scripts/script_hardening.sh at main · f1forhelp/scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
#!/bin/bash

# Function to create user and add to sudo group
create_user_with_sudo() {
    local username="$1"

    # Check if username is provided
    if [[ -z "$username" ]]; then
        logk "e" "Username is required"
        return 1
    fi

    # Check if user already exists
    add_user "$username"

    # Add user to sudo group
    add_user_to_sudo_group "$username"

    # Set password for the user
    prompt_set_password "$username"

    logk "s" "User setup completed for '$username'"
}

copy_ssh_key(){
    local username="$1"
    local ssh_key="$2"

    # Check if username is provided
    if [[ -z "$username" ]]; then
        logk "e" "Username is required"
        return 1
    fi

    # Check if ssh_key is provided
    if [[ -z "$ssh_key" ]]; then
        logk "e" "SSH key is required"
        return 1
    fi

    # Copy the ssh key to the user's home directory
    logk "i" "Copying SSH key to user '$username'..."
    mkdir -p "/home/$username/.ssh"
    cat "$ssh_key" > "/home/$username/.ssh/authorized_keys"
    chmod 600 "/home/$username/.ssh/authorized_keys"
    chown -R "$username:$username" "/home/$username/.ssh"

    logk "s" "SSH key copied to user '$username' successfully"
}


change_sshd_config(){
    logk "i" "SSHD config change"
    read -p "Enter the port number for ssh or press enter to use default (22): " ssh_port
    if [ -z "$ssh_port" ]; then
        ssh_port=22
    fi


    loge ""
    logk "i" "SSHD config before change"
    sudo sshd -T | grep permitrootlogin
    sudo sshd -T | grep passwordauthentication
    sudo sshd -T | grep pubkeyauthentication
    sudo sshd -T | grep permituserenvironment
    sudo sshd -T | grep permittunnel
    sudo sshd -T | grep port
    append_line_to_start "/etc/ssh/sshd_config" "PermitRootLogin no"
    append_line_to_start "/etc/ssh/sshd_config" "PasswordAuthentication no"
    append_line_to_start "/etc/ssh/sshd_config" "PubkeyAuthentication yes"
    append_line_to_start "/etc/ssh/sshd_config" "PermitUserEnvironment no"
    append_line_to_start "/etc/ssh/sshd_config" "PermitTunnel no"
    append_line_to_start "/etc/ssh/sshd_config" "Port $ssh_port"
    sudo systemctl restart sshd
    loge ""
    logk "i" "SSHD config after change"
    sudo sshd -T | grep permitrootlogin
    sudo sshd -T | grep passwordauthentication
    sudo sshd -T | grep pubkeyauthentication
    sudo sshd -T | grep permituserenvironment
    sudo sshd -T | grep permittunnel
    sudo sshd -T | grep port
    logk "i" "Verify the sshd config above and press any key to continue"
    read -n 1 -s
    systemctl daemon-reload
    systemctl restart sshd
    # For digital ocean droplet agent
    systemctl restart droplet-agent.service
}

install_fail2ban(){
    logk "i" "Installing fail2ban..."
    sudo apt-get install -y fail2ban
    # sudo systemctl enable fail2ban
    # sudo systemctl start fail2ban
    sudo systemctl enable --now fail2ban
    sudo systemctl status fail2ban
    logk "i" "Fail2ban installed and enabled"
}


switch_to_user(){
    local username="$1"
    logk "i" "Switching to user '$username'..."
    sudo su - "$username"
}

system_update(){
    logk "i" "Updating system..."
    sudo apt-get update
    sudo apt-get upgrade -y
    sudo apt-get dist-upgrade -y
    sudo apt-get autoremove -y
}

script_hardening_one(){

    # Main script execution
    logk "i" "Starting hardening script one..."

    # Get username from user input
    logk "i" "Enter the username to create:"
    read -r username

    # Create user with sudo privileges
    create_user_with_sudo "$username"

    # Copy the ssh key to the user's home directory
    copy_ssh_key "$username" "/root/.ssh/authorized_keys"

    # Switch to user
    switch_to_user "$username"


    logk "i" "Hardening script completed"

}

script_hardening_two(){
    logk "i" "Starting hardening script two..."

    # Update system
    system_update

    # Change the sshd config
    change_sshd_config

    # Install fail2ban
    install_fail2ban

    # Install ufw
    script_firewall

    logk "i" "Hardening script two completed"

}

script_system_update(){
    logk "i" "Updating system..."
    system_update
}