Skip to content

Commit fd5eab5

Browse files
author
Brian Pontarelli
committed
Refactored to new approach of two scripts, local and remote with configuration system
1 parent 556e781 commit fd5eab5

8 files changed

+150
-12
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
.idea/workspace.xml
2+
output

‎2016-security-scripts.iml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<component name="NewModuleRootManager" inherit-compiler-output="true">
1111
<exclude-output />
1212
<content url="file://$MODULE_DIR$">
13-
<sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
13+
<excludeFolder url="file://$MODULE_DIR$/output" />
1414
</content>
1515
<orderEntry type="inheritedJdk" />
1616
<orderEntry type="sourceFolder" forTests="false" />

‎configure.sh

+20-10
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ function ask_yes_no {
99
done
1010
}
1111

12+
rm -rf output
13+
mkdir output
1214

1315
echo "Enter the IP address of the Application Server"
1416
read application_server_ip
@@ -30,6 +32,8 @@ while [[ ${monit_smtp_encryption} != "ssl" && ${monit_smtp_encryption} != "tlsv1
3032
done
3133
if [[ ${monit_smtp_encryption} == "none" ]]; then
3234
monit_smtp_encryption=""
35+
else
36+
monit_smtp_encryption="using ${monit_smtp_encryption}"
3337
fi
3438

3539
ask_yes_no "Install Ruby and Monit Slack/Pushover integration? (y/n)"
@@ -54,16 +58,22 @@ if [[ ${answer} == "y" ]]; then
5458
read monit_pushover_user
5559
monit_pushover_enabled="true"
5660
fi
61+
62+
cp template/ubuntu-16.04/monit-ssh-logins-exec.cfg output/monit-ssh-logins.cfg
63+
sed "s/@MONIT_SLACK_WEBHOOK_URL@/${monit_slack_webhook_url//\//\\/}/g;s/@MONIT_SLACK_ENABLED@/${monit_slack_enabled}/g;s/@MONIT_PUSHOVER_APPLICATION@/${monit_pushover_application}/g;s/@MONIT_PUSHOVER_USER@/${monit_pushover_user}/g;s/@MONIT_PUSHOVER_ENABLED@/${monit_pushover_enabled}/g" < template/ubuntu-16.04/monit-slack-pushover.rb > output/monit-slack-pushover.rb
64+
chmod +x output/monit-slack-pushover.rb
65+
else
66+
cp template/ubuntu-16.04/monit-ssh-logins-alert.cfg output/monit-ssh-logins.cfg
5767
fi
5868

59-
cp template/ubuntu-16.04/backup.sh .
60-
cp template/ubuntu-16.04/common-password .
61-
cp template/ubuntu-16.04/iptables-application-server.cfg .
62-
cp template/ubuntu-16.04/monit-ssh-logins-alert.cfg .
63-
cp template/ubuntu-16.04/monit-ssh-logins-exec.cfg .
64-
chmod +x backup.sh
69+
cp template/ubuntu-16.04/backup.sh output
70+
cp template/ubuntu-16.04/common-password output
71+
cp template/ubuntu-16.04/iptables-application-server.cfg output
72+
cp template/ubuntu-16.04/setup-server.sh output
73+
cp template/ubuntu-16.04/sshd output
74+
cp template/ubuntu-16.04/sshd_config output
75+
chmod +x output/backup.sh
76+
chmod +x output/setup-server.sh
6577

