Default VPS configs are insecure by design. Root login enabled, password auth on, no firewall. Most operators mean to fix it. Most never do it thoroughly.

This kit removes the excuse. Hardening scripts, Ansible playbooks, and checklists built around the CIS Benchmark. Run it once, document it, stop being the low-hanging fruit.

── What's inside ── • Bash hardening script: disables root SSH, key-only auth, UFW defaults, sysctl hardening, auto security updates (Ubuntu 22.04 / Debian 12) • Ansible playbook variant for multi-server operators • fail2ban config: tuned jails for SSH, Nginx, and common web apps • CrowdSec integration guide + bouncers config for Nginx/Traefik • Lynis audit wrapper: CIS-aligned scan with prioritised remediation output • Hardening checklist (Markdown + PDF): 60-point sign-off list • UNDO.md: every change the script makes and how to revert it

── FAQ ── Q: How experienced do I need to be? A: Solid Linux fundamentals required — systemd, permissions, read scripts before running. UNDO.md logs every change and how to revert it. Not a point-and-click tool.

Q: What's in the kit and how do I access it? A: Private GitHub repo: bash script, Ansible playbook, fail2ban/CrowdSec configs, Lynis wrapper, 60-point checklist (Markdown + PDF). Instant access via Whop.

Q: Which providers work and will it be maintained? A: Any VPS with root access — Hetzner, DigitalOcean, Vultr. Ubuntu 22.04 / Debian 12. Updates on breaking changes; critical fixes pushed promptly.