diff --git a/README.md b/README.md index 71e1417..83225b7 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Debian & Ubuntu Server Setup & Hardening Script -**Version:** 4.0 +**Version:** 4.1 **Last Updated:** 2025-06-28 @@ -22,6 +22,7 @@ This script automates the initial setup and security hardening of a fresh Debian - **Automated Security Updates**: Enables `unattended-upgrades` for automatic security patches. - **System Stability**: Configures NTP time synchronization with `chrony` and optional swap file setup for low-RAM systems. - **Remote rsync Backups**: Configures automated `rsync` backups over SSH to any compatible server (e.g., Hetzner Storage Box), with SSH key automation (`sshpass` or manual), cron scheduling, ntfy/Discord notifications, and a customizable exclude file. +- **Tailscale VPN**: Installs Tailscale and connects to the standard Tailscale network (pre-auth key required) or a custom server (URL and key required). Configures optional flags (`--ssh`, `--advertise-exit-node`, `--accept-dns`, `--accept-routes`). - **Safety First**: Backs up critical configuration files before modification, stored in `/root/setup_harden_backup_*`. - **Optional Software**: Offers interactive installation of: - Docker & Docker Compose @@ -37,6 +38,7 @@ This script automates the initial setup and security hardening of a fresh Debian - Root or `sudo` privileges. - Internet access for package downloads. - For remote backups: An SSH-accessible server (e.g., Hetzner Storage Box) with credentials or SSH key access. +- For Tailscale: A pre-auth key from https://login.tailscale.com/admin (standard, starts with `tskey-auth-`) or from a custom server (e.g., `https://ts.mydomain.cloud`). ### 1. Download the Script @@ -59,7 +61,7 @@ sudo ./setup_harden_debian_ubuntu.sh --quiet > **Warning**: The script pauses to verify SSH access on the new port before disabling old access methods. **Test the new SSH connection from a separate terminal before proceeding!** > -> Ensure your VPS provider’s firewall allows the custom SSH port and the backup server’s SSH port (e.g., 23 for Hetzner Storage Box). +> Ensure your VPS provider’s firewall allows the custom SSH port, backup server’s SSH port (e.g., 23 for Hetzner Storage Box), and Tailscale traffic (UDP 41641 for direct connections). ## What It Does @@ -71,11 +73,11 @@ sudo ./setup_harden_debian_ubuntu.sh --quiet | **SSH Hardening** | Disables root login, enforces key-based auth, and sets a custom port. | | **Firewall Setup** | Configures UFW to deny incoming traffic by default, allowing specific ports. | | **Remote Backup Setup** | Configures `rsync` backups to an SSH server (e.g., `u457300-sub4@u457300.your-storagebox.de:23`). Creates `/root/run_backup.sh`, `/root/rsync_exclude.txt`, and schedules a cron job. Supports ntfy/Discord notifications. | +| **Tailscale Setup** | Installs Tailscale and connects to the standard Tailscale network (pre-auth key starting with `tskey-auth-`) or a custom server (any valid key). Configures optional flags (`--ssh`, `--advertise-exit-node`, `--accept-dns`, `--accept-routes`). | | **System Backups** | Saves timestamped configuration backups in `/root/setup_harden_backup_*`. | | **Swap File Setup** | Creates an optional swap file (e.g., 2G) with tuned settings. | | **Timezone & Locales** | Configures timezone and system locales interactively. | | **Docker Install** | Installs Docker Engine and adds the user to the `docker` group. | -| **Tailscale Install** | Installs the Tailscale client for Mesh VPN. | | **Final Cleanup** | Removes unused packages and reloads daemons. | ## Logs & Backups @@ -96,6 +98,11 @@ After rebooting, verify the setup: - **Hostname**: `hostnamectl` - **Docker Status** (if installed): `docker ps` - **Tailscale Status** (if installed): `tailscale status` +- **Tailscale Verification** (if configured): + - Check connection: `tailscale status` + - Test Tailscale SSH (if enabled): `tailscale ssh @` + - Verify exit node (if enabled): Check Tailscale