op-vps

Storage Policy: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

VPS Hardening and Setup

Target and options: $ARGUMENTS

1. Parse $ARGUMENTS for VPS IP address, --provider (default auto), and --profile (default normal). The profile determines the opsec posture applied across all phases.

2. Ask the user for SSH credentials or key path via AskUserQuestion if not obvious from the environment or arguments.

3. Set the opsec profile for the session:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" set <profile>
   

   • normal — standard hardening, full logging
   • stealth — aggressive hardening, minimal logging
   • paranoid — maximum hardening, no logging, encrypted everything

4. Phase 1 — SSH Hardening: Connect to the VPS and lock down SSH:

   • Deploy SSH public key and disable password authentication
   • Change SSH port to a non-standard port (randomized high port)
   • Set PermitRootLogin no, MaxAuthTries 3, AllowUsers <operator>
   • Restart sshd and verify reconnection on the new port

5. Phase 2 — Firewall Setup: Configure nftables with deny-by-default policy:

   • Default INPUT and FORWARD policy: DROP
   • Allow only the new SSH port, and any explicitly needed service ports
   • Allow established/related connections
   • Rate-limit new connections to prevent brute-force

6. Phase 3 — Fail2ban: Install and configure fail2ban:

   • Set up an aggressive SSH jail: maxretry=2, bantime=3600, findtime=600
   • Configure email or webhook notifications if desired
   • Enable and start the fail2ban service

7. Phase 4 — Unattended Upgrades: Configure automatic security patching:

   • Install unattended-upgrades package
   • Enable automatic security updates only (no feature updates)
   • Configure auto-reboot if needed (with time window)

8. Phase 5 — Encrypted Storage: Set up LUKS-encrypted container for operational data:

   • Create a file-backed LUKS container: dd if=/dev/urandom of=/root/vault.img bs=1M count=512
   • Format with LUKS: cryptsetup luksFormat /root/vault.img
   • Open and mount: cryptsetup open /root/vault.img vault && mkfs.ext4 /dev/mapper/vault && mount /dev/mapper/vault /mnt/vault
   • Ask user for the encryption passphrase via AskUserQuestion

9. Phase 6 — VPN Killswitch: Configure iptables rules to prevent traffic leaks:

   • Allow traffic only through VPN tunnel interface (tun0/wg0)
   • Allow loopback and the VPN server's IP on the physical interface
   • Drop all other outbound traffic
   • Persist rules with iptables-save

10. Phase 7 — DNS Leak Prevention: Force all DNS through VPN or Tor:

    • Set /etc/resolv.conf to use VPN-provided DNS or Tor DNS (127.0.0.1:5353)
    • Make resolv.conf immutable: chattr +i /etc/resolv.conf
    • Verify no DNS leaks with external test

11. Phase 8 — Log Management: Configure logging based on the opsec profile:

    • normal: standard syslog and journald, rotate weekly
    • stealth: minimal logging — disable auth.log verbose entries, reduce journal retention to 1 day
    • paranoid: disable all persistent logging — set Storage=volatile in journald.conf, truncate all log files, disable rsyslog

12. Log each setup phase to the ops tracker:

    node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <vps-ip> vps-setup <phase> "<action>" <result> <severity>
    

13. Write a comprehensive VPS setup report to the project directory. Include all configuration changes, credentials/ports to remember, and operational notes.