ADVANCED / OPTIONAL

Security & network tuning

Two optional jobs: stop brute-force attempts, and make TCP faster. Each option says what it changes, whether it needs a reboot, and how to confirm it works.

Baseline security (key login, no passwords, a firewall, security updates) lives in Initialize VPS. Do that first; this page builds on it.

Server system

Debian / UbuntuRocky / Alma / CentOSAlpine

Debian 12/13, Ubuntu 22.04–26.04; Rocky / AlmaLinux 8–10, CentOS Stream 9/10, RHEL (dnf, some tools from EPEL); Alpine 3.x (apk + OpenRC). The script checks the host first and stops on a mismatch.

1. Brute-force protection

CrowdSec reads SSH and other logs to spot malicious IPs

NoneDetect onlyDetect and block

Detect: records suspicious IPs without blocking, good for watching first. Detect and block: adds the firewall bouncer to ban them. With password login off, the risk is already low. Alpine has no CrowdSec package.

2. TCP acceleration (BBR)

Better throughput on long or lossy routes

No changeEnable BBR (recommended)BBRv3 (new kernel)

BBR: uses the current kernel, works immediately, no reboot, any system. BBRv3: installs the XanMod kernel, Debian / Ubuntu x86_64 only, needs a reboot, and detects your CPU to pick the right build.

Package manager, output & identity

Install with

aptnala

Debian and Ubuntu only: apt by default, nala is installed first if selected. RHEL-family systems use dnf; Alpine uses apk.

How to use it

PasteScript

Paste mode stops on errors inside a subshell, preserving your SSH session. Script mode is for reviewing and saving a file.

Run as

rootsudo

A fresh reinstall is root, so the default commands have no sudo. Choose sudo when you are a normal user and sudo is already installed.

harden.txt

Choose protection or BBR on the left to build the commands.

The script ends with checks to run: cscli metrics shows whether CrowdSec reads logs, and sysctl net.ipv4.tcp_congestion_control shows whether BBR is active.