.

2026-08-22 12:49:53 +02:00 · 2026-01-27 17:35:45 -05:00
commit 2639af6531
176 changed files with 27104 additions and 0 deletions
@@ -0,0 +1,138 @@
+#!/bin/bash
+# Linux Security Audit Script
+# Usage: ./audit-system.sh [--verbose]
+
+set -euo pipefail
+
+VERBOSE="${1:-}"
+PASS=0
+WARN=0
+FAIL=0
+
+check() {
+    local status="$1"
+    local message="$2"
+    case "$status" in
+        PASS) echo -e "\e[32m[PASS]\e[0m $message"; ((PASS++)) ;;
+        WARN) echo -e "\e[33m[WARN]\e[0m $message"; ((WARN++)) ;;
+        FAIL) echo -e "\e[31m[FAIL]\e[0m $message"; ((FAIL++)) ;;
+    esac
+}
+
+echo "========================================="
+echo "Linux Security Audit"
+echo "========================================="
+echo ""
+
+# 1. System Updates
+echo "1. System Updates"
+echo "-----------------"
+UPDATES=$(apt-get -s upgrade 2>/dev/null | grep -c "^Inst" || echo 0)
+if [ "$UPDATES" -eq 0 ]; then
+    check "PASS" "System is up to date"
+else
+    check "FAIL" "$UPDATES packages need updating"
+fi
+
+# 2. SSH Configuration
+echo ""
+echo "2. SSH Configuration"
+echo "--------------------"
+if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config* 2>/dev/null; then
+    check "PASS" "Root login disabled"
+else
+    check "FAIL" "Root login may be enabled"
+fi
+
+if grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config* 2>/dev/null; then
+    check "PASS" "Password authentication disabled"
+else
+    check "WARN" "Password authentication may be enabled"
+fi
+
+# 3. User Accounts
+echo ""
+echo "3. User Accounts"
+echo "----------------"
+EMPTY_PASS=$(awk -F: '($2 == "") {print $1}' /etc/shadow 2>/dev/null | wc -l)
+if [ "$EMPTY_PASS" -eq 0 ]; then
+    check "PASS" "No accounts with empty passwords"
+else
+    check "FAIL" "$EMPTY_PASS accounts with empty passwords"
+fi
+
+ROOT_ACCOUNTS=$(awk -F: '($3 == 0) {print $1}' /etc/passwd | wc -l)
+if [ "$ROOT_ACCOUNTS" -eq 1 ]; then
+    check "PASS" "Only root has UID 0"
+else
+    check "FAIL" "$ROOT_ACCOUNTS accounts have UID 0"
+fi
+
+# 4. File Permissions
+echo ""
+echo "4. File Permissions"
+echo "-------------------"
+SHADOW_PERMS=$(stat -c %a /etc/shadow 2>/dev/null)
+if [ "$SHADOW_PERMS" = "600" ] || [ "$SHADOW_PERMS" = "640" ]; then
+    check "PASS" "/etc/shadow permissions: $SHADOW_PERMS"
+else
+    check "FAIL" "/etc/shadow permissions: $SHADOW_PERMS (should be 600)"
+fi
+
+WORLD_WRITABLE=$(find /etc -type f -perm -002 2>/dev/null | wc -l)
+if [ "$WORLD_WRITABLE" -eq 0 ]; then
+    check "PASS" "No world-writable files in /etc"
+else
+    check "FAIL" "$WORLD_WRITABLE world-writable files in /etc"
+fi
+
+# 5. Network Security
+echo ""
+echo "5. Network Security"
+echo "-------------------"
+if sysctl -n net.ipv4.tcp_syncookies 2>/dev/null | grep -q "1"; then
+    check "PASS" "TCP SYN cookies enabled"
+else
+    check "WARN" "TCP SYN cookies not enabled"
+fi
+
+if sysctl -n net.ipv4.conf.all.rp_filter 2>/dev/null | grep -q "1"; then
+    check "PASS" "Reverse path filtering enabled"
+else
+    check "WARN" "Reverse path filtering not enabled"
+fi
+
+# 6. Firewall
+echo ""
+echo "6. Firewall Status"
+echo "------------------"
+if command -v ufw &>/dev/null && ufw status | grep -q "active"; then
+    check "PASS" "UFW firewall is active"
+elif command -v firewalld &>/dev/null && systemctl is-active firewalld &>/dev/null; then
+    check "PASS" "firewalld is active"
+elif iptables -L -n 2>/dev/null | grep -q "DROP\|REJECT"; then
+    check "PASS" "iptables has rules configured"
+else
+    check "FAIL" "No firewall appears to be active"
+fi
+
+# 7. Services
+echo ""
+echo "7. Running Services"
+echo "-------------------"
+LISTENING=$(ss -tlnp 2>/dev/null | grep -c LISTEN || echo 0)
+check "WARN" "$LISTENING services listening on ports"
+
+# Summary
+echo ""
+echo "========================================="
+echo "Audit Summary"