66-
sed "s/@APPLICATION_SERVER_IP@/${application_server_ip}/g" < template/ubuntu-16.04/iptables-database-server.cfg > iptables-database-server.cfg
67-
sed "s/@MONIT_SLACK_WEBHOOK_URL@/${monit_slack_webhook_url/\//\\\/}/g;s/@MONIT_SLACK_ENABLED@/${monit_slack_enabled}/g;s/@MONIT_PUSHOVER_APPLICATION@/${monit_pushover_application}/g;s/@MONIT_PUSHOVER_USER@/${monit_pushover_user}/g;s/@MONIT_PUSHOVER_ENABLED@/${monit_pushover_enabled}/g" < template/ubuntu-16.04/monit-slack-pushover.rb > monit-slack-pushover.rb
68-
sed "s/@MONIT_EMAIL_SERVER@/${monit_smtp_host}/g;s/@MONIT_EMAIL_PORT@/${monit_smtp_port}/g;s/@MONIT_EMAIL_USERNAME@/${monit_smtp_username}/g;s/@MONIT_EMAIL_PASSWORD@/${monit_smtp_password}/g;s/@MONIT_EMAIL_ENCRYPTION@/${monit_smtp_encryption}/g" < template/ubuntu-16.04/monitrc > monitrc
69-
chmod +x /etc/monit/monit-slack-pushover.rb
78+
sed "s/@APPLICATION_SERVER_IP@/${application_server_ip}/g" < template/ubuntu-16.04/iptables-database-server.cfg > output/iptables-database-server.cfg
79+
sed "s/@MONIT_EMAIL_SERVER@/${monit_smtp_host}/g;s/@MONIT_EMAIL_PORT@/${monit_smtp_port}/g;s/@MONIT_EMAIL_USERNAME@/${monit_smtp_username}/g;s/@MONIT_EMAIL_PASSWORD@/${monit_smtp_password}/g;s/@MONIT_EMAIL_ENCRYPTION@/${monit_smtp_encryption}/g" < template/ubuntu-16.04/monitrc > output/monitrc

‎setup-server.sh renamed to ‎setup-existing-server.sh

+4-1
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ function ask_yes_no {
5454
}
5555

5656

57+
echo "This script doesn't work yet"
58+
exit 1
59+
5760
if [[ $# != 3 ]]; then
5861
echo "Usage: setup-server.sh <ordinary-username> <ssh-public-key-file> <iptable-config-file>"
5962
exit 1
@@ -233,4 +236,4 @@ fi
233236
if ! usermod -p '*' root; then
234237
bail "Unable to lock root user's account for direct login"
235238
fi
236-
####### End Lock Root Account #######
239+
####### End Lock Root Account #######

‎setup-new-server.sh

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ ${#} != 4 && ${#} != 5 ]]; then
4+
echo "Usage: setup-new-server.sh <root@host> <ssh-public-key-file> <iptable-config-file> <ordinary-username> [ordinary-user-password]"
5+
echo ""
6+
echo " for example: setup-new-server.sh root@192.168.1.1 ~/.ssh/id_rsa.pub output/iptables-application-server.cfg myuser password"
7+
echo ""
8+
echo " If the password is not specified, it will be input by the user interactively"
9+
exit 1
10+
fi
11+
12+
13+
root_at_host=$1
14+
ssh_key_file=$2
15+
iptable_cfg_file=$3
16+
ordinary_user=$4
17+
18+
ordinary_user_password=""
19+
ordinary_user_password_confirm=""
20+
if [[ ${#} == 5 ]]; then
21+
ordinary_user_password=$5
22+
else
23+
while [[ ${ordinary_user_password} != ${ordinary_user_password_confirm} ]]; do
24+
echo -n "Password: "
25+
read -s ordinary_user_password
26+
echo -n "Password (again): "
27+
read -s ordinary_user_password_confirm
28+
if [[ ${ordinary_user_password} != ${ordinary_user_password_confirm} ]]; then
29+
echo "Passwords don't match"
30+
fi
31+
done
32+
fi
33+
34+
if ! [ -f ${ssh_key_file} ]; then
35+
bail "Invalid SSH public key file"
36+
fi
37+
38+
if ! [ -f ${iptable_cfg_file} ]; then
39+
bail "Invalid IPTables configuration file"
40+
fi
41+
42+
scp output/* ${ssh_key_file} ${root_at_host}:/root
43+
ssh -t ${root_at_host} "/root/setup-new-server.sh ${ssh_key_file} ${iptable_cfg_file} ${ordinary_user} ${ordinary_user_password}"

‎template/ubuntu-16.04/setup-server.sh

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ ${#} != 4 ]]; then
4+
echo "Usage: setup-server.sh <ssh-public-key-file> <iptable-config-file> <ordinary-username> <ordinar-user-password>"
5+
echo ""
6+
echo " for example: setup-server.sh id_rsa.pub iptables-application-server.cfg myuser password"
7+
exit 1
8+
fi
9+
10+
ssh_key_file=$1
11+
iptable_cfg_file=$2
12+
ordinary_user=$3
13+
ordinary_user_password=$4
14+
15+
if ! [ -f ${ssh_key_file} ]; then
16+
bail "Invalid SSH public key file"
17+
fi
18+
19+
if ! [ -f ${iptable_cfg_file} ]; then
20+
bail "Invalid IPTables configuration file"
21+
fi
22+
23+
apt-get -qq -y install libpam-cracklib > /dev/null 2>&1
24+
apt-get -qq -y install libpam-google-authenticator > /dev/null 2>&1
25+
apt-get -qq -y install ntp > /dev/null 2>&1
26+
debconf-set-selections <<< 'iptables-persistent iptables-persistent/autosave_v4 boolean true'
27+
debconf-set-selections <<< 'iptables-persistent iptables-persistent/autosave_v6 boolean true'
28+
apt-get -qq -y install iptables-persistent > /dev/null 2>&1
29+
apt-get -qq -y install monit > /dev/null 2>&1
30+
apt-get -qq -y install ruby > /dev/null 2>&1
31+
32+
ordinary_user_password_encrypted=$(mkpasswd -m sha-512 ${ordinary_user_password})
33+
useradd -m -G sudo -s /bin/bash -p "${ordinary_user_password_encrypted}" ${ordinary_user}
34+
mkdir -p /home/${ordinary_user}/.ssh
35+
cp ${ssh_key_file} /home/${ordinary_user}/.ssh/authorized_keys
36+
chown -R ${ordinary_user}:${ordinary_user} /home/${ordinary_user}/.ssh
37+
chmod 700 /home/${ordinary_user}/.ssh
38+
chmod 600 /home/${ordinary_user}/.ssh/authorized_keys
39+
40+
# Backup all the configuration files
41+
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
42+
cp /etc/pam.d/sshd /etc/pam.d/sshd.orig
43+
cp /etc/iptables/rules.v4 /etc/iptables/rules.v4.orig
44+
cp /etc/monit/monitrc /etc/monit/monitrc.orig
45+
46+
# SCP over all the files
47+
cp common-password /etc/pam.d/common-password
48+
cp ${iptable_cfg_file} /etc/iptables/rules.v4
49+
cp monit-ssh-logins.cfg /etc/monit/conf.d/ssh-logins
50+
cp monitrc /etc/monit/monitrc
51+
cp sshd_config /etc/ssh/sshd_config
52+
cp sshd /etc/pam.d/sshd
53+
if [ -f monit-slack-pushover.rb ]; then
54+
cp monit-slack-pushover.rb /etc/monit/monit-slack-pushover.rb
55+
fi
56+
57+
service ssh restart
58+
service netfilter-persistent reload
59+
service monit restart
60+
usermod -p '*' root

‎test-answers

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
10.10.10.10
2+
monit-alerts@test.com
3+
smtp.test.com
4+
587
5+
smtp-username@test.com
6+
smtp-password
7+
tlsv12
8+
y
9+
y
10+
https://hooks.slack.com/services/A0411FLaa/B004CKBBB/E7eeeea2a7a1U6EUhnIAus6z
11+
y
12+
pushover-app
13+
pushover-user

‎test-answers-no-slack-pushover

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
10.10.10.10
2+
monit-alerts@test.com
3+
smtp.test.com
4+
587
5+
smtp-username@test.com
6+
smtp-password
7+
tlsv12
8+
n

0 commit comments

Comments
 (0)