admin/bootstrap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update bootstrap.sh

Browse Source
This commit is contained in:
admin
2026-06-12 17:06:26 +02:00
parent fb0ec5b9db
commit cb4dc21abb
1 changed files with 40 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
bootstrap.sh
View File

@@ -10,6 +10,7 @@ REBOOTHANDLER="/root/scripts/reboot_handler.sh"
CRONTABTMP="/tmp/crontab.root.tmp"
HOSTNAME=$(hostname)
KEYFILE="/root/.ssh/$HOSTNAME"
MOTD_TEMP="/etc/update-motd/02-temp"
## 2. ALIASES
@@ -55,8 +56,42 @@ fi
EOF
chmod +x $MOTD
### 4. Création du script first-login
### 4. Hardening binaries
cat << 'EOF' > $MOTD_TEMP
#!/bin/bash
RED='\033[0;31m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
HOSTNAME=$(hostname)
KEYFILE="/root/.ssh/$HOSTNAME"
echo
echo -e "${BLUE}===============================${NC}"
echo -e "${BLUE} Clé privée SSH à conserver !${NC}"
echo -e "${BLUE}===============================${NC}"
echo
cat "${KEYFILE}"
echo
echo "${BLUE}===============================${NC}"
# Suppression de la clé privée
rm -f "${KEYFILE}"
# Durcissement SSH
sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
rm -fr $MOTD_TEMP
EOF
chmod +x $MOTD_TEMP
### 5. Hardening binaries
# REBOOT WRAPPER
mv $REBOOTBIN $REBOOTBINOLD
cat << 'EOF' > $REBOOTBIN
@@ -77,7 +112,7 @@ EOF
chmod +x $SHUTBIN
### 5. REBOOT HANDLER
### 6. REBOOT HANDLER
mkdir -p $SCRIPTSDIR
cat << 'EOF' > $REBOOTHANDLER
#!/bin/bash
@@ -115,12 +150,12 @@ rm -f $CRONTABTMP
touch /var/log/reboot.log
### 6. Ajout route VPN
### 7. Ajout route VPN
echo "up ip route add 10.8.0.0/24 via 192.168.1.200" >> /etc/network/interfaces
systemctl restart networking
### 7. Hardening SSH
### 8. Hardening SSH
echo "AllowUsers root@192.168.1.250 #(PC_Aurel)" >> /etc/ssh/sshd_config
echo "AllowUsers root@10.8.0.3 #(asus_r409l via VPN)" >> /etc/ssh/sshd_config
systemctl restart sshd
@@ -132,33 +167,4 @@ ssh-keygen -t ed25519 -C "$HOSTNAME" -f "$KEYFILE" -N ""
# Ajouter la clé publique dans authorized_keys
cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
### 8. Création du script first-login
cat << 'EOF' > /root/first-login.sh
#!/bin/bash
HOSTNAME=$(hostname)
KEYFILE="/root/.ssh/$HOSTNAME"
echo
echo "==============================="
echo " Clé privée SSH à conserver !"
echo "==============================="
echo
cat "${KEYFILE}"
echo
echo "==============================="
# Suppression de la clé privée
rm -f "${KEYFILE}"
# Durcissement SSH
sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
EOF
chmod 600 /root/.ssh/authorized_keys