console enrollment
• Updated configuration options for CrowdSec
• Updated documentation and examples

v2.1.6

• Script now continues on component failures instead of exiting
• Added failure tracking and summary report at end
• Fixed Fail2Ban "no log file found" error on fresh installs

v2.1.5

• Fixed root check to run before any directory operations
• Fixed Fail2Ban failing to start on Debian 12/Ubuntu 22.04+
• Made RKHunter database update non-fatal

v2.1.4

• Moved root check to run before banner display
• Fixed backup warnings for files that don't exist yet
• Fixed fail2ban-client status causing script exit
• Removed dist-upgrade prompt (now config-driven)
• Added one-line install instructions to README

v2.1.3

• Fixed dry-run mode exiting on missing directories
• Fixed repository URLs in install.sh and documentation
• Improved dry-run handling for essential tools installation

v2.1.2

• Fixed symlink path resolution for installed command
• Works correctly when called via /usr/local/bin/harden

v2.1.1

• Added essential tools auto-installation (sudo, curl, vim)
• Works on minimal server installations

v2.1.0

• Multi-architecture support (AMD64, ARM64, ARM32)
• Distribution-specific configurations
• Enhanced platform detection and validation

v2.0.0

• Complete modular rewrite
• Configuration file support
• Dry-run mode
• Enhanced error handling
• Modern security standards
• Comprehensive logging

v1.0.0 (Legacy)

• Initial release
• Basic hardening features
• Single-file script

---

⚠️ Always test in a non-production environment first!

Remember: Security is a process, not a product. Regular updates, monitoring, and audits are essential.