Lion Cipher Lab

Write a bash script to harden a fresh Linux server

• Cyber / Security Engineer
• Intermediate
• ~75 min
• Free · no account required

Why it matters

The first hour on a brand-new server is the same handful of jobs every time: make a non-root user, lock down SSH, turn on a firewall, switch on automatic security updates, install a brute-force blocker. Doing it by hand from memory means you forget a step, do it slightly differently each time, and can't prove what you did. A script fixes all three: it's repeatable, it's reviewable, and it's the honest way real engineers work — infrastructure as code. Learning to write it also teaches you actual bash, which is the glue language of every Linux and DevOps job.

What you'll learn

• Bash scripting (variables, conditionals, functions)
• set -euo pipefail and error handling
• Idempotency
• Automating server hardening
• SSH lockdown, UFW, unattended-upgrades, Fail2Ban

Steps in this lab

1. What you're building — and the one safety rule that matters most
2. Create the script file and make it runnable
3. The safety header: set -euo pipefail
4. A guard: refuse to run unless we're root
5. Function 1 — create the non-root user (idempotently)
6. Function 2 — lock down SSH (the step that can lock you out)
7. Function 3 — turn on the firewall, SSH-safe
8. Function 4 — automatic security updates
9. Function 5 — install Fail2Ban
10. Wire it together in main() and run it
11. What you actually walked away with

Open the full interactive lab →