Merge pull request 'Update bootstrap.sh' (#9) from dev into prod

Reviewed-on: #9

bootstrap.sh

@@ -10,6 +10,7 @@ REBOOTHANDLER="/root/scripts/reboot_handler.sh"
 CRONTABTMP="/tmp/crontab.root.tmp"
 HOSTNAME=$(hostname)
 KEYFILE="/root/.ssh/$HOSTNAME"
+MOTD_TEMP="/etc/update-motd/02-temp"
 
 
 ## 2. ALIASES
@@ -55,8 +56,42 @@ fi
 EOF
 chmod +x $MOTD
 
+### 4. Création du script first-login
 
-### 4. Hardening binaries
+cat << 'EOF' > $MOTD_TEMP
+
+#!/bin/bash
+RED='\033[0;31m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+HOSTNAME=$(hostname)
+KEYFILE="/root/.ssh/$HOSTNAME"
+
+echo
+echo -e "${BLUE}===============================${NC}"
+echo -e "${BLUE} Clé privée SSH à conserver !${NC}"
+echo -e "${BLUE}===============================${NC}"
+echo
+cat "${KEYFILE}"
+echo
+echo "${BLUE}===============================${NC}"
+
+# Suppression de la clé privée
+rm -f "${KEYFILE}"
+
+# Durcissement SSH
+sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
+sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+
+systemctl restart sshd
+rm -fr $MOTD_TEMP
+EOF
+chmod +x $MOTD_TEMP
+
+### 5. Hardening binaries
 # REBOOT WRAPPER
 mv $REBOOTBIN $REBOOTBINOLD
 cat << 'EOF' > $REBOOTBIN
@@ -77,7 +112,7 @@ EOF
 chmod +x $SHUTBIN
 
 
-### 5. REBOOT HANDLER
+### 6. REBOOT HANDLER
 mkdir -p $SCRIPTSDIR
 cat << 'EOF' > $REBOOTHANDLER
 #!/bin/bash
@@ -115,12 +150,12 @@ rm -f $CRONTABTMP
 touch /var/log/reboot.log
 
 
-### 6. Ajout route VPN
+### 7. Ajout route VPN
 echo "up ip route add 10.8.0.0/24 via 192.168.1.200" >> /etc/network/interfaces
 systemctl restart networking
 
 
-### 7. Hardening SSH
+### 8. Hardening SSH
 echo "AllowUsers root@192.168.1.250 #(PC_Aurel)" >> /etc/ssh/sshd_config
 echo "AllowUsers root@10.8.0.3 #(asus_r409l via VPN)" >> /etc/ssh/sshd_config
 systemctl restart sshd
@@ -132,33 +167,4 @@ ssh-keygen -t ed25519 -C "$HOSTNAME" -f "$KEYFILE" -N ""
 
 # Ajouter la clé publique dans authorized_keys
 cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
-chmod 600 /root/.ssh/authorized_keys
+chmod 600 /root/.ssh/authorized_keys
-
-
-### 8. Création du script first-login
-cat << 'EOF' > /root/first-login.sh
-#!/bin/bash
-
-HOSTNAME=$(hostname)
-KEYFILE="/root/.ssh/$HOSTNAME"
-
-echo
-echo "==============================="
-echo " Clé privée SSH à conserver !"
-echo "==============================="
-echo
-cat "${KEYFILE}"
-echo
-echo "==============================="
-
-# Suppression de la clé privée
-rm -f "${KEYFILE}"
-
-# Durcissement SSH
-sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
-sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
-sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
-sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
-
-systemctl restart sshd
-EOF