Linux Server Hardening & Utility Guide#

1. Initial System Setup#

Timezone & Updates#

timedatectl set-timezone America/Toronto

apt update && apt full-upgrade -y

Warpification (Terminal UI)#

echo -e '\n# Auto-Warpify\nprintf '\''\eP$f{"hook": "SourcedRcFileForWarp", "value": { "shell": "bash", "uname": "'$(uname)'" }}\x9c'\'' ' >> ~/.bashrc

Essential Package Installation#

For Virtual Machines (Full Suite):

apt install gdebi curl sudo gpg ethtool ngrep lshw lsscsi cifs-utils ncdu etherwake lshw sudo tasksel fail2ban openssh-server qemu-guest-agent unzip smbclient fio iperf3 nmap net-tools apt-transport-https software-properties-common wget duf tldr zip git eza snapd samba glances -y

For LXC Containers (Lightweight):

apt install curl gpg sudo fail2ban apt-transport-https software-properties-common wget etherwake zip git -y

Security Scripts#

Run the AI protection script from the Mac Studio volume:

/Volumes/Software/Software/Scripts/MacOS/ai_deploy_safety_on_all_servers.sh

2. User & Access Management#

Root Password & Sudo Users#

# Change root password
sudo passwd root

# Create user 'marc' with NOPASSWD sudo
adduser --home /home/marc marc && usermod -aG sudo marc
echo "marc ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/marc

# Create user 'chr'
adduser --home /home/chr chr && usermod -aG sudo chr

Configure SSH Public Key#

Edit authorized keys:

nano ~/.ssh/authorized_keys

Paste SSH keys for 1Password Private note

Restart SSH:

systemctl restart sshd

In some cases, the file is located here:
nano /etc/pve/priv/authorized_keys

Edit SSH config:

nano /etc/ssh/sshd_config

Ensure the following settings:

PermitRootLogin prohibit-password
#PermitRootLogin yes
PubkeyAuthentication yes

Apply changes:

systemctl restart sshd

n8n Restricted SSH User#

Created for secure command execution from the n8n container.

# Create system user
adduser --system --home /home/n8n --shell /bin/bash --group n8n

# Setup SSH Directory
mkdir -p /home/n8n/.ssh
chown -R n8n:n8n /home/n8n
chmod 700 /home/n8n/.ssh

# Add public key from n8n host (HP1GPU)
nano /home/n8n/.ssh/authorized_keys

# Paste key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6oOUXHpXQDKMiFGmjWqZNAg6rw00a33HkooILzyeim root@HP1GPU

# Finalize Permissions
chmod 600 /home/n8n/.ssh/authorized_keys
chown n8n:n8n /home/n8n/.ssh/authorized_keys

3. Storage Maintenance#

SSD Trimming#

# Manual trim
fstrim -v /

# Enable weekly automation
systemctl enable --now fstrim.timer

# Verify schedule
systemctl list-timers fstrim.timer

LVM Partition Extension (Ubuntu)#

# Identify drive
df -h

# Extend Logical Volume
lvextend -l +100%FREE /dev/mapper/ubuntu--vg-ubuntu--lv

# Resize Filesystem
resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv

4. Security: #Fail2ban & #UFW#

Fail2ban Hardened Strategy#

Strategy: 3 failed attempts in 24h = 1-year ban (8760h).

Setup local config:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
echo "[INCLUDES]
before = paths-debian.conf

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 YOUR_HOME_IP_HERE
bantime  = 1h
findtime  = 1h
maxretry = 5
backend  = systemd
banaction = ufw

[sshd]
enabled  = true
port     = ssh
maxretry = 3
findtime = 24h
bantime  = 8760h
filter   = sshd[mode=aggressive]" > /etc/fail2ban/jail.local

Restart:

systemctl restart fail2ban

UFW Firewall Setup#

Reset#

sudo ufw --force reset

Deny Incoming#

sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow Trusted SSH
sudo ufw allow from 72.11.191.80 to any port 22 proto tcp
sudo ufw allow from 24.114.107.66 to any port 22 proto tcp
# Allow Web & WireGuard
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp
sudo ufw enable

Terminal Aliases#

#alias

Specific Docker and 1Password Aliases

# Edit aliases
/root/.bashrc

5. Network Shares (Samba - #SMB)#

apt install samba
smbpasswd -a marc

Config (nano /etc/samba/smb.conf):

nano /etc/samba/smb.conf

[paperless]
   path = /mnt/paperless/media/documents/originals/
   browseable = yes
   read only = no
   guest ok = no
   valid users = "marc"
   force user = "marc"

sudo systemctl restart smbd

Restricted #SMB - Only User#

sudo adduser --system --shell /usr/sbin/nologin --no-create-home --group proxmox
sudo smbpasswd -a proxmox

7. Maintenance Tools#

Malware Scanning#

sudo apt install rkhunter chkrootkit -y

# Run check
sudo rkhunter --check --sk

# Update baseline after clean scan
sudo rkhunter --propupd

QEMU Guest Agent (Proxmox Integration)#

apt-get install qemu-guest-agent
systemctl start qemu-guest-agent
systemctl enable qemu-guest-agent

RClone Installation#

curl [https://rclone.org/install.sh](https://rclone.org/install.sh) | sudo bash

# Configure remotes
rclone config