External/du_setup
1
0
Fork 0
mirror of https://github.com/buildplan/du_setup.git synced 2025-12-29 16:14:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

trying to fix config for Ubuntu 24.04+

Browse Source
This commit is contained in:
buildplan
2025-06-30 17:23:39 +01:00
parent 30df0ed6e4
commit 3cebc3c380
1 changed files with 63 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
du_setup.sh
View File

@@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# Debian 12 and Ubuntu Server Hardening Interactive Script # Debian 12 and Ubuntu Server Hardening Interactive Script
# Version: 0.51 | 2025-06-30 # Version: 0.52-rc | 2025-06-30
# Changelog: # Changelog:
# - v0.51: corrected repo links # - v0.51: corrected repo links
# - v0.50: versioning format change and repo name change # - v0.50: versioning format change and repo name change
@@ -513,7 +513,7 @@ configure_ssh() {
exit 1 exit 1
fi fi
# Detect SSH service name, preserve socket activation on Ubuntu if active # Detect SSH service name, prefer socket activation on Ubuntu if active
if [[ $ID == "ubuntu" ]] && systemctl is-active ssh.socket >/dev/null 2>&1; then if [[ $ID == "ubuntu" ]] && systemctl is-active ssh.socket >/dev/null 2>&1; then
SSH_SERVICE="ssh.socket" SSH_SERVICE="ssh.socket"
print_info "Using SSH socket activation: $SSH_SERVICE" print_info "Using SSH socket activation: $SSH_SERVICE"
@@ -592,29 +592,39 @@ configure_ssh() {
SSHD_BACKUP_FILE="$BACKUP_DIR/sshd_config.backup_$(date +%Y%m%d_%H%M%S)" SSHD_BACKUP_FILE="$BACKUP_DIR/sshd_config.backup_$(date +%Y%m%d_%H%M%S)"
cp /etc/ssh/sshd_config "$SSHD_BACKUP_FILE" cp /etc/ssh/sshd_config "$SSHD_BACKUP_FILE"
# Apply port override based on SSH service type # Update SSH port in sshd_config for Ubuntu 24.04+ socket activation
if [[ "$SSH_SERVICE" == "ssh.socket" ]]; then if [[ $ID == "ubuntu" ]] && dpkg --compare-versions "$(lsb_release -rs)" ge "24.04"; then
print_info "Configuring SSH socket to listen on port $SSH_PORT..." print_info "Updating SSH port in /etc/ssh/sshd_config for Ubuntu 24.04+ socket activation..."
NEW_SSH_CONFIG=$(mktemp) if ! grep -q "^Port" /etc/ssh/sshd_config; then
tee "$NEW_SSH_CONFIG" > /dev/null <<EOF echo "Port $SSH_PORT" >> /etc/ssh/sshd_config
else
sed -i "s/^Port .*/Port $SSH_PORT/" /etc/ssh/sshd_config
fi
else
# Fallback for older versions or non-Ubuntu
if [[ "$SSH_SERVICE" == "ssh.socket" ]]; then
print_info "Configuring SSH socket to listen on port $SSH_PORT..."
NEW_SSH_CONFIG=$(mktemp)
tee "$NEW_SSH_CONFIG" > /dev/null <<EOF
[Socket] [Socket]
ListenStream= ListenStream=
ListenStream=$SSH_PORT ListenStream=$SSH_PORT
EOF EOF
mkdir -p /etc/systemd/system/ssh.socket.d mkdir -p /etc/systemd/system/ssh.socket.d
mv "$NEW_SSH_CONFIG" /etc/systemd/system/ssh.socket.d/override.conf mv "$NEW_SSH_CONFIG" /etc/systemd/system/ssh.socket.d/override.conf
chmod 644 /etc/systemd/system/ssh.socket.d/override.conf chmod 644 /etc/systemd/system/ssh.socket.d/override.conf
else else
print_info "Configuring SSH service to listen on port $SSH_PORT..." print_info "Configuring SSH service to listen on port $SSH_PORT..."
NEW_SSH_CONFIG=$(mktemp) NEW_SSH_CONFIG=$(mktemp)
tee "$NEW_SSH_CONFIG" > /dev/null <<EOF tee "$NEW_SSH_CONFIG" > /dev/null <<EOF
[Service] [Service]
ExecStart= ExecStart=
ExecStart=/usr/sbin/sshd -D -p $SSH_PORT ExecStart=/usr/sbin/sshd -D -p $SSH_PORT
EOF EOF
mkdir -p /etc/systemd/system/ssh.service.d mkdir -p /etc/systemd/system/ssh.service.d
mv "$NEW_SSH_CONFIG" /etc/systemd/system/ssh.service.d/override.conf mv "$NEW_SSH_CONFIG" /etc/systemd/system/ssh.service.d/override.conf
chmod 644 /etc/systemd/system/ssh.service.d/override.conf chmod 644 /etc/systemd/system/ssh.service.d/override.conf
fi
fi fi
# Apply additional hardening via sshd_config.d # Apply additional hardening via sshd_config.d
@@ -640,31 +650,31 @@ EOF
tee /etc/issue.net > /dev/null <<'EOF' tee /etc/issue.net > /dev/null <<'EOF'
****************************************************************************** ******************************************************************************
🔒AUTHORIZED ACCESS ONLY 🔒AUTHORIZED ACCESS ONLY
════ all attempts are logged and reviewed ════ <EFBFBD>═══ all attempts are logged and reviewed ════
