117 lines
2.9 KiB
Bash
117 lines
2.9 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
|
||
|
|
set -e
|
||
|
|
|
||
|
|
# ===============================
|
||
|
|
# CONFIG VALUES (EDIT HERE)
|
||
|
|
# ===============================
|
||
|
|
SSH_PORT="48291"
|
||
|
|
|
||
|
|
echo "==============================="
|
||
|
|
echo " Server Prep Script"
|
||
|
|
echo "==============================="
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Prompt for hostname
|
||
|
|
# -------------------------------
|
||
|
|
read -p "Enter new hostname (FQDN recommended): " NEW_HOSTNAME
|
||
|
|
|
||
|
|
if [ -z "$NEW_HOSTNAME" ]; then
|
||
|
|
echo "Hostname cannot be empty"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
hostnamectl set-hostname "$NEW_HOSTNAME"
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Timezone
|
||
|
|
# -------------------------------
|
||
|
|
read -p "Enter timezone [default: America/Chicago]: " NEW_TZ
|
||
|
|
NEW_TZ=${NEW_TZ:-America/Chicago}
|
||
|
|
|
||
|
|
timedatectl set-timezone "$NEW_TZ"
|
||
|
|
timedatectl set-ntp true
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# System update
|
||
|
|
# -------------------------------
|
||
|
|
apt update && apt upgrade -y
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Base packages
|
||
|
|
# -------------------------------
|
||
|
|
apt install -y \
|
||
|
|
curl \
|
||
|
|
ca-certificates \
|
||
|
|
gnupg \
|
||
|
|
lsb-release \
|
||
|
|
apt-transport-https \
|
||
|
|
software-properties-common \
|
||
|
|
fail2ban \
|
||
|
|
net-tools \
|
||
|
|
unzip \
|
||
|
|
jq
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# SSH CONFIG (MODERN - socket)
|
||
|
|
# -------------------------------
|
||
|
|
echo "Configuring SSH socket on port ${SSH_PORT}..."
|
||
|
|
|
||
|
|
mkdir -p /etc/systemd/system/ssh.socket.d
|
||
|
|
|
||
|
|
cat > /etc/systemd/system/ssh.socket.d/override.conf <<EOF
|
||
|
|
[Socket]
|
||
|
|
ListenStream=
|
||
|
|
ListenStream=${SSH_PORT}
|
||
|
|
EOF
|
||
|
|
|
||
|
|
# Keep sshd_config aligned
|
||
|
|
sed -i "s/^#*Port .*/Port ${SSH_PORT}/" /etc/ssh/sshd_config
|
||
|
|
|
||
|
|
# SSH auth settings
|
||
|
|
sed -i "s/^#*PasswordAuthentication.*/PasswordAuthentication yes/" /etc/ssh/sshd_config
|
||
|
|
|
||
|
|
if ! grep -q "^KbdInteractiveAuthentication" /etc/ssh/sshd_config; then
|
||
|
|
echo "KbdInteractiveAuthentication yes" >> /etc/ssh/sshd_config
|
||
|
|
else
|
||
|
|
sed -i "s/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/" /etc/ssh/sshd_config
|
||
|
|
fi
|
||
|
|
|
||
|
|
if ! grep -q "^ChallengeResponseAuthentication" /etc/ssh/sshd_config; then
|
||
|
|
echo "ChallengeResponseAuthentication yes" >> /etc/ssh/sshd_config
|
||
|
|
else
|
||
|
|
sed -i "s/^ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/" /etc/ssh/sshd_config
|
||
|
|
fi
|
||
|
|
|
||
|
|
systemctl daemon-reexec
|
||
|
|
systemctl daemon-reload
|
||
|
|
systemctl restart ssh.socket
|
||
|
|
systemctl restart ssh
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# SSH KEY INSTALL
|
||
|
|
# -------------------------------
|
||
|
|
echo "Installing SSH key..."
|
||
|
|
|
||
|
|
SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDosb5jR9eu4Avc0HmMzR8HQDYOGRSxwRYgprpDuggDG eddsa-key-20260531"
|
||
|
|
|
||
|
|
mkdir -p ~/.ssh
|
||
|
|
chmod 700 ~/.ssh
|
||
|
|
|
||
|
|
grep -qxF "$SSH_KEY" ~/.ssh/authorized_keys 2>/dev/null || echo "$SSH_KEY" >> ~/.ssh/authorized_keys
|
||
|
|
chmod 600 ~/.ssh/authorized_keys
|
||
|
|
|
||
|
|
echo "✅ SSH key added"
|
||
|
|
|
||
|
|
# -------------------------------
|
||
|
|
# Firewall
|
||
|
|
# -------------------------------
|
||
|
|
read -p "Disable UFW? (Y/n): " DISABLE_UFW
|
||
|
|
|
||
|
|
if [[ ! "$DISABLE_UFW" =~ ^[Nn]$ ]]; then
|
||
|
|
systemctl stop ufw || true
|
||
|
|
systemctl disable ufw || true
|
||
|
|
else
|
||
|
|
ufw allow ${SSH_PORT}/tcp
|
||
|
|
ufw allow 80/tcp
|