hpsr.sh is the interactive Bash assistant that applies a rock-solid technical baseline on brand-new servers: non-root admin user, cryptographic SSH keys, default-deny UFW firewall, Fail2ban, and automatic security patches without Ansible bloat or manual oversights.
Paste this command into your terminal as root to launch the interactive wizard:
0 dependencies outside standard Bash. No changes are applied until your explicit confirmation.
Every technical decision is calculated to eliminate common attack vectors on internet-facing servers without hurting developer ergonomics.
Provisions a dedicated administrative user with clean sudoers membership and ~/.ssh directory restricted to strict permissions (700 for directories, 600 for authorized keys).
Disables PermitRootLogin and PasswordAuthentication. Installs managed Ed25519 key pairs, validates sshd_config with sshd -t before reloading, and moves the listening port to 666 (or your custom choice).
Enables kernel firewalling with default deny incoming and allow outgoing. Strictly allows only your configured SSH port and essential web traffic (80/tcp and 443/tcp), with prompts for custom extra ports.
Installs and provisions Fail2ban with a sane SSH jail: 1-hour ban after 5 failed authentication attempts inside a 10-minute window (findtime: 10m, bantime: 1h, maxretry: 5).
Configures unattended-upgrades so Debian or Ubuntu silently fetches and applies critical security patches for kernel and core packages in the background without destructive restarts.
Generates a timestamped backup of sshd_config prior to edits, logs every executed command, compiles a detailed Markdown report, encrypts key bundles, and optionally delivers alerts via Resend.
Neither the fragility of improvised manual setups nor the heavy operational overhead of enterprise orchestrators for single servers.
| Criteria | Manual setup by hand | RECOMENDADO hpsr.sh | Ansible / CIS Benchmark |
|---|---|---|---|
| Average setup time | 30 to 60 minutes | < 60 seconds | 2 to 4 hours (crafting playbooks) |
| Required dependencies | None (ad-hoc commands) | 0 dependencies (Standard Bash & apt) | Python, Ansible, control node, SSH agent |
| Learning curve | Medium (remembering flags & syntax) | Zero (guided interactive wizard) | High (YAML, roles, inventories, vault) |
| SSH lockout protection | None (easy to break sshd syntax) | Protected (syntax checked with sshd -t) | Requires extensive staging tests |
| Firewall + Fail2ban included | Manual step frequently forgotten | Configured and active out of the box | Requires dedicated roles and tasks |
| Backups & change logs | Rarely documented | Automatic sshd backup + log + MD report | Depends on custom playbook design |
No hidden black magic. hpsr.sh presents a system snapshot, allows step-by-step configuration, and requires your explicit confirmation before applying a single change.
Once execution finishes, verify the firewall state, Fail2ban jails, and your new SSH connection in just 10 seconds:
sudo ufw status verbose Ensures the firewall is "active", defaults to deny incoming, and only exposes authorized ports.
sudo fail2ban-client status sshd Displays currently banned IPs and active jail filters in real-time.
ssh -p 666 -i ~/.ssh/your_key adminops@YOUR_IP Verify connectivity with your new user and port before exiting the active root session.
sudo systemctl status unattended-upgrades Confirms background automatic patching is active and healthy.
Transparent technical answers to the most common questions regarding hpsr.sh internals.
hpsr.sh rigorously validates the syntax of your OpenSSH configuration using `sshd -t` before restarting or reloading any daemon. Additionally, the wizard explicitly asks you to open a separate terminal window and test logging in with your new user and key before closing your root session. If anything fails, your current session stays intact.
Moving SSH off port 22 is not encryption, but it is outstanding noise reduction: it cuts out over 98% of automated port scanners and brute-force bots on the public internet. If you prefer another port or want to keep port 22, the wizard allows you to input any port number.
hpsr.sh is specifically designed and optimized for fresh or newly restored VPS servers (Greenfield environments). If Docker is already installed, UFW rules can interfere with iptables chains managed by Docker. We strongly recommend running hpsr.sh as step one on a clean machine before installing Docker or production stacks.
If you opt to have hpsr.sh generate an Ed25519 key pair, the public key is appended to authorized_keys inside a clearly marked managed block. The private key is output to the console and can be bundled into a password-encrypted zip or dispatched via Resend email. Sensitive temporary files are scrubbed right after.
No. hpsr.sh installs zero proprietary daemons, telemetry agents, or background processes. It only installs standard packages from official Debian/Ubuntu repositories via apt (ufw, fail2ban, unattended-upgrades, curl, zip). Once finished, nothing remains running in memory.
The source code of hpsr.sh is 100% open, readable, and auditable. You can inspect it directly in your terminal using `curl -fsSL https://sh.hpsr.dev/setup.sh | less` or by checking the GitHub repository at https://github.com/hopsersmerk/hpsr.sh.