diff --git a/README.md b/README.md index 16cbf8d..1bb50c6 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # Debian & Ubuntu Server Setup & Hardening Script -**Version:** v0.56 +**Version:** v0.57 -**Last Updated:** 2025-07-04 +**Last Updated:** 2025-07-07 **Compatible With:** @@ -75,12 +75,12 @@ sha256sum du_setup.sh Compare the output hash to the one below. They must match exactly. -`d8c56a3927972cb0e6a5c1f732a03bcdd050715a949ff58232e3bfe6d0c6d260` +`7d8fa1b1682018eb5d3470630b6b28b620f090f1066035b4c483737f2697d736` Or echo the hash to check, it should output: `du_setup.sh: OK` ``` -echo d8c56a3927972cb0e6a5c1f732a03bcdd050715a949ff58232e3bfe6d0c6d260 du_setup.sh | sha256sum --check - +echo 7d8fa1b1682018eb5d3470630b6b28b620f090f1066035b4c483737f2697d736 du_setup.sh | sha256sum --check - ``` ### 3\. Run the Script diff --git a/du_setup.sh b/du_setup.sh index 0eb76c0..86c23ab 100644 --- a/du_setup.sh +++ b/du_setup.sh @@ -1,8 +1,10 @@ #!/bin/bash # Debian 12 and Ubuntu Server Hardening Interactive Script -# Version: 0.56 | 2025-07-04 +# Version: 0.57 | 2025-07-07 # Changelog: +# - v0.57: Fix for silent failure at test_backup() +# Option to choose which directories to back up. # - v0.56: Make tailscale config optional # - v0.55: Improving setup_user() - ssh-keygen replaced the option to skip ssh key # - v0.54: Fix for rollback_ssh_changes() - more reliable on newer Ubuntu @@ -109,7 +111,7 @@ print_header() { echo -e "${CYAN}╔═════════════════════════════════════════════════════════════════╗${NC}" echo -e "${CYAN}║ ║${NC}" echo -e "${CYAN}║ DEBIAN/UBUNTU SERVER SETUP AND HARDENING SCRIPT ║${NC}" - echo -e "${CYAN}║ v0.56 | 2025-07-04 ║${NC}" + echo -e "${CYAN}║ v0.57 | 2025-07-07 ║${NC}" echo -e "${CYAN}║ ║${NC}" echo -e "${CYAN}╚═════════════════════════════════════════════════════════════════╝${NC}" echo @@ -1486,6 +1488,35 @@ setup_backup() { fi fi + # --- Collect Backup Source Directories --- + local BACKUP_DIRS_ARRAY=() + while true; do + print_info "Enter the full paths of directories to back up, separated by spaces." + read -rp "$(echo -e "${CYAN}Default is '/home/${USERNAME}/'. Press Enter for default or provide your own: ${NC}")" -a user_input_dirs + + if [ ${#user_input_dirs[@]} -eq 0 ]; then + BACKUP_DIRS_ARRAY=("/home/${USERNAME}/") + break + fi + + local all_valid=true + for dir in "${user_input_dirs[@]}"; do + if [[ ! "$dir" =~ ^/ ]]; then + print_error "Invalid path: '$dir'. All paths must be absolute (start with '/'). Please try again." + all_valid=false + break + fi + done + + if [[ "$all_valid" == true ]]; then + BACKUP_DIRS_ARRAY=("${user_input_dirs[@]}") + break + fi + done + # Convert array to a space-separated string for the backup script + local BACKUP_DIRS_STRING="${BACKUP_DIRS_ARRAY[*]}" + print_info "Directories to be backed up: $BACKUP_DIRS_STRING" + # --- Create Exclude File --- print_info "Creating rsync exclude file at $EXCLUDE_FILE_PATH..." tee "$EXCLUDE_FILE_PATH" > /dev/null <<'EOF' @@ -1494,11 +1525,16 @@ setup_backup() { .docker/ .local/ .npm/ +.ssh/ .vscode-server/ *.log *.tmp node_modules/ +.bashrc .bash_history +.bash_logout +.cloud-locale-test.skip +.profile .wget-hsts EOF if confirm "Add more directories/files to the exclude list?"; then @@ -1548,7 +1584,7 @@ EOF # Generated by server setup script on $(date) set -Euo pipefail; umask 077 # --- CONFIGURATION --- -LOCAL_DIR="/home/${USERNAME}/" +BACKUP_DIRS="${BACKUP_DIRS_STRING}" REMOTE_DEST="${BACKUP_DEST}" REMOTE_PATH="${REMOTE_BACKUP_PATH}" SSH_PORT="${BACKUP_PORT}" @@ -1586,7 +1622,7 @@ exec 200>"$LOCK_FILE"; flock -n 200 || { echo "Backup already running."; exit 1; touch "$LOG_FILE"; chmod 600 "$LOG_FILE"; if [[ -f "$LOG_FILE" && $(stat -c%s "$LOG_FILE") -gt 10485760 ]]; then mv "$LOG_FILE" "${LOG_FILE}.1"; fi echo "--- Starting Backup at $(date) ---" >> "$LOG_FILE" # --- RSYNC COMMAND --- -rsync_output=$(rsync -avz --delete --stats --exclude-from="$EXCLUDE_FILE" -e "ssh -p $SSH_PORT" "$LOCAL_DIR" "${REMOTE_DEST}:${REMOTE_PATH}" 2>&1) +rsync_output=$(rsync -avz --delete --stats --exclude-from="$EXCLUDE_FILE" -e "ssh -p $SSH_PORT" $BACKUP_DIRS "${REMOTE_DEST}:${REMOTE_PATH}" 2>&1) rsync_exit_code=$?; echo "$rsync_output" >> "$LOG_FILE" # --- NOTIFICATION --- if [[ $rsync_exit_code -eq 0 ]]; then @@ -1658,30 +1694,19 @@ test_backup() { if [[ $(id -u) -ne 0 ]]; then print_error "Backup test must be run as root. Re-run with 'sudo -E' or as root." log "Backup test failed: Script not run as root (UID $(id -u))." - print_info "Action: Run the script with 'sudo -E ./du_setup.sh' or as the root user." return 0 fi - # Check if backup script exists and is readable local BACKUP_SCRIPT_PATH="/root/run_backup.sh" - if [[ ! -f "$BACKUP_SCRIPT_PATH" ]]; then - print_error "Backup script not found at $BACKUP_SCRIPT_PATH." - log "Backup test failed: $BACKUP_SCRIPT_PATH not found." - print_info "Action: Ensure the backup script exists at $BACKUP_SCRIPT_PATH and is accessible." - return 0 - fi - if [[ ! -r "$BACKUP_SCRIPT_PATH" ]]; then - print_error "Cannot read backup script at $BACKUP_SCRIPT_PATH. Check permissions." - log "Backup test failed: $BACKUP_SCRIPT_PATH not readable." - print_info "Action: Run 'chmod u+r $BACKUP_SCRIPT_PATH' as root to fix permissions." + if [[ ! -f "$BACKUP_SCRIPT_PATH" || ! -r "$BACKUP_SCRIPT_PATH" ]]; then + print_error "Backup script not found or not readable at $BACKUP_SCRIPT_PATH." + log "Backup test failed: Script not found or not readable." return 0 fi - # Check if timeout command is available if ! command -v timeout >/dev/null 2>&1; then print_error "The 'timeout' command is not available. Please install coreutils." log "Backup test failed: 'timeout' command not found." - print_info "Action: Install coreutils with 'apt install coreutils' or equivalent." return 0 fi @@ -1691,69 +1716,38 @@ test_backup() { return 0 fi - # Extract backup configuration from script - local BACKUP_DEST REMOTE_BACKUP_PATH BACKUP_PORT SSH_COPY_ID_FLAGS + # Extract backup configuration from the generated backup script + local BACKUP_DEST REMOTE_BACKUP_PATH BACKUP_PORT BACKUP_DEST=$(grep "^REMOTE_DEST=" "$BACKUP_SCRIPT_PATH" | cut -d'"' -f2 2>/dev/null || echo "unknown") BACKUP_PORT=$(grep "^SSH_PORT=" "$BACKUP_SCRIPT_PATH" | cut -d'"' -f2 2>/dev/null || echo "22") REMOTE_BACKUP_PATH=$(grep "^REMOTE_PATH=" "$BACKUP_SCRIPT_PATH" | cut -d'"' -f2 2>/dev/null || echo "unknown") - SSH_COPY_ID_FLAGS=$(grep "^SSH_COPY_ID_FLAGS=" "$BACKUP_SCRIPT_PATH" | cut -d'"' -f2 2>/dev/null || echo "") local BACKUP_LOG="/var/log/backup_rsync.log" if [[ "$BACKUP_DEST" == "unknown" || "$REMOTE_BACKUP_PATH" == "unknown" ]]; then - print_error "Invalid backup configuration in $BACKUP_SCRIPT_PATH." + print_error "Could not parse backup configuration from $BACKUP_SCRIPT_PATH." log "Backup test failed: Invalid configuration in $BACKUP_SCRIPT_PATH." - print_info "Action: Check $BACKUP_SCRIPT_PATH for valid REMOTE_DEST and REMOTE_PATH variables." return 0 fi - # Ensure backup log is writable - if ! touch "$BACKUP_LOG" 2>/dev/null || ! chmod 600 "$BACKUP_LOG" 2>/dev/null; then - print_error "Cannot create or write to $BACKUP_LOG." - log "Backup test failed: Cannot write to $BACKUP_LOG." - print_info "Action: Ensure /var/log/ is writable by root and try again." - return 0 - fi - - # Check SSH key existence - local SSH_KEY="/root/.ssh/id_ed25519" - if [[ ! -f "$SSH_KEY" || ! -r "$SSH_KEY" ]]; then - print_error "SSH key $SSH_KEY not found or not readable." - log "Backup test failed: SSH key not found or not readable." - print_info "Action: Create or fix permissions for $SSH_KEY with 'chmod 600 $SSH_KEY'." - return 0 - fi - - # Create a temporary test directory + # Create a temporary directory and file for the test local TEST_DIR="/root/test_backup_$(date +%Y%m%d_%H%M%S)" - if ! mkdir -p "$TEST_DIR" 2>/dev/null; then - print_error "Failed to create test directory $TEST_DIR." - log "Backup test failed: Cannot create $TEST_DIR." - print_info "Action: Ensure /root/ is writable by root and try again." - return 0 - fi - if ! echo "Test file for backup verification" > "$TEST_DIR/test.txt" 2>/dev/null; then - print_error "Failed to create test file in $TEST_DIR." - log "Backup test failed: Cannot create test file in $TEST_DIR." - print_info "Action: Ensure /root/ is writable by root and try again." - rm -rf "$TEST_DIR" 2>/dev/null - return 0 - fi - if ! chmod 600 "$TEST_DIR/test.txt" 2>/dev/null; then - print_error "Failed to set permissions on $TEST_DIR/test.txt." - log "Backup test failed: Cannot set permissions on $TEST_DIR/test.txt." - print_info "Action: Ensure /root/ is writable by root and try again." + if ! mkdir -p "$TEST_DIR" || ! echo "Test file for backup verification" > "$TEST_DIR/test.txt"; then + print_error "Failed to create test directory or file in /root/." + log "Backup test failed: Cannot create test directory/file." rm -rf "$TEST_DIR" 2>/dev/null return 0 fi print_info "Running test backup to $BACKUP_DEST:$REMOTE_BACKUP_PATH..." local RSYNC_OUTPUT RSYNC_EXIT_CODE TIMEOUT_DURATION=120 + local SSH_KEY="/root/.ssh/id_ed25519" local SSH_COMMAND="ssh -p $BACKUP_PORT -i $SSH_KEY -o BatchMode=yes -o StrictHostKeyChecking=no" - if [[ -n "$SSH_COPY_ID_FLAGS" ]]; then - SSH_COMMAND="sftp -P $BACKUP_PORT -i $SSH_KEY -o BatchMode=yes -o StrictHostKeyChecking=no" - fi + + set +e RSYNC_OUTPUT=$(timeout "$TIMEOUT_DURATION" rsync -avz --delete -e "$SSH_COMMAND" "$TEST_DIR/" "${BACKUP_DEST}:${REMOTE_BACKUP_PATH}test_backup/" 2>&1) RSYNC_EXIT_CODE=$? + set -e # Re-enable 'exit on error' + echo "--- Test Backup at $(date) ---" >> "$BACKUP_LOG" echo "$RSYNC_OUTPUT" >> "$BACKUP_LOG" @@ -1761,30 +1755,24 @@ test_backup() { print_success "Test backup successful! Check $BACKUP_LOG for details." log "Test backup successful." else + print_warning "The backup test failed. This is not critical, and the script will continue." + print_info "You can troubleshoot this after the server setup is complete." + if [[ $RSYNC_EXIT_CODE -eq 124 ]]; then - print_error "Test backup timed out after $TIMEOUT_DURATION seconds. Check network connectivity or increase timeout." + print_error "Test backup timed out after $TIMEOUT_DURATION seconds." log "Test backup failed: Timeout after $TIMEOUT_DURATION seconds." - print_info "Action: Verify network connectivity to $BACKUP_DEST and retry." else - print_error "Test backup failed (exit code: $RSYNC_EXIT_CODE). Check $BACKUP_LOG for details." + print_error "Test backup failed (exit code: $RSYNC_EXIT_CODE). See $BACKUP_LOG for details." log "Test backup failed with exit code $RSYNC_EXