How to Keep Your Server from Becoming a Sitting Duck with konstruktoid's Hardening Scripts

Imagine you've just deployed a fresh Ubuntu instance. Everything's running, SSH is open, packages are updated. You feel secure—until you check the logs and see endless brute-force login attempts from around the globe. Default Linux distro settings prioritize convenience over security, so hardening a system requires hours of tweaking SSH configs, configuring firewalls, and restricting service permissions.

The repository author under the handle konstruktoid decided to simplify this routine and assembled scripts for automatic Ubuntu hardening. This isn't just a set of commands—it's an entire strategy for turning a regular OS into a digital fortress, with control through systemd as the cornerstone.

What exactly this script does

The core idea of the project is to minimize the attack surface as much as possible. If a service isn't needed, it should be disabled. If a service is running, it should have exactly the permissions required to perform its task.

The script checks the system against a comprehensive list of criteria, many of which are taken from CIS (Center for Internet Security) recommendations. Here are a few areas where it brings order:

• Kernel parameter configuration via sysctl. This includes blocking packet forwarding (IP forwarding), spoofing protection, and restricting access to kernel debugging functions.
• Hardening file permissions on system files. The script checks permissions on /etc/shadow, /etc/gshadow, and other critical configs so that regular users or compromised web applications can't read them.
• Restricting systemd services. This is perhaps the most interesting part. The script uses modern systemd isolation features, such as PrivateTmp, NoNewPrivileges, and ProtectSystem.
• Kernel module management. Rarely used protocols (like DCCP or SCTP) and filesystems that often become sources of vulnerabilities are disabled.

How it works in practice

The project is written in Shell, which makes it transparent for auditing. You can simply read the code before running it and understand exactly what will change in your system. To get started, just clone the repository and run the main script as root.

git clone https://github.com/konstruktoid/hardening.git
cd hardening
sudo bash ubuntu.sh

By the way, the author has a separate version for Debian, but this repository is focused specifically on Ubuntu (versions 20.04, 22.04, and 24.04). Interestingly, the script doesn't just modify configs—it also installs additional security tools, for example, auditd for deep system call logging.

Fine-tuning for your needs

Running the script head-on on a live production system is a risky endeavor. Hardening is always a trade-off between security and functionality. If you disable the ability to load certain kernel modules, Docker or specific network hardware might stop working.

The project includes a configuration file where you can override variables. For example, if you absolutely need IPv6 (which the script tries to restrict by default), you can adjust this in the settings. I'd recommend running the script first on a test VM that fully replicates your production tech stack.

Why you should pay attention to the systemd edition

Many older Linux security guides still recommend editing dozens of files in /etc/. The konstruktoid approach is more modern: it actively uses systemd's modularity. Instead of rewriting the main service unit file, drop-in files are created. This allows updating packages via apt without configuration conflicts, while your security customizations remain in effect.

The script also checks for compromised packages and suggests removing software that often becomes a security hole, such as old implementations of rsh or telnet.

Who will find this project useful

If you administer a couple of servers for personal projects, this repository will become a great checklist. You don't have to run the entire script— you can borrow good solutions for configuring ufw or sysctl parameters.

For system administrators in companies, this is a ready-made foundation for creating your own corporate golden image. Instead of reinventing the wheel, you can take konstruktoid's work and adapt it to your compliance requirements.

However, remember: security is a process. Running the script today doesn't guarantee protection against a vulnerability that emerges tomorrow. But it definitely raises the bar for a potential attacker so high that they'll most likely go look for easier prey.

Where to start learning

1. Look at the ubuntu.sh file. This is the entry point from which the other modules are called.
2. Explore the scripts/ folder. The logic is broken down by category: network, filesystem, permissions.
3. Be sure to read the section on environment variables in the README to understand how to control the script's behavior without editing its code.

The project is alive and regularly updated for new Ubuntu releases and incorporates the latest security recommendations. This is a great example of how automation turns hours of routine work into a task that takes minutes.