92 lines
2.5 KiB
Bash
92 lines
2.5 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
|
||
|
|
set -e
|
||
|
|
|
||
|
|
echo "==============================="
|
||
|
|
echo " SSH Configuration Script"
|
||
|
|
echo "==============================="
|
||
|
|
|
||
|
|
SSHD_CONFIG="/etc/ssh/sshd_config"
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Install SSH Key
|
||
|
|
# -------------------------------
|
||
|
|
echo "Installing SSH key..."
|
||
|
|
|
||
|
|
SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDosb5jR9eu4Avc0HmMzR8HQDYOGRSxwRYgprpDuggDG eddsa-key-20260531"
|
||
|
|
|
||
|
|
mkdir -p ~/.ssh
|
||
|
|
chmod 700 ~/.ssh
|
||
|
|
|
||
|
|
grep -qxF "$SSH_KEY" ~/.ssh/authorized_keys 2>/dev/null || echo "$SSH_KEY" >> ~/.ssh/authorized_keys
|
||
|
|
chmod 600 ~/.ssh/authorized_keys
|
||
|
|
|
||
|
|
echo "✅ Key installed"
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Backup config
|
||
|
|
# -------------------------------
|
||
|
|
cp ${SSHD_CONFIG} ${SSHD_CONFIG}.bak.$(date +%s)
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# SSH SETTINGS
|
||
|
|
# -------------------------------
|
||
|
|
echo "Updating SSH settings..."
|
||
|
|
|
||
|
|
# Pubkey
|
||
|
|
if grep -q "^PubkeyAuthentication" "$SSHD_CONFIG"; then
|
||
|
|
sed -i "s/^PubkeyAuthentication.*/PubkeyAuthentication yes/" "$SSHD_CONFIG"
|
||
|
|
else
|
||
|
|
echo "PubkeyAuthentication yes" >> "$SSHD_CONFIG"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Password (initially enabled for safety)
|
||
|
|
if grep -q "^PasswordAuthentication" "$SSHD_CONFIG"; then
|
||
|
|
sed -i "s/^PasswordAuthentication.*/PasswordAuthentication yes/" "$SSHD_CONFIG"
|
||
|
|
else
|
||
|
|
echo "PasswordAuthentication yes" >> "$SSHD_CONFIG"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# KbdInteractive ✅
|
||
|
|
if grep -q "^KbdInteractiveAuthentication" "$SSHD_CONFIG"; then
|
||
|
|
sed -i "s/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/" "$SSHD_CONFIG"
|
||
|
|
else
|
||
|
|
echo "KbdInteractiveAuthentication yes" >> "$SSHD_CONFIG"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# ChallengeResponse
|
||
|
|
if grep -q "^ChallengeResponseAuthentication" "$SSHD_CONFIG"; then
|
||
|
|
sed -i "s/^ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/" "$SSHD_CONFIG"
|
||
|
|
else
|
||
|
|
echo "ChallengeResponseAuthentication yes" >> "$SSHD_CONFIG"
|
||
|
|
fi
|
||
|
|
|
||
|
|
systemctl restart ssh
|
||
|
|
|
||
|
|
echo "✅ SSH restarted"
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Optional Lockdown
|
||
|
|
# -------------------------------
|
||
|
|
read -p "Disable password login? (y/N): " DISABLE_PASS
|
||
|
|
|
||
|
|
if [[ "$DISABLE_PASS" =~ ^[Yy]$ ]]; then
|
||
|
|
sed -i "s/^#*PasswordAuthentication.*/PasswordAuthentication no/" "$SSHD_CONFIG"
|
||
|
|
systemctl restart ssh
|
||
|
|
echo "✅ Password login disabled"
|
||
|
|
fi
|
||
|
|
|
||
|
|
read -p "Disable root login? (y/N): " DISABLE_ROOT
|
||
|
|
|
||
|
|
if [[ "$DISABLE_ROOT" =~ ^[Yy]$ ]]; then
|
||
|
|
sed -i "s/^#*PermitRootLogin.*/PermitRootLogin no/" "$SSHD_CONFIG"
|
||
|
|
systemctl restart ssh
|
||
|
|
echo "✅ Root login disabled"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
echo "==============================="
|
||
|
|
echo " ✅ SSH CONFIG COMPLETE"
|
||
|
|
echo "==============================="
|
||
|
|
echo "⚠️ Test SSH access before closing your session"
|