Merge pull request 'Update bootstrap.sh' (#20) from dev into prod

Reviewed-on: #20

bootstrap.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-### 1. VARIABLES
+#################. VARIABLES
 MOTD="/etc/update-motd.d/01-custom"
 REBOOTBIN="/usr/sbin/reboot"
 REBOOTBINOLD="/usr/sbin/reboot.old"
@@ -10,15 +10,20 @@ REBOOTHANDLER="/root/scripts/reboot_handler.sh"
 CRONTABTMP="/tmp/crontab.root.tmp"
 HOSTNAME=$(hostname)
 KEYFILE="/root/.ssh/$HOSTNAME"
+TEMP_SCRIPT="/root/firstlogin.sh"
+TEMP_SCRIPT_WRAPPER="/root/firstloginwrapper.sh"
+TEMP_SCRIPT_CLEANER="/root/firstlogincleaner.sh"
 
 
-## 2. ALIASES
+#################. ALIASES
 echo "alias ll='ls -l --color=auto'" >> ~/.bashrc
 echo "alias l='ls -lAh --color=auto'" >> ~/.bashrc
+echo "" >> ~/.bashrc
+echo 'PS1="\u\[\e[0m\]@\[\e[31m\]\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]# "' >> ~/.bashrc
 source ~/.bashrc
 
 
-## 3. UPDATE & ESSENTIALS
+#################. UPDATE & ESSENTIALS
 apt update && apt -o Dpkg::Options::="--force-confold" upgrade -y
 apt install -y vim inxi fastfetch htop ncdu net-tools
 
@@ -55,13 +60,85 @@ fi
 EOF
 chmod +x $MOTD
 
+#################. Création du script first-login
+cat << 'EOF' > $TEMP_SCRIPT
+#!/bin/bash
 
-### 4. Hardening binaries
+HOSTNAME=$(hostname)
+KEYFILE="/root/.ssh/$HOSTNAME"
+
+echo
+echo "==============================="
+echo " Clé privée SSH à conserver !"
+echo "==============================="
+echo
+
+# Affichage dans TON shell
+cat "$KEYFILE"
+
+echo
+echo "==============================="
+
+# Suppression de la clé privée
+rm -f "$KEYFILE"
+
+# Durcissement SSH
+sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
+sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+
+systemctl restart sshd
+
+# Nettoyage différé
+nohup /root/firstlogincleaner.sh >/dev/null 2>&1 &
+exit 0
+EOF
+chmod +x $TEMP_SCRIPT
+
+
+
+cat << 'EOF' > $TEMP_SCRIPT_WRAPPER
+#!/bin/bash
+
+if [ -f /root/firstlogin.sh ]; then
+    /root/firstlogin.sh
+fi
+
+exit 0
+EOF
+chmod +x $TEMP_SCRIPT_WRAPPER
+
+
+cat << 'EOF' > $TEMP_SCRIPT_CLEANER
+#!/bin/bash
+
+# Attendre la fin du login
+sleep 2
+
+# Supprimer la ligne PAM
+sed -i '/firstloginwrapper.sh/d' /etc/pam.d/sshd
+
+# Supprimer les scripts
+rm -f /root/firstlogin.sh
+rm -f /root/firstloginwrapper.sh
+rm -f /root/firstlogincleaner.sh
+rm -f /root/bootstrap.sh
+
+exit 0
+EOF
+chmod +x $TEMP_SCRIPT_CLEANER
+
+echo "auth optional pam_exec.so stdout /root/firstloginwrapper.sh" >> /etc/pam.d/sshd
+
+
+#################. Hardening binaries
 # REBOOT WRAPPER
 mv $REBOOTBIN $REBOOTBINOLD
 cat << 'EOF' > $REBOOTBIN
 #!/bin/bash
 touch /var/log/restart-flag
+echo "[REBOOT] Rebooting server..."
 sleep 1
 /usr/sbin/reboot.old
 EOF
@@ -71,13 +148,14 @@ chmod +x $REBOOTBIN
 cat << 'EOF' > $SHUTBIN
 #!/bin/bash
 touch /var/log/restart-flag
+echo "[SHUTDOWN] Stopping server..."
 sleep 1
 shutdown -h now
 EOF
 chmod +x $SHUTBIN
 
 
-### 5. REBOOT HANDLER
+#################. REBOOT HANDLER
 mkdir -p $SCRIPTSDIR
 cat << 'EOF' > $REBOOTHANDLER
 #!/bin/bash
@@ -115,12 +193,12 @@ rm -f $CRONTABTMP
 touch /var/log/reboot.log
 
 
-### 6. Ajout route VPN
+### 7. Ajout route VPN
 echo "up ip route add 10.8.0.0/24 via 192.168.1.200" >> /etc/network/interfaces
 systemctl restart networking
 
 
-### 7. Hardening SSH
+### 8. Hardening SSH
 echo "AllowUsers root@192.168.1.250 #(PC_Aurel)" >> /etc/ssh/sshd_config
 echo "AllowUsers root@10.8.0.3 #(asus_r409l via VPN)" >> /etc/ssh/sshd_config
 systemctl restart sshd
@@ -134,43 +212,7 @@ ssh-keygen -t ed25519 -C "$HOSTNAME" -f "$KEYFILE" -N ""
 cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
 chmod 600 /root/.ssh/authorized_keys
 
-
-### 8. Création du script first-login
-cat << 'EOF' > /root/first-login.sh
-#!/bin/bash
-
-KEYFILE="/root/.ssh/id_ed25519"
-
-echo
-echo "==============================="
-echo " Clé privée SSH à conserver !"
-echo "==============================="
-echo
-cat "${KEYFILE}"
-echo
-echo "==============================="
-
-# Suppression de la clé privée
-rm -f "${KEYFILE}"
-
-# Durcissement SSH
-sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
-sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
-sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
-sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
-
-systemctl restart sshd
-
-# Désactivation du hook
-rm -f /root/.bash_firstlogin
-EOF
-
-chmod +x /root/first-login.sh
-
-# Hook pour exécuter first-login au premier login root
-echo "/root/first-login.sh" > /root/.bash_firstlogin
-
-# Ajout dans .bashrc
-if ! grep -q bash_firstlogin /root/.bashrc; then
-    echo '[ -f /root/.bash_firstlogin ] && bash /root/.bash_firstlogin' >> /root/.bashrc
-fi
+rm -fr /etc/systemd/system/bootstrap.service
+rm -fr /etc/systemd/system/multi-user.target.wants/bootstrap.service
+rm -fr /root/run-bootstrap.sh
+systemctl daemon-reload