Agent skill · security · aradotso
server-security-init-skill
Agent skill for safely initializing and hardening fresh Ubuntu/Debian SSH servers with staged security improvements
Why this skill is useful
Adds executable scripts and a comprehensive workflow for securely initializing and hardening Ubuntu/Debian servers, which the AI cannot generate on its own.
What it needs
Requires npx installed locally. About 7k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Server Security Init Skill Skill by ara.so — Security Skills collection. This skill guides you through safely initializing and hardening fresh Ubuntu/Debian SSH servers. It implements a staged bootstrap flow: selecting or generating local SSH keys, requiring public-key login before remote changes, creating a non-root sudo user, changing the SSH port, disabling root/password login, configuring UFW firewall, setting up fail2ban, and verifying no lockout conditions exist. What This Skill Does The server-security-init skill provides guidance for: Public-key SSH bootstrap without exposing root passwords in commands, logs, or config files Staged SSH hardening with verified non-root sudo login before disabling old access paths UFW firewall setup with default-deny inbound policy and explicit port allowances Fail2ban jail configuration for SSH brute-force protection with management IP exceptions Debian 12/systemd socket checks to prevent ssh.socket from silently keeping SSH on the old port Server-side verification using ss -ltnp, sshd -T, systemctl, and ufw status Recovery checks for fail2ban bans, firewall mistakes, and SSH listener mismatches Installation This skill should be installed by copying the server-security-init/ directory to your AI agent's user-level skills directory. For AI agents: Install only the server-security-init/ directory, NOT the repository root Do not execute server initialization during skill installation After installation, inform the user if their agent needs to restart or reload skills For humans using npx: Target specific agents: Staged Security Initialization Flow Stage 1: Pre-Flight Checks and Bootstrap Before making any changes, gather and verify: Verify existing SSH key or generate: Test password-based root SSH access (initial): Stage 2: Install Public Key Copy your public key to the server: Verify public-key login works: CRITICAL: Do not proceed until public-key authentication is verified. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/server-security-init-skill