Linux Server Init & SSH Hardening Script (linux-ssh-init-sh)

🇨🇳 中文文档 | 🇺🇸 English

A production-ready, POSIX-compliant shell script designed to initialize Linux servers and harden SSH security in minutes.

It safely handles SSH key deployment, port changing, user creation, TCP BBR enablement, and system updates, while ensuring compatibility across Debian, Ubuntu, CentOS, RHEL, and Alpine Linux.

✨ Key Features

Universal Compatibility: Works flawlessly on Debian 10/11/12, Ubuntu, CentOS 7/8/9, Alma/Rocky, and Alpine Linux.
POSIX Compliant: Written in pure /bin/sh. No bash dependency. Runs perfectly on dash (Debian) and ash (Alpine/Busybox).
Safety Architecture:
- Managed Config Block: Inserts configuration at the top of sshd_config to strictly override vendor defaults (bypasses the Debian 12 Include trap).
- Atomic Verification: Validates config with sshd -t before restarting. Automatically rolls back on failure to prevent downtime.
- Anti-Lockout: If SSH keys fail to deploy, it will not disable password login, ensuring you don't lose access.
- Firewall Awareness: Automatically detects and configures ufw or firewalld if port is changed.
Smart Interactions:
- Fetches public keys from GitHub, URL, or Direct Paste.
- Random High Port: Generates a random port between 20000-60000 and checks for availability using ss/netstat.
- System Update & TCP BBR: Optional one-click optimization.

🚀 Quick Start

Run the following command as root.

Standard Run (Interactive)

curl -fsSL [https://raw.githubusercontent.com/247like/linux-ssh-init-sh/main/init.sh](https://raw.githubusercontent.com/247like/linux-ssh-init-sh/main/init.sh) -o init.sh && chmod +x init.sh && ./init.sh

Force English UI

./init.sh --lang=en

⚙️ Command Line Arguments

The script accepts the following arguments to control its behavior:

Argument	Description
`--lang=en`	Force the interactive interface to use English.
`--lang=zh`	Force the interactive interface to use Chinese (Default behavior asks if not specified).
`--strict`	Strict Mode. If enabled, the script will exit immediately if any critical step (like downloading keys or generating a port) fails, instead of falling back to defaults. Recommended for CI/CD or automated pipelines.

⚙️ Strict Mode vs. Normal Mode

Feature	Normal Mode (Default)	Strict Mode (`--strict`)
Philosophy	"Don't Lockout" (Best Effort)	"Compliance First" (Zero Tolerance)
Key Failure	If key download fails, script keeps Password Auth enabled and warns you.	Script exits immediately. No changes applied.
Port Failure	If random port generation fails, it falls back to Port 22.	Script exits immediately.
Use Case	Manual setup, unstable networks.	CI/CD pipelines, high-security requirements.

💡 Examples

1. Standard interactive installation (English):

./init.sh --lang=en

2. Strict mode for high-security requirements: If the GitHub key cannot be downloaded, the script will abort rather than falling back to password login.

./init.sh --strict

🛠️ Technical Logic

Dependency Check: Auto-detects package manager (apt, yum, apk) and installs minimal dependencies (curl, sudo, openssh-server).
User Setup: Creates the specified user (if not root) and grants password-less sudo privileges.
Key Deployment: Fetches keys, validates format, fixes .ssh permissions (SELinux context safe), and writes to authorized_keys.
Config Writing:
- Backs up sshd_config.
- Removes old script-managed blocks.
- Writes a new block at the beginning of the file to ensure priority over Include directives.
Finalization: Validates config syntax, restarts SSH service, and applies BBR/Updates if requested.

⚠️ Disclaimer

This script modifies critical system configurations (SSH). While it includes multiple safety checks and automatic rollback mechanisms, please ensure you have an alternative access method (such as a VNC/KVM Console) to your server to prevent lockout in case of network interruptions or unexpected configuration errors.

📄 License

This project is released under the MIT License.

If you found this tool helpful, please give it a ⭐ Star!

Report Bug · Request Feature