Harden SSH
Disables root and password login, keeps keys. Destructive: verify your key access first.
Security
fail2ban
fail2ban with the SSH jail, active and verified.
A recipe is not a frozen script: it is a verified playbook that drives an AI run. Reconnaissance first, idempotent by design, and every step proves itself before the next one starts.
- Category
- Security
- Risk
- caution
- Verified steps
- 3
- Estimated
- ~2 min
- Systems
- Ubuntu · Debian · RHEL · Fedora · Rocky · AlmaLinux
01
Reconnaissance — before touching anything
The run starts read-only. Before a single change, Servor checks the real state of your server — a real machine is rarely clean, and only what is actually there decides what happens next.
- 01fail2ban already installed?
- 02service active?
02
The steps — each one proves itself
The playbook below guides the run; the model adapts each command to the distribution and state found during reconnaissance. A step only counts as done when its verification passes.
- 01
Install fail2ban
Verified by
command -v fail2ban-server - 02
Enable
Verified by
systemctl is-active fail2ban - 03
Check the sshd jail
Verified by
fail2ban-client status sshd 2>&1 | grep -c Jail
03
How Servor runs this recipe
Servor is zero-knowledge: the platform cannot execute anything on its own. When you launch this recipe, an AI run reads the reconnaissance, plans the steps, and asks for your approval. Each approved command is signed by your browser — with a key the server never sees — then relayed to the agent, which verifies the signature locally before executing.
- Read-only reconnaissance before any change
- Every command signed by your browser, approved by you
- Each step verified before the run moves on
More security recipes
Run this recipe on your server
Connect a server, launch the recipe, and approve each step as Servor executes and verifies it. Free plan, no card required.