****************************************************************************** ******************************************************************************
EOF EOF
fi fi
print_info "Reloading systemd and restarting SSH service..." print_info "Reloading systemd and restarting SSH service..."
systemctl daemon-reload systemctl daemon-reload
if ! systemctl restart "$SSH_SERVICE"; then if [[ $SSH_SERVICE == "ssh.socket" ]]; then
print_error "SSH service failed to restart! Reverting changes..." if ! systemctl restart "$SSH_SERVICE"; then
rm -f /etc/systemd/system/ssh.service.d/override.conf print_error "SSH socket failed to restart! Reverting changes..."
cp "$SSHD_BACKUP_FILE" /etc/ssh/sshd_config rollback_ssh_changes
rm -f /etc/ssh/sshd_config.d/99-hardening.conf exit 1
systemctl daemon-reload fi
systemctl restart "$SSH_SERVICE" || /usr/sbin/sshd || true else
exit 1 if ! systemctl restart "$SSH_SERVICE"; then
print_error "SSH service failed to restart! Reverting changes..."
rollback_ssh_changes
exit 1
fi
fi fi
# Wait and verify port binding # Wait and verify port binding
sleep 5 sleep 5
if ! ss -tuln | grep -q ":$SSH_PORT"; then if ! ss -tuln | grep -q ":$SSH_PORT"; then
print_error "SSH not listening on port $SSH_PORT after restart! Reverting changes..." print_error "SSH not listening on port $SSH_PORT after restart! Reverting changes..."
rm -f /etc/systemd/system/ssh.service.d/override.conf rollback_ssh_changes
cp "$SSHD_BACKUP_FILE" /etc/ssh/sshd_config
rm -f /etc/ssh/sshd_config.d/99-hardening.conf
systemctl daemon-reload
systemctl restart "$SSH_SERVICE" || /usr/sbin/sshd || true
exit 1 exit 1
fi fi
print_success "SSH service restarted on port $SSH_PORT." print_success "SSH service restarted on port $SSH_PORT."
@@ -673,6 +683,7 @@ EOF
print_info "Verifying root SSH login is disabled..." print_info "Verifying root SSH login is disabled..."
if ssh -p "$SSH_PORT" -o BatchMode=yes -o ConnectTimeout=5 root@localhost true 2>/dev/null; then if ssh -p "$SSH_PORT" -o BatchMode=yes -o ConnectTimeout=5 root@localhost true 2>/dev/null; then
print_error "Root SSH login is still possible! Check SSH configuration." print_error "Root SSH login is still possible! Check SSH configuration."
rollback_ssh_changes
exit 1 exit 1
else else
print_success "Confirmed: Root SSH login is disabled." print_success "Confirmed: Root SSH login is disabled."
@@ -680,6 +691,7 @@ EOF
print_warning "CRITICAL: Test new SSH connection in a SEPARATE terminal NOW!" print_warning "CRITICAL: Test new SSH connection in a SEPARATE terminal NOW!"
print_info "Use: ssh -p $SSH_PORT $USERNAME@$SERVER_IP" print_info "Use: ssh -p $SSH_PORT $USERNAME@$SERVER_IP"
print_info "If login fails, ensure client uses the new port and check server logs (e.g., journalctl -u $SSH_SERVICE)."
# Retry loop for SSH connection test # Retry loop for SSH connection test
local retry_count=0 local retry_count=0
@@ -694,11 +706,7 @@ EOF
sleep 5 sleep 5
else else
print_error "Aborting. Restoring original SSH configuration." print_error "Aborting. Restoring original SSH configuration."
rm -f /etc/systemd/system/ssh.service.d/override.conf rollback_ssh_changes
cp "$SSHD_BACKUP_FILE" /etc/ssh/sshd_config
rm -f /etc/ssh/sshd_config.d/99-hardening.conf
systemctl daemon-reload
systemctl restart "$SSH_SERVICE" || /usr/sbin/sshd || true
exit 1 exit 1
fi fi
fi fi
@@ -706,6 +714,25 @@ EOF
log "SSH hardening completed." log "SSH hardening completed."
} }
rollback_ssh_changes() {
print_info "Rolling back SSH configuration changes..."
rm -f /etc/systemd/system/ssh.service.d/override.conf
rm -f /etc/systemd/system/ssh.socket.d/override.conf
cp "$SSHD_BACKUP_FILE" /etc/ssh/sshd_config
rm -f /etc/ssh/sshd_config.d/99-hardening.conf
systemctl daemon-reload
if ! systemctl restart "$SSH_SERVICE"; then
print_warning "Failed to restart $SSH_SERVICE after rollback. Attempting manual start..."
/usr/sbin/sshd || true
fi
sleep 5
if ss -tuln | grep -q ":$CURRENT_SSH_PORT"; then
print_success "Rollback successful. SSH restored on original port $CURRENT_SSH_PORT."
else
print_error "Rollback failed. SSH may not be accessible. Please investigate manually."
fi
}
configure_firewall() { configure_firewall() {
print_section "Firewall Configuration (UFW)" print_section "Firewall Configuration (UFW)"
if ufw status | grep -q "Status: active"; then if ufw status | grep -q "Status: active"; then