bootstrap/bootstrap.sh

#!/bin/bash

#################. VARIABLES
MOTD="/etc/update-motd.d/01-custom"
REBOOTBIN="/usr/sbin/reboot"
REBOOTBINOLD="/usr/sbin/reboot.old"
SHUTBIN="/usr/sbin/shut"
SCRIPTSDIR="/root/scripts"
REBOOTHANDLER="/root/scripts/reboot_handler.sh"
CRONTABTMP="/tmp/crontab.root.tmp"
HOSTNAME=$(hostname)
KEYFILE="/root/.ssh/$HOSTNAME"
TEMP_SCRIPT="/root/firstlogin.sh"
TEMP_SCRIPT_WRAPPER="/root/firstloginwrapper.sh"
TEMP_SCRIPT_CLEANER="/root/firstlogincleaner.sh"


#################. ALIASES
echo "alias ll='ls -l --color=auto'" >> ~/.bashrc
echo "alias l='ls -lAh --color=auto'" >> ~/.bashrc
source ~/.bashrc


#################. UPDATE & ESSENTIALS
apt update && apt -o Dpkg::Options::="--force-confold" upgrade -y
apt install -y vim inxi fastfetch htop ncdu net-tools

timedatectl set-timezone Europe/Paris

# VIM CONFIG
VIMDEF=$(find /usr/share/vim -type f -name defaults.vim | head -n1)
[ -f "$VIMDEF" ] && sed -i 's/set mouse=a/set mouse=/g' "$VIMDEF"

# MOTD CUSTOMIZATION
rm -rf /etc/motd /etc/update-motd.d/*
cat << 'EOF' > $MOTD
#!/bin/bash
RED='\033[0;31m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

echo -e "${RED}          GENERAL SYSTEM INFORMATION ${NC}"
echo
script -q -c '/usr/bin/fastfetch' /dev/null
echo
echo -e "${RED}  SYSTEM DISK USAGE ${NC}"
export TERM=xterm; inxi -D
echo
echo -e "${RED} LAST REBOOT STATUS ${NC}"
tail -n 4 /var/log/reboot.log
echo
apt update -qq > /dev/null 2>&1
updates=$(apt list --upgradable 2>/dev/null | grep -v "^Listing" | wc -l)
if [ "$updates" -gt 0 ]; then
    echo -e "${RED} APT UPDATE RESULT ${NC}"
    echo "$updates package updates available"
fi
EOF
chmod +x $MOTD

#################. Création du script first-login
cat << 'EOF' > $TEMP_SCRIPT
#!/bin/bash

HOSTNAME=$(hostname)
KEYFILE="/root/.ssh/$HOSTNAME"

echo
echo "==============================="
echo " Clé privée SSH à conserver !"
echo "==============================="
echo

# Affichage dans TON shell
cat "$KEYFILE"

echo
echo "==============================="

# Suppression de la clé privée
rm -f "$KEYFILE"

# Durcissement SSH
sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#\?AuthorizedKeysFile.*/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config

systemctl restart sshd

# Nettoyage différé
nohup /root/firstlogincleaner.sh >/dev/null 2>&1 &
exit 0
EOF
chmod +x $TEMP_SCRIPT



cat << 'EOF' > $TEMP_SCRIPT_WRAPPER
#!/bin/bash

if [ -f /root/firstlogin.sh ]; then
    /root/firstlogin.sh
fi

exit 0
EOF
chmod +x $TEMP_SCRIPT_WRAPPER


cat << 'EOF' > $TEMP_SCRIPT_CLEANER
#!/bin/bash

# Attendre la fin du login
sleep 2

# Supprimer la ligne PAM
sed -i '/firstloginwrapper.sh/d' /etc/pam.d/sshd

# Supprimer les scripts
rm -f /root/firstlogin.sh
rm -f /root/firstloginwrapper.sh
rm -f /root/firstlogincleaner.sh
rm -f /root/bootstrap.sh

exit 0
EOF
chmod +x $TEMP_SCRIPT_CLEANER

echo "auth optional pam_exec.so stdout /root/firstloginwrapper.sh" >> /etc/pam.d/sshd


#################. Hardening binaries
# REBOOT WRAPPER
mv $REBOOTBIN $REBOOTBINOLD
cat << 'EOF' > $REBOOTBIN
#!/bin/bash
touch /var/log/restart-flag
echo "[REBOOT] Rebooting server..."
sleep 1
/usr/sbin/reboot.old
EOF
chmod +x $REBOOTBIN

# SHUTDOWN WRAPPER
cat << 'EOF' > $SHUTBIN
#!/bin/bash
touch /var/log/restart-flag
echo "[SHUTDOWN] Stopping server..."
sleep 1
shutdown -h now
EOF
chmod +x $SHUTBIN


#################. REBOOT HANDLER
mkdir -p $SCRIPTSDIR
cat << 'EOF' > $REBOOTHANDLER
#!/bin/bash
FLAG='/var/log/restart-flag'
FLAG2='/var/log/scheduled-flag'
LOG='/var/log/reboot.log'

if [ -f "$FLAG" ]; then
    echo '--------------------------------' >> "$LOG"
    date >> "$LOG"
    echo '*  REBOOT OK :  command exec   *' >> "$LOG"
    echo '--------------------------------' >> "$LOG"
    rm -f "$FLAG"
elif [ -f "$FLAG2" ]; then
    echo '---------------------------------' >> "$LOG"
    date >> "$LOG"
    echo '*  REBOOT PLANNED :   crontab   *' >> "$LOG"
    echo '---------------------------------' >> "$LOG"
    rm -f "$FLAG2"
else
    date >> "$LOG"
    echo '*  REBOOT ERROR :  not planned  *' >> "$LOG"
    echo '---------------------------------' >> "$LOG"
fi
EOF
chmod +x $REBOOTHANDLER

# CRONTAB SETUP
crontab -l 2>/dev/null > $CRONTABTMP || true
echo "@reboot /root/scripts/reboot_handler.sh" >> $CRONTABTMP
crontab $CRONTABTMP
rm -f $CRONTABTMP

# INIT LOG FILE
touch /var/log/reboot.log


### 7. Ajout route VPN
echo "up ip route add 10.8.0.0/24 via 192.168.1.200" >> /etc/network/interfaces
systemctl restart networking


### 8. Hardening SSH
echo "AllowUsers root@192.168.1.250 #(PC_Aurel)" >> /etc/ssh/sshd_config
echo "AllowUsers root@10.8.0.3 #(asus_r409l via VPN)" >> /etc/ssh/sshd_config
systemctl restart sshd

# Préparation clé SSH root
mkdir -p /root/.ssh
chmod 700 /root/.ssh
ssh-keygen -t ed25519 -C "$HOSTNAME" -f "$KEYFILE" -N ""

# Ajouter la clé publique dans authorized_keys
cat "${KEYFILE}.pub" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

rm -fr /etc/systemd/system/bootstrap.service
rm -fr /etc/systemd/system/multi-user.target.wants/bootstrap.service
rm -fr /root/run-bootstrap.sh
systemctl daemon-reload