+echo "========================================="
+echo -e "Passed: \e[32m$PASS\e[0m"
+echo -e "Warnings: \e[33m$WARN\e[0m"
+echo -e "Failed: \e[31m$FAIL\e[0m"
+echo ""
+
+if [ "$FAIL" -gt 0 ]; then
+    exit 1
+fi
@@ -0,0 +1,131 @@
+#!/bin/bash
+# Linux System Hardening Script
+# Usage: ./harden-system.sh [--apply]
+# Run without --apply to see what changes would be made
+
+set -euo pipefail
+
+APPLY="${1:-}"
+
+if [ "$APPLY" != "--apply" ]; then
+    echo "DRY RUN MODE - No changes will be made"
+    echo "Run with --apply to make changes"
+    echo ""
+fi
+
+apply_change() {
+    if [ "$APPLY" == "--apply" ]; then
+        eval "$1"
+        echo "  [APPLIED] $2"
+    else
+        echo "  [WOULD APPLY] $2"
+    fi
+}
+
+echo "========================================="
+echo "Linux System Hardening"
+echo "========================================="
+echo ""
+
+# 1. Update system
+echo "1. System Updates"
+echo "-----------------"
+apply_change "apt-get update && apt-get upgrade -y" "Update all packages"
+
+# 2. Disable unused filesystems
+echo ""
+echo "2. Disable Unused Filesystems"
+echo "------------------------------"
+FILESYSTEMS="cramfs freevxfs jffs2 hfs hfsplus squashfs udf"
+for fs in $FILESYSTEMS; do
+    apply_change "echo 'install $fs /bin/true' >> /etc/modprobe.d/disable-filesystems.conf" "Disable $fs"
+done
+
+# 3. Kernel parameters
+echo ""
+echo "3. Kernel Hardening (sysctl)"
+echo "----------------------------"
+SYSCTL_CONF="/etc/sysctl.d/99-hardening.conf"
+cat << 'EOF' > /tmp/sysctl-hardening.conf
+# Network security
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.secure_redirects = 0
+net.ipv4.conf.default.secure_redirects = 0
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+net.ipv4.tcp_syncookies = 1
+
+# IPv6 (disable if not needed)
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+
+# Kernel hardening
+kernel.randomize_va_space = 2
+kernel.kptr_restrict = 2
+kernel.dmesg_restrict = 1
+kernel.yama.ptrace_scope = 1
+EOF
+apply_change "cp /tmp/sysctl-hardening.conf $SYSCTL_CONF && sysctl -p $SYSCTL_CONF" "Apply kernel hardening parameters"
+
+# 4. SSH hardening
+echo ""
+echo "4. SSH Hardening"
+echo "----------------"
+SSH_CONF="/etc/ssh/sshd_config.d/hardening.conf"
+cat << 'EOF' > /tmp/ssh-hardening.conf
+PermitRootLogin no
+PasswordAuthentication no
+PubkeyAuthentication yes
+MaxAuthTries 3
+ClientAliveInterval 300
+ClientAliveCountMax 2
+X11Forwarding no
+AllowAgentForwarding no
+PermitEmptyPasswords no
+EOF
+apply_change "cp /tmp/ssh-hardening.conf $SSH_CONF" "Apply SSH hardening"
+
+# 5. File permissions
+echo ""
+echo "5. File Permissions"
+echo "-------------------"
+apply_change "chmod 600 /etc/shadow" "Secure /etc/shadow"
+apply_change "chmod 644 /etc/passwd" "Secure /etc/passwd"
+apply_change "chmod 600 /etc/gshadow" "Secure /etc/gshadow"
+apply_change "chmod 644 /etc/group" "Secure /etc/group"
+
+# 6. Remove unnecessary packages
+echo ""
+echo "6. Remove Unnecessary Services"
+echo "------------------------------"
+REMOVE_PKGS="telnet rsh-client rsh-redone-client"
+for pkg in $REMOVE_PKGS; do
+    apply_change "apt-get remove -y $pkg 2>/dev/null || true" "Remove $pkg"
+done
+
+# 7. Configure firewall
+echo ""
+echo "7. Enable Firewall"
+echo "------------------"
+apply_change "ufw default deny incoming && ufw default allow outgoing && ufw allow ssh && ufw --force enable" "Configure UFW firewall"
+
+# 8. Enable automatic updates
+echo ""
+echo "8. Automatic Security Updates"
+echo "-----------------------------"
+apply_change "apt-get install -y unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades" "Enable unattended upgrades"
+
+echo ""
+echo "========================================="
+echo "Hardening script complete"
+if [ "$APPLY" != "--apply" ]; then
+    echo "Run with --apply to make changes"
+fi
+echo "========================================="