The catalogue
Hardening
ufw on SSH only, fail2ban, root closed and passwords off once a key opens dev.
- Module
- core.hardening
- Category
- Base
What it installs
- ufw, open on SSH only — port 22, and 443 as an option if your network blocks 22.
- fail2ban on the SSH jail, with the defaults Ubuntu ships.
- AllowUsers dev and a ClientAlive setting that keeps the app’s session from dropping silently.
- Password authentication disabled, and root login closed unless you keep it — last, and only after the app has verified that your key opens dev.
What it asks you for
- Whether SSH should also listen on 443.
- Whether to keep root access. Off, root is closed and dev becomes the only way in; on, root stays reachable by SSH key — never by password — and the rest of the hardening applies unchanged.
Good to know
This module is mandatory, and it is the one that can lock you out. It refuses to close root until a key has actually opened dev; if that check fails, nothing is closed and the app tells you why. An exposure module that needs ports 80 and 443 opens them under rules of its own, which this one never takes back.