Harden everything. Trust nothing.

Universal security hardener for proxy & VPN servers

Fortify automatically detects proxy and VPN services running on your server, scores their security posture (0–100, A+ to F), and hardens them with one-click profiles or granular manual controls.

💡 Best practice: Install your proxy/VPN backend first using its official installer, then run fortify to harden it. The built-in Deploy menu is available for quick setup if needed.

bash <(curl -sL https://github.com/SamNet-dev/fortify/raw/main/install.sh)

Then just run:

fortify

Fortify scans your server, detects running services, and presents an interactive TUI dashboard:

  ⚡ Fortify v0.9
  Harden everything. Trust nothing.
  by Sam — SamNet Technologies

  Detected Services:
  ├── ✓ Anti-Abuse (SMTP torrent)
  ├── ✓ Firewall (nftables) 3 ports open
  ├── ✓ hysteria2 v2.7.1 (running)
  ├── ✓ SSH :2222 key-only
  ├── ✓ WireGuard wg0 (3 peers)
  └── ✓ Xray v26.2.6 (running)

  Security Score: ████████████████░░░░ 82/100  [A]

Fortify scans for installed services on every launch — no configuration needed. Install a backend, run fortify, and it appears immediately.

Each module gets a score (0–100) based on its security posture. The overall score combines all modules into a single grade:

Apply a full hardening profile with one command:

fortify --profile paranoid

Available profiles:

• SMTP blocking — prevent spam (ports 25, 465, 587)
• Torrent blocking — port-based + deep packet inspection (DPI)
• Rate limiting — per-IP SYN flood protection
• Connection limits — cap concurrent connections
• IP blocking/whitelisting — single IPs or CIDR ranges

Block traffic by country using Xray's GeoIP database:

• Preset list: China, Russia, North Korea, Syria, Cuba, Venezuela, Belarus, Myanmar
• Custom country codes: add any 2-letter ISO code (e.g., TR, DE, PK)

• Disable password authentication (key-only)
• Change SSH port with automatic firewall update
• MaxAuthTries enforcement (minimum 4 — prevents lockout)
• fail2ban setup with Fortify-managed jail
• Cipher/KexAlgorithm hardening
• Lockout prevention: SSH access rule is always preserved in the firewall, even after flush

• Dual-stack: IPv4 + IPv6
• Supports nftables and iptables (auto-detected)
• Tagged rules for clean management (fortify-* comments)
• Persistent across reboot via systemd service
• SYN flood protection, invalid packet dropping, ICMP rate limiting

• Automatic backup before every change
• Checksum verification (SHA256)
• Named backups with timestamps
• Restore any previous state

• Telegram — bot token + chat ID
• Discord — webhook URL
• Custom webhook — any HTTP endpoint

# Interactive TUI
fortify

# Quick security scan
fortify --scan

# One-line status (great for monitoring)
fortify --status
# Output: fortify score=82 grade=A modules=8

# JSON report (for automation)
fortify --json

# Apply hardening profile
fortify --profile paranoid

# Deploy a new backend
fortify --deploy

# Backup all configs
fortify --backup

# Show version
fortify --version

/opt/fortify/
├── fortify.sh              # Main entry point + TUI + help pages
├── install.sh              # Installer
├── core/
│   ├── utils.sh            # Shared utilities, validators, logging
│   ├── tui.sh              # Terminal UI (menus, boxes, colors)
│   ├── firewall.sh         # nftables/iptables abstraction layer
│   ├── loader.sh           # Module loader + service scanner
│   ├── scorer.sh           # Score calculator + grade system
│   ├── backup.sh           # Backup/restore with checksums
│   ├── notify.sh           # Telegram/Discord/webhook notifications
│   ├── deployer.sh         # Backend installers
│   └── updater.sh          # Self-update mechanism
├── modules/
│   ├── antabuse.sh         # Anti-abuse (SMTP, torrent, rate limit)
│   ├── ssh.sh              # SSH hardening
│   ├── firewall_mod.sh     # Firewall module (audit, rules)
│   ├── xray.sh             # Xray/panel security
│   ├── wireguard.sh        # WireGuard hardening
│   ├── singbox.sh          # sing-box security
│   ├── hysteria.sh         # Hysteria 2 hardening
│   ├── openvpn.sh          # OpenVPN hardening
│   └── dnstt.sh            # DNSTT security
└── profiles/
    ├── paranoid.conf        # Maximum security
    ├── public-share.conf    # Balanced for shared servers
    └── minimal.conf         # Light touch

Fortify is designed to never lock you out of your server:

• 🔑 SSH port is always allowed in the firewall (even after flush)
• 🔑 MaxAuthTries minimum of 4 enforced (prevents multi-key lockout)
• 🔑 Password auth only disabled after confirming SSH keys exist
• 🔑 Root login falls back to prohibit-password if no keys found
• 🔑 Firewall flush automatically re-creates SSH safety rule
• 🔑 SSH port change updates the safety rule to match

Every rule Fortify creates is tagged with a fortify-* comment, making cleanup simple and preventing conflicts with other tools (Docker, fail2ban, etc.).

• Uses a separate inet fortify nftables table (never touches system tables)
• Backs up configs before every change
• All changes are reversible

• OS: Ubuntu 20.04+, Debian 11+, CentOS 8+, AlmaLinux 8+, Fedora 36+
• Bash: 4.4+
• Root access required
• Optional: jq (for Xray/sing-box JSON editing — installed automatically if missing)

MIT License — see LICENSE for details.

Sam — SamNet Technologies

• GitHub: github.com/SamNet-dev

⚡ Harden everything. Trust nothing.