Merge pull request 'Update bootstrap.sh' (#9) from dev into prod

Reviewed-on: #9

bootstrap.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-#################. VARIABLES
+### 1. VARIABLES
 MOTD="/etc/update-motd.d/01-custom"
 REBOOTBIN="/usr/sbin/reboot"
 REBOOTBINOLD="/usr/sbin/reboot.old"
@@ -10,20 +10,16 @@ REBOOTHANDLER="/root/scripts/reboot_handler.sh"
 CRONTABTMP="/tmp/crontab.root.tmp"
 HOSTNAME=$(hostname)
 KEYFILE="/root/.ssh/$HOSTNAME"
-TEMP_SCRIPT="/root/firstlogin.sh"
+MOTD_TEMP="/etc/update-motd/02-temp"
-TEMP_SCRIPT_WRAPPER="/root/firstloginwrapper.sh"
-TEMP_SCRIPT_CLEANER="/root/firstlogincleaner.sh"
 
 
-#################. ALIASES
+## 2. ALIASES
 echo "alias ll='ls -l --color=auto'" >> ~/.bashrc
 echo "alias l='ls -lAh --color=auto'" >> ~/.bashrc
-echo "" >> ~/.bashrc
-echo 'PS1="\u\[\e[0m\]@\[\e[31m\]\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]# "' >> ~/.bashrc
 source ~/.bashrc
 
 
-#################. UPDATE & ESSENTIALS
+## 3. UPDATE & ESSENTIALS
 apt update && apt -o Dpkg::Options::="--force-confold" upgrade -y
 apt install -y vim inxi fastfetch htop ncdu net-tools
 
@@ -60,27 +56,29 @@ fi
 EOF
 chmod +x $MOTD
 
-#################. Création du script first-login
+### 4. Création du script first-login
-cat << 'EOF' > $TEMP_SCRIPT
+
+cat << 'EOF' > $MOTD_TEMP
+
 #!/bin/bash
+RED='\033[0;31m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
 
 HOSTNAME=$(hostname)
 KEYFILE="/root/.ssh/$HOSTNAME"
 
 echo
-echo "==============================="
+echo -e "${BLUE}===============================${NC}"
-echo " Clé privée SSH à conserver !"
+echo -e "${BLUE} Clé privée SSH à conserver !${NC}"
-echo "==============================="
+echo -e "${BLUE}===============================${NC}"
 echo
-
+cat "${KEYFILE}"
-# Affichage dans TON shell
-cat "$KEYFILE"
-
 echo
-echo "==============================="
+echo "${BLUE}===============================${NC}"
 
 # Suppression de la clé privée
-rm -f "$KEYFILE"
+rm -f "${KEYFILE}"
 
 # Durcissement SSH
 sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
@@ -89,56 +87,16 @@ sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/ssh
 sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
 
 systemctl restart sshd
-
+rm -fr $MOTD_TEMP
-# Nettoyage différé
-nohup /root/firstlogincleaner.sh >/dev/null 2>&1 &
-exit 0
 EOF
-chmod +x $TEMP_SCRIPT
+chmod +x $MOTD_TEMP
 
-
+### 5. Hardening binaries
-
-cat << 'EOF' > $TEMP_SCRIPT_WRAPPER
-#!/bin/bash
-
-if [ -f /root/firstlogin.sh ]; then
-    /root/firstlogin.sh
-fi
-
-exit 0
-EOF
-chmod +x $TEMP_SCRIPT_WRAPPER
-
-
-cat << 'EOF' > $TEMP_SCRIPT_CLEANER
-#!/bin/bash
-
-# Attendre la fin du login
-sleep 2
-
-# Supprimer la ligne PAM
-sed -i '/firstloginwrapper.sh/d' /etc/pam.d/sshd
-
-# Supprimer les scripts
-rm -f /root/firstlogin.sh
-rm -f /root/firstloginwrapper.sh
-rm -f /root/firstlogincleaner.sh
-rm -f /root/bootstrap.sh
-
-exit 0
-EOF
-chmod +x $TEMP_SCRIPT_CLEANER
-
-echo "auth optional pam_exec.so stdout /root/firstloginwrapper.sh" >> /etc/pam.d/sshd
-
-
-#################. Hardening binaries
 # REBOOT WRAPPER
 mv $REBOOTBIN $REBOOTBINOLD
 cat << 'EOF' > $REBOOTBIN
 #!/bin/bash
 touch /var/log/restart-flag
-echo "[REBOOT] Rebooting server..."
 sleep 1
 /usr/sbin/reboot.old
 EOF
@@ -148,14 +106,13 @@ chmod +x $REBOOTBIN
 cat << 'EOF' > $SHUTBIN
 #!/bin/bash
 touch /var/log/restart-flag
-echo "[SHUTDOWN] Stopping server..."
 sleep 1
 shutdown -h now
 EOF
 chmod +x $SHUTBIN
 
 
-#################. REBOOT HANDLER
+### 6. REBOOT HANDLER
 mkdir -p $SCRIPTSDIR
 cat << 'EOF' > $REBOOTHANDLER
 #!/bin/bash
@@ -210,9 +167,4 @@ ssh-keygen -t ed25519 -C "$HOSTNAME" -f "$KEYFILE" -N ""
 
 # Ajouter la clé publique dans authorized_keys
 cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
-chmod 600 /root/.ssh/authorized_keys
+chmod 600 /root/.ssh/authorized_keys
-
-rm -fr /etc/systemd/system/bootstrap.service
-rm -fr /etc/systemd/system/multi-user.target.wants/bootstrap.service
-rm -fr /root/run-bootstrap.sh
-systemctl daemon-reload