admin console + - If not connected, run the `tailscale up` command shown in the script output - **Remote Backup** (if configured): - Verify SSH key: `cat /root/.ssh/id_ed25519.pub` - Copy key (if not done): `ssh-copy-id -p -s ` @@ -109,6 +116,7 @@ After rebooting, verify the setup: - Ubuntu 22.04, 24.04, 24.10 (experimental) - Cloud providers: DigitalOcean, Oracle Cloud, Hetzner, Netcup - Backup destinations: Hetzner Storage Box, custom SSH servers +- Tailscale: Standard network, custom self-hosted servers ## Important Notes @@ -117,6 +125,7 @@ After rebooting, verify the setup: - Test in a non-production environment (e.g., staging VM) first. - Maintain out-of-band console access in case of SSH lockout. - For Hetzner Storage Box, ensure `~/.ssh/` exists on the remote server: `ssh -p 23 "mkdir -p ~/.ssh && chmod 700 ~/.ssh"`. +- For Tailscale, generate a pre-auth key from https://login.tailscale.com/admin (standard, must start with `tskey-auth-`) or your custom server (any valid key). Ensure UDP 41641 is open for Tailscale traffic. ## Troubleshooting @@ -172,6 +181,33 @@ If backups fail: 6. **Summary Errors**: - If summary shows `Remote Backup: Not configured`, verify: `ls -l /root/run_backup.sh` +### Tailscale Issues + +If Tailscale fails to connect: + +1. **Verify Installation**: + - Check: `command -v tailscale` + - Service status: `systemctl status tailscaled` + +2. **Check Connection**: + - Run: `tailscale status` + - Verify server: `tailscale status --json | grep ControlURL` + - Check logs: `sudo journalctl -u tailscaled` + +3. **Test Pre-Auth Key**: + - Re-run the command shown in the script output (e.g., `sudo tailscale up --auth-key= --operator=` or with `--login-server=`). + - For custom servers, ensure the key is valid for the specified server (e.g., generated from `https://ts.mydomain.cloud`). + +4. **Additional Flags**: + - Verify SSH: `tailscale ssh @` + - Check exit node: Tailscale admin console + - Verify DNS: `cat /etc/resolv.conf` + - Check routes: `tailscale status` + +5. **Network Issues**: + - Ensure UDP 41641 is open: `nc -zvu 41641` + - Check VPS firewall for Tailscale traffic. + ## [MIT](https://github.com/buildplan/setup_harden_server/blob/main/LICENSE) License This script is open-source and provided "as is" without warranty. Use at your own risk. diff --git a/setup_harden_debian_ubuntu.sh b/setup_harden_debian_ubuntu.sh index 7f5edaf..7999249 100644 --- a/setup_harden_debian_ubuntu.sh +++ b/setup_harden_debian_ubuntu.sh @@ -1,7 +1,7 @@ #!/bin/bash # Debian 12 and Ubuntu Server Hardening Interactive Script -# Version: 4.0 | 2025-06-28 +# Version: 4.1 | 2025-06-28 # Changelog: # - v4.0: Added automated backup config. Mainly for Hetzner Storage Box but can be used for any rsync/SSH enabled remote solution. # - v3.*: Improvements to script flow and fixed bugs which were found in tests at Oracle Cloud @@ -82,7 +82,7 @@ print_header() { echo -e "${CYAN}╔═════════════════════════════════════════════════════════════════╗${NC}" echo -e "${CYAN}║ ║${NC}" echo -e "${CYAN}║ DEBIAN/UBUNTU SERVER SETUP AND HARDENING SCRIPT ║${NC}" - echo -e "${CYAN}║ v4.0 | 2025-06-28 ║${NC}" + echo -e "${CYAN}║ v4.1 | 2025-06-28 ║${NC}" echo -e "${CYAN}║ ║${NC}" echo -e "${CYAN}╚═════════════════════════════════════════════════════════════════╝${NC}" echo @@ -902,33 +902,124 @@ EOF } install_tailscale() { - if ! confirm "Install Tailscale VPN (Optional)?"; then + if ! confirm "Install and configure Tailscale VPN (Optional)?"; then print_info "Skipping Tailscale installation." + log "Tailscale installation skipped by user." return 0 fi - print_section "Tailscale VPN Installation" + print_section "Tailscale VPN Installation and Configuration" if command -v tailscale >/dev/null 2>&1; then print_info "Tailscale already installed." + if systemctl is-active --quiet tailscaled && tailscale status >/dev/null 2>&1; then + print_success "Tailscale service is active and connected." + return 0 + else + print_warning "Tailscale installed but service is not active or not connected." + fi + else + print_info "Installing Tailscale..." + curl -fsSL https://tailscale.com/install.sh -o /tmp/tailscale_install.sh + chmod +x /tmp/tailscale_install.sh + if ! grep -q "tailscale" /tmp/tailscale_install.sh; then + print_error "Downloaded Tailscale install script appears invalid." + rm -f /tmp/tailscale_install.sh + log "Tailscale installation failed: Invalid install script." + return 0 + fi + if ! /tmp/tailscale_install.sh; then + print_error "Failed to install Tailscale." + rm -f /tmp/tailscale_install.sh + log "Tailscale installation failed." + return 0 + fi + rm -f /tmp/tailscale_install.sh + print_success "Tailscale installation complete." + log "Tailscale installation completed." + fi + + # --- Configure Tailscale Connection --- + if systemctl is-active --quiet tailscaled && tailscale status >/dev/null 2>&1; then + print_info "Tailscale is already connected." return 0 fi - print_info "Installing Tailscale..." - curl -fsSL https://tailscale.com/install.sh -o /tmp/tailscale_install.sh - chmod +x /tmp/tailscale_install.sh - # Simple sanity check on the downloaded script - if ! grep -q "tailscale" /tmp/tailscale_install.sh; then - print_error "Downloaded Tailscale install script appears invalid." - rm -f /tmp/tailscale_install.sh - exit 1 + print_info "Configuring Tailscale connection..." + echo -e "${CYAN}Choose Tailscale connection method:${NC}" + echo -e " 1) Standard Tailscale (requires pre-auth key from https://login.tailscale.com/admin)" + echo -e " 2) Custom Tailscale server (requires server URL and pre-auth key)" + read -rp "$(echo -e "${CYAN}Enter choice (1-2) [1]: ${NC}")" TS_CONNECTION + TS_CONNECTION=${TS_CONNECTION:-1} + local AUTH_KEY LOGIN_SERVER="" + if [[ "$TS_CONNECTION" == "2" ]]; then + while true; do + read -rp "$(echo -e "${CYAN}Enter Tailscale server URL (e.g., https://ts.mydomain.cloud): ${NC}")" LOGIN_SERVER + if [[ "$LOGIN_SERVER" =~ ^https://[a-zA-Z0-9.-]+(:[0-9]+)?$ ]]; then break; else print_error "Invalid URL. Must start with https://. Try again."; fi + done fi - if ! /tmp/tailscale_install.sh; then - print_error "Failed to install Tailscale." - rm -f /tmp/tailscale_install.sh - exit 1 + while true; do + read -rp "$(echo -e "${CYAN}Enter Tailscale pre-auth key: ${NC}")" AUTH_KEY + if [[ "$TS_CONNECTION" == "1" && "$AUTH_KEY" =~ ^tskey-auth- ]]; then break + elif [[ "$TS_CONNECTION" == "2" && -n "$AUTH_KEY" ]]; then + print_warning "Ensure the pre-auth key is valid for your custom Tailscale server ($LOGIN_SERVER)." + break + else + print_error "Invalid key format. For standard connection, key must start with 'tskey-auth-'. For custom server, key cannot be empty." + fi + done + local TS_COMMAND="tailscale up" + if [[ "$TS_CONNECTION" == "2" ]]; then + TS_COMMAND="$TS_COMMAND --login-server=$LOGIN_SERVER" fi - rm -f /tmp/tailscale_install.sh - print_warning "ACTION REQUIRED: Run 'sudo tailscale up' after script finishes." - print_success "Tailscale installation complete." - log "Tailscale installation completed." + TS_COMMAND="$TS_COMMAND --auth-key=$AUTH_KEY --operator=$USERNAME" + print_info "Connecting to Tailscale with: $TS_COMMAND" + if ! $TS_COMMAND; then + print_warning "Failed to connect to Tailscale. Possible issues: invalid pre-auth key, network restrictions, or server unavailability." + print_info "Please run the following command manually after resolving the issue:" + echo -e "${CYAN} $TS_COMMAND${NC}" + log "Tailscale connection failed: $TS_COMMAND" + else + print_success "Tailscale connected successfully." + log "Tailscale connected: $TS_COMMAND" + fi + + # --- Configure Additional Flags --- + if confirm "Configure additional Tailscale options (SSH, exit node, DNS, routes)?"; then + local TS_FLAGS="" + if confirm "Enable Tailscale SSH (--ssh)?"; then + TS_FLAGS="$TS_FLAGS --ssh" + fi + if confirm "Advertise as an exit node (--advertise-exit-node)?"; then + TS_FLAGS="$TS_FLAGS --advertise-exit-node" + fi + if confirm "Accept Tailscale DNS settings (--accept-dns)?"; then + TS_FLAGS="$TS_FLAGS --accept-dns" + fi + if confirm "Accept advertised routes (--accept-routes)?"; then + TS_FLAGS="$TS_FLAGS --accept-routes" + fi + if [[ -n "$TS_FLAGS" ]]; then + TS_COMMAND="tailscale up" + if [[ "$TS_CONNECTION" == "2" ]]; then + TS_COMMAND="$TS_COMMAND --login-server=$LOGIN_SERVER" + fi + TS_COMMAND="$TS_COMMAND --auth-key=$AUTH_KEY --operator=$USERNAME $TS_FLAGS" + print_info "Reconfiguring Tailscale with additional options: $TS_COMMAND" + if ! $TS_COMMAND; then + print_warning "Failed to reconfigure Tailscale with additional options." + print_info "Please run the following command manually after resolving the issue:" + echo -e "${CYAN} $TS_COMMAND${NC}" + log "Tailscale reconfiguration failed: $TS_COMMAND" + else + print_success "Tailscale reconfigured with additional options." + log "Tailscale reconfigured: $TS_COMMAND" + fi + else + print_info "No additional Tailscale options selected." + log "No additional Tailscale options applied." + fi + fi + print_success "Tailscale setup complete." + print_info "Verify status: tailscale status" + log "Tailscale setup completed." } setup_backup() { @@ -1409,11 +1500,20 @@ generate_summary() { print_error "Service docker is NOT active." fi fi + local TS_COMMAND="" if command -v tailscale >/dev/null 2>&1; then - if systemctl is-active --quiet tailscaled; then - print_success "Service tailscaled is active." + if systemctl is-active --quiet tailscaled && tailscale status >/dev/null 2>&1; then + print_success "Service tailscaled is active and connected." + local TS_SERVER=$(tailscale status --json 2>/dev/null | grep -o '"ControlURL":"[^"]*"' | cut -d'"' -f4 || echo "Unknown") + local TS_FLAGS=$(tailscale status --json 2>/dev/null | grep -o '"CurrentTailnet":{"MagicDNSSuffix":"[^"]*","Capabilities":\[[^]]*]}' | grep -o '"ssh":true\|"advertise-exit-node":true\|"accept-dns":true\|"accept-routes":true' | tr '\n' ',' | sed 's/,$//' | sed 's/"//g' | sed 's/:true//g' || echo "None") + TS_FLAGS=${TS_FLAGS:-None} else - print_error "Service tailscaled is NOT active." + print_error "Service tailscaled is NOT active or not connected." + local TS_SERVER="Not connected" + local TS_FLAGS="None" + # Check log for last attempted command + TS_COMMAND=$(grep "Tailscale connection failed: tailscale up" "$LOG_FILE" | tail -1 | sed 's/.*Tailscale connection failed: //') + TS_COMMAND=${TS_COMMAND:-"tailscale up --operator=$USERNAME"} fi fi echo -e "\n${GREEN}Server setup and hardening script has finished successfully.${NC}\n" @@ -1443,6 +1543,13 @@ generate_summary() { else echo -e " Remote Backup: ${RED}Not configured${NC}" fi + if command -v tailscale >/dev/null 2>&1; then + echo -e " Tailscale: ${GREEN}Enabled${NC}" + printf " %-16s%s\n" "- Server:" "$TS_SERVER" + printf " %-16s%s\n" "- Flags:" "$TS_FLAGS" + else + echo -e " Tailscale: ${RED}Not configured${NC}" + fi echo printf "${PURPLE}%-16s%s${NC}\n" "Log File:" "$LOG_FILE" printf "${PURPLE}%-16s%s${NC}\n" "Backups:" "$BACKUP_DIR" @@ -1459,6 +1566,9 @@ generate_summary() { fi if command -v tailscale >/dev/null 2>&1; then printf " %-20s${CYAN}%s${NC}\n" "- Tailscale status:" "tailscale status" + if [[ "$TS_SERVER" == "Not connected" && -n "$TS_COMMAND" ]]; then + printf " %-20s${CYAN}%s${NC}\n" "- Tailscale connect:" "$TS_COMMAND" + fi fi if [[ -f /root/run_backup.sh ]]; then echo -e " Remote Backup:" @@ -1468,10 +1578,13 @@ generate_summary() { printf " %-18s${CYAN}%s${NC}\n" "- Check logs:" "sudo less /var/log/backup_rsync.log" fi print_warning "\nACTION REQUIRED: If remote backup is enabled, ensure the root SSH key is copied to the destination server." + if [[ -n "$TS_COMMAND" ]]; then + print_warning "ACTION REQUIRED: Tailscale connection failed. Run the command above to connect manually." + fi print_warning "A reboot is required to apply all changes cleanly." if [[ $VERBOSE == true ]]; then if confirm "Reboot now?" "y"; then - print_info "Rebooting ..." + print_info "Rebooting now..." sleep 3 reboot else