What is vpsshield?
vpsshield is an open-source, Python standard-library tool for VPS security. One tool, three steps: check your VPS, harden it safely, undo if needed. No daemon, no account, no telemetry.
Example
A fresh VPS, run check, see “SSH password ON, 10 ports open, fail2ban OFF” in one report — then run harden once, and re-run check to see the list turn green.
Install
Requirements: Ubuntu 22.04 / 24.04 or Debian 12, Python 3.10+, root (sudo) for harden and undo. check works without root, with some checks limited.
git clone https://github.com/mymyanmarland/vpsshield.git
cd vpsshield
python3 vpsshield.py check
python3 vpsshield.py harden --dry-run --yesDo not use blind curl | bash to install a security tool. Clone the repo, read the code, then run it. A verified one-line installer may be added later only with a published checksum.
Commands
| Command | What it does |
|---|---|
check [--json] [--output report.md] | Read-only security check. Never changes anything. |
harden [--dry-run] [--allow-port 22,80,443] [--yes] | Guarded hardening: backup first, lockout guard, sshd validation, then re-check. |
report | Print the last saved check report. |
undo [--backup DATE] | Restore sshd config from the latest backup. |
Running harden twice gives the same end state. --dry-run prints every planned change and changes nothing.
14 checks
| Group | Checks |
|---|---|
| SSH | Password login, root login, key available, key file permissions |
| Firewall | UFW active, default deny incoming, open ports review |
| fail2ban | Service active, sshd jail enabled |
| Updates | Pending updates (cached lists), reboot required, unattended updates |
| Users | Empty-password users (root only, names only), sudo users listed |
| Services / files | Listening services, /etc/shadow permissions |
Each check returns PASS / WARN / FAIL with a fix hint. The score is a guide, never a security guarantee. Listening on a port does not mean internet-reachable — UFW is the deciding layer, reported separately.
Safety — what vpsshield never does
- Never prints a key, password, or token.
- Never deletes
authorized_keys, never removes sudo access automatically. - Never disables SSH password login when no public key exists — that would lock you out, so harden aborts instead.
- Never reboots. Reboot is reported, done by the owner.
- Never sends data anywhere. No telemetry, no cloud API, no remote control.
- Never closes your current SSH port without warning.
Limitations (honest)
- UFW/fail2ban checks need those tools installed; missing = FAIL, not a guess.
- fail2ban covers the sshd jail only in v0.1. Web-log jails behind a proxy need real-IP setup first.
- No dashboard, no multi-VPS panel, no alerts in v0.1.
- A high score is not a guarantee. If a server may already be compromised, rebuild it and rotate keys — do not just harden it in place.
License: MIT. Version: v0.1 (public repo, see Install).