Compare commits
10 Commits
a0faa7629d
...
dev
| Author | SHA1 | Date | |
|---|---|---|---|
| 44b0b866b8 | |||
| 35a7d7888f | |||
| 2d5f13ba98 | |||
| 1a35d6d60a | |||
| 521f77cf5b | |||
| 018ce95617 | |||
| ce9e345d37 | |||
| 8dd3bbe8a3 | |||
| 89d496bfdd | |||
| 003dc11383 |
32
bootstrap.sh
32
bootstrap.sh
@@ -11,13 +11,15 @@ CRONTABTMP="/tmp/crontab.root.tmp"
|
|||||||
HOSTNAME=$(hostname)
|
HOSTNAME=$(hostname)
|
||||||
KEYFILE="/root/.ssh/$HOSTNAME"
|
KEYFILE="/root/.ssh/$HOSTNAME"
|
||||||
TEMP_SCRIPT="/root/firstlogin.sh"
|
TEMP_SCRIPT="/root/firstlogin.sh"
|
||||||
TEMP_SCRIPT_WRAPPER="root/firstloginwrapper.sh"
|
TEMP_SCRIPT_WRAPPER="/root/firstloginwrapper.sh"
|
||||||
TEMP_SCRIPT_CLEANER="root/firstlogincleaner.sh"
|
TEMP_SCRIPT_CLEANER="/root/firstlogincleaner.sh"
|
||||||
|
|
||||||
|
|
||||||
#################. ALIASES
|
#################. ALIASES
|
||||||
echo "alias ll='ls -l --color=auto'" >> ~/.bashrc
|
echo "alias ll='ls -l --color=auto'" >> ~/.bashrc
|
||||||
echo "alias l='ls -lAh --color=auto'" >> ~/.bashrc
|
echo "alias l='ls -lAh --color=auto'" >> ~/.bashrc
|
||||||
|
echo "" >> ~/.bashrc
|
||||||
|
echo 'PS1="\u\[\e[0m\]@\[\e[31m\]\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]# "' >> ~/.bashrc
|
||||||
source ~/.bashrc
|
source ~/.bashrc
|
||||||
|
|
||||||
|
|
||||||
@@ -89,7 +91,7 @@ sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd
|
|||||||
systemctl restart sshd
|
systemctl restart sshd
|
||||||
|
|
||||||
# Nettoyage différé
|
# Nettoyage différé
|
||||||
nohup /root/first-login-cleaner.sh >/dev/null 2>&1 &
|
nohup /root/firstlogincleaner.sh >/dev/null 2>&1 &
|
||||||
exit 0
|
exit 0
|
||||||
EOF
|
EOF
|
||||||
chmod +x $TEMP_SCRIPT
|
chmod +x $TEMP_SCRIPT
|
||||||
@@ -99,8 +101,8 @@ chmod +x $TEMP_SCRIPT
|
|||||||
cat << 'EOF' > $TEMP_SCRIPT_WRAPPER
|
cat << 'EOF' > $TEMP_SCRIPT_WRAPPER
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
if [ -f /root/first-login.sh ]; then
|
if [ -f /root/firstlogin.sh ]; then
|
||||||
/root/first-login.sh
|
/root/firstlogin.sh
|
||||||
fi
|
fi
|
||||||
|
|
||||||
exit 0
|
exit 0
|
||||||
@@ -112,21 +114,22 @@ cat << 'EOF' > $TEMP_SCRIPT_CLEANER
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Attendre la fin du login
|
# Attendre la fin du login
|
||||||
sleep 10
|
sleep 2
|
||||||
|
|
||||||
# Supprimer la ligne PAM
|
# Supprimer la ligne PAM
|
||||||
sed -i '/first-login-wrapper.sh/d' /etc/pam.d/sshd
|
sed -i '/firstloginwrapper.sh/d' /etc/pam.d/sshd
|
||||||
|
|
||||||
# Supprimer les scripts
|
# Supprimer les scripts
|
||||||
rm -f /root/first-login.sh
|
rm -f /root/firstlogin.sh
|
||||||
rm -f /root/first-login-wrapper.sh
|
rm -f /root/firstloginwrapper.sh
|
||||||
rm -f /root/first-login-cleaner.sh
|
rm -f /root/firstlogincleaner.sh
|
||||||
|
rm -f /root/bootstrap.sh
|
||||||
|
|
||||||
exit 0
|
exit 0
|
||||||
EOF
|
EOF
|
||||||
chmod +x $TEMP_SCRIPT_CLEANER
|
chmod +x $TEMP_SCRIPT_CLEANER
|
||||||
|
|
||||||
echo "auth optional pam_exec.so stdout /root/first-login-wrapper.sh" >> /etc/pam.d/sshd
|
echo "auth optional pam_exec.so stdout /root/firstloginwrapper.sh" >> /etc/pam.d/sshd
|
||||||
|
|
||||||
|
|
||||||
#################. Hardening binaries
|
#################. Hardening binaries
|
||||||
@@ -135,6 +138,7 @@ mv $REBOOTBIN $REBOOTBINOLD
|
|||||||
cat << 'EOF' > $REBOOTBIN
|
cat << 'EOF' > $REBOOTBIN
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
touch /var/log/restart-flag
|
touch /var/log/restart-flag
|
||||||
|
echo "[REBOOT] Rebooting server..."
|
||||||
sleep 1
|
sleep 1
|
||||||
/usr/sbin/reboot.old
|
/usr/sbin/reboot.old
|
||||||
EOF
|
EOF
|
||||||
@@ -144,6 +148,7 @@ chmod +x $REBOOTBIN
|
|||||||
cat << 'EOF' > $SHUTBIN
|
cat << 'EOF' > $SHUTBIN
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
touch /var/log/restart-flag
|
touch /var/log/restart-flag
|
||||||
|
echo "[SHUTDOWN] Stopping server..."
|
||||||
sleep 1
|
sleep 1
|
||||||
shutdown -h now
|
shutdown -h now
|
||||||
EOF
|
EOF
|
||||||
@@ -206,3 +211,8 @@ ssh-keygen -t ed25519 -C "$HOSTNAME" -f "$KEYFILE" -N ""
|
|||||||
# Ajouter la clé publique dans authorized_keys
|
# Ajouter la clé publique dans authorized_keys
|
||||||
cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
|
cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
|
||||||
chmod 600 /root/.ssh/authorized_keys
|
chmod 600 /root/.ssh/authorized_keys
|
||||||
|
|
||||||
|
rm -fr /etc/systemd/system/bootstrap.service
|
||||||
|
rm -fr /etc/systemd/system/multi-user.target.wants/bootstrap.service
|
||||||
|
rm -fr /root/run-bootstrap.sh
|
||||||
|
systemctl daemon-reload
|
||||||
Reference in New Issue
Block a user