Linux Security Bash Scripts

Security hardening on Linux isn't a one-time task — it's a set of checks you run every time you set up a server, every time you deploy new software, and periodically on servers that have been running for a while. The checks are not exotic. Most of them come down to four questions: who can read what, who can connect from where, what ports are listening, and are the certificates current?

The scripts on this page answer those four questions. They don't require security tools, scanners, or paid software. They use chmod, ssh-keygen, ss, and openssl — the same tools that came with your Linux install.

File permissions are the most common security misconfiguration on Linux servers. Not 777 on a web root (obviously wrong) but more subtle issues: world-readable configuration files containing database passwords, log directories writable by the web server user, SSH authorized_keys files with group-write permissions that sshd silently ignores but that indicate a broader permission problem. file-permissions-security audits and corrects the most common of these.

Open ports are the attack surface. Every port in LISTEN state on 0.0.0.0 is a service that can be reached from the internet. Most of them should be. Some of them shouldn't — debug interfaces left open, old services from previous configurations, packages that start listeners on install without asking. list-open-ports-linux maps your complete listening surface in one command. Run it on a new server before you open firewall rules.

SSH key authentication is the single highest-value security upgrade for any Linux server that accepts remote access. Disabling password authentication and switching to key pairs eliminates the entire class of brute-force SSH attacks. ssh-key-setup-script automates the setup so there's no manual copying of authorized_keys files and no risk of locking yourself out.

SSL certificate expiry is the silent failure. certbot renews automatically — until it doesn't. A failed renewal produces no alert visible to the user until the certificate expires and browsers start showing the warning. check-ssl-certificate-expiry runs the check from outside the server (the same way a browser would), catches the failure that the renewal hook misses, and gives you 30 days of warning before the site goes red.