Linux-scripts

A collection of interactive, fully user-configurable scripts for provisioning and hardening Linux dedicated servers.

Scripts

Shell Compatibility

All scripts support direct execution, bash script.sh, and sh script.sh. When started with sh, they relaunch themselves with Bash, preserving arguments and standard input. Bash must be installed; these are not pure POSIX shell scripts. The generated cron updaters use the same launcher.

Download scripts to a file before running them. Piping them into sh or sourcing them is not supported.

sudo sh ./install-pterodactyl.sh
sudo bash ./install-pterodactyl.sh

dedi-audit.sh

Interactive system information, performance, and security audit with optional report saving. Performance checks write a temporary 128 MiB test file and run short CPU benchmarks; security checks do not change system configuration.

sh ./dedi-audit.sh
bash ./dedi-audit.sh --all

install-pterodactyl.sh

Fully interactive Pterodactyl Panel and Wings installer for Debian, Ubuntu, RHEL, Rocky Linux, and AlmaLinux.

What it does:

• Detects the OS and installs the correct packages
• Configures MariaDB (local or remote) with randomly generated credentials
• Installs Redis, PHP-FPM, Caddy (replaces nginx), and optionally Docker
• Downloads and installs the Pterodactyl Panel from the target directory
• Runs migrations and seeds the database
• Creates the first admin user, location, and node with random credentials
• Generates a Caddyfile with automatic HTTPS for both the Panel URL and the Wings FQDN
• Optionally installs Wings and Docker on the same host
• Sets up the queue worker systemd service and cron scheduler
• Saves generated credentials to pterodactyl-credentials.txt in the script directory

Usage:

sudo ./install-pterodactyl.sh

secure-server.sh

Interactive dedicated server firewall hardening script with ipsum scanner blocking.

What it does:

• Detects the OS and installs iptables, ipset, and persistence tools
• Downloads the ipsum blocklist and populates an ipset
• Blocks all IPs from the ipsum scanner/bruteforce database via iptables
• Offers preset port configurations:
  • Basic web — 80, 443
  • Game servers — Minecraft, Valheim, ARK, Rust, Source engine, DayZ, 7 Days to Die, Factorio, Satisfactory, Project Zomboid, FiveM
  • Voice — TeamSpeak, Mumble
  • All of the above
  • Custom — select ports manually
• Each port can be restricted to specific source IPs/CIDR
• SSH hardening: key-only authentication, root login prohibited, password auth disabled
• Auto-generates an ED25519 SSH key pair for root if none exists
• Applies kernel hardening via sysctl (reverse path filtering, source route disable, syncookies, ICMP flood protection, disabled unused modules)
• Saves iptables rules persistently and configures daily ipsum blocklist auto-updates

Usage:

sudo ./secure-server.sh

vpn-setup.sh

Interactive WireGuard VPN setup with SSH restricted to the server's public IP only.

What it does:

• Installs WireGuard on Debian, Ubuntu, RHEL, Rocky Linux, or AlmaLinux
• Generates server and client key pairs
• Creates a WireGuard interface with configurable VPN subnet
• Generates per-client configuration files
• Configures iptables to allow VPN traffic and restrict SSH to the server's public IP only
• Enables IP forwarding and NAT for VPN clients
• Persists firewall rules across reboots

Usage:

sudo ./vpn-setup.sh

install-pelican.sh

Interactive Pelican.dev installer (native PHP, no Docker) for Debian, Ubuntu, RHEL, Rocky Linux, and AlmaLinux.

What it does:

• Detects the OS and installs PHP-FPM, MariaDB, Redis, Caddy, and Composer
• Downloads the latest Pelican Panel release to /var/www/pelican
• Configures the .env, database, and application settings
• Runs migrations and seeds the database
• Creates the first admin user with random credentials
• Configures Caddy with automatic HTTPS for the Panel domain
• Sets up the queue worker systemd service and cron scheduler
• Optionally installs Wings on the same host
• Sets up a daily auto-updater via /etc/cron.daily/pelican-update
• Saves generated credentials to pelican-credentials.txt in the script directory

Usage:

sudo ./install-pelican.sh

Auto-Updaters

Both install-pterodactyl.sh and install-pelican.sh configure daily auto-updaters:

• Pterodactyl: /etc/cron.daily/pterodactyl-update
• Pelican: /etc/cron.daily/pelican-update

Each updater:

• Checks GitHub for the latest release
• Downloads and extracts the new release
• Preserves .env and storage/ (user uploads, logs, cache)
• Reinstalls composer dependencies
• Runs database migrations
• Clears caches and restarts the queue worker

Requirements

• Root access
• Debian, Ubuntu, RHEL, Rocky Linux, or AlmaLinux
• curl, openssl
• Bash (4 or newer for associative arrays used by the firewall and VPN scripts)
• Internet connectivity for package and image downloads

Credentials

After running any installer, credentials are saved to the script directory:

• /root/scripts/pterodactyl-credentials.txt (Pterodactyl)
• /root/scripts/pelican-credentials.txt (Pelican)

Both files are created with chmod 600 and contain admin passwords, database passwords, and connection details.

Notes

Shell compatibility tests (Python 3 required):

python3 -B -m unittest discover -s tests -p test_shell_compatibility.py -v

These check Bash syntax and safe launcher probes, not live provisioning or firewall changes. sh -n is not a valid whole-file check for scripts that relaunch with Bash before reaching Bash-specific syntax.

• The Pterodactyl Panel directory defaults to /var/www/pterodactyl but can be changed interactively
• Existing .env files are backed up before modification
• Existing Caddy configurations are backed up before replacement
• Wings is installed on the same host by default but can be skipped for remote node setups
• The ipsum blocklist is updated daily via cron
• Pelican uses a native PHP installation (no Docker) with Caddy as the web server
• Pelican Wings is a separate binary that connects to the Panel via the configured domain
• Both installers include daily auto-updaters that preserve config and user data

vpn-setup.sh

Interactive WireGuard VPN setup with SSH restricted to the server's public IP only.

What it does:

• Installs WireGuard on Debian, Ubuntu, RHEL, Rocky Linux, or AlmaLinux
• Generates server and client key pairs
• Creates a WireGuard interface with configurable VPN subnet
• Generates per-client configuration files
• Configures iptables to allow VPN traffic and restrict SSH to the server's public IP only
• Enables IP forwarding and NAT for VPN clients
• Persists firewall rules across reboots

Usage:

sudo ./vpn-setup.sh

gre-tunnel.sh

Interactive GRE tunnel setup for BuyVM DDoS-filtered VPS.

What it does:

• Creates a GRE tunnel between a BuyVM VPS (unfiltered IP) and a remote destination server
• Supports two modes:
  • Basic — general-purpose GRE tunnel for any traffic
  • Docker/Pterodactyl — DDoS-protected game servers with proper routing, NAT, and DNS configuration
• Configures NAT to masquerade traffic through the BuyVM DDoS-filtered IP
• Forwards specified ports (or all ports) over the GRE tunnel
• Configures source routing on the remote server for proper return traffic
• Supports optional SSH-based remote server configuration
• Persists the tunnel across reboots via /etc/rc.local
• Tests the tunnel with ping after setup

Usage:

sudo ./gre-tunnel.sh