# Harden Linux Web Hosting Safely

Linux hosting setup can lock users out or expose services when steps are rushed. This skill guides ordered SSH, firewall, Nginx, DNS, and TLS changes with validation gates.

## Install

```bash
npx skillstore add xixu-me/secure-linux-web-hosting
```

## Metadata

- Status: approved
- Slug: xixu-me-secure-linux-web-hosting
- Skillstore revision: r1
- Version status: missing
- Tree hash: addbba16e19385d11383c7ca088f0ce98d40ebe5024048d083ab4f797c69883a
- Author: xixu-me
- GitHub username: xixu-me
- License: MIT
- Repository: https://github.com/xixu-me/skills/tree/main/skills/secure-linux-web-hosting/
- Ref: 64ca8af0f54a325752f08bd54e52151061ea659a
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 75
- Public page: https://skillstore.pages.dev/skills/xixu-me-secure-linux-web-hosting
- Manifest: https://skillstore.pages.dev/api/skills/xixu-me-secure-linux-web-hosting/manifest

## Capabilities

- Routes advice by Linux distro family before package or service commands are suggested.
- Separates static-site hosting from Nginx reverse-proxy hosting workflows.
- Orders SSH hardening steps to reduce lockout risk.
- Guides firewall exposure with a deny-by-default inbound posture.
- Checks HTTPS readiness before certificate issuance and redirects.
- Defers BBR and kernel tuning until secure hosting is stable.

## Use Cases

- Launch a personal site: Plan a safe first setup for DNS, Nginx, SSH, firewall rules, and HTTPS on a new Linux VPS.
- Review a small server: Check whether SSH, firewall exposure, Nginx routing, and TLS sequencing follow safe operational order.
- Troubleshoot a proxy rollout: Separate app health, loopback binding, Nginx configuration, DNS, and certificate issues during deployment.

## Prompt Templates

### Start a safe VPS setup

```
Help me set up a new Linux VPS for a website. Ask what you need first, then give the safest phase sequence.
```

### Harden SSH and firewall

```
Review my SSH and firewall plan for a Linux web server. Focus on lockout risk and public port exposure.
```

### Configure Nginx hosting branch

```
Help me choose between static Nginx hosting and a reverse proxy. I will share my app type, domain, and distro.
```

### Audit TLS rollout order

```
Audit my HTTPS rollout sequence for DNS, HTTP validation, certificate issuance, renewal, redirects, and failure recovery.
```

## Limitations

- It does not design Kubernetes, PaaS, or container orchestration deployments.
- It does not cover Windows or macOS host administration.
- It requires current official documentation for exact distro commands.
- It is not a full SRE review for complex multi-tenant production platforms.

## Best Practices

- Verify distro-specific package names, service units, and config paths before giving commands.
- Keep a second SSH session or recovery path before changing authentication rules.
- Validate each phase before moving to the next risky hosting change.

## Anti Patterns

- Do not disable SSH password or root login from the only active session.
- Do not expose backend application ports publicly when Nginx can proxy loopback.
- Do not force HTTP-to-HTTPS redirects before HTTPS is proven healthy.

## Security Audit

- Audited at: 2026-07-08T09:59:44.709\+00:00
- Summary: Static findings were reviewed against the skill context and are false positives. The skill is documentation for authorized Linux web hosting tasks and emphasizes verification, safety gates, and official docs. No prompt injection, exfiltration intent, or unauthorized scanning behavior was found.

## Stats

- Views: 96
- Downloads: 17
- Favorites: 0
- Popularity score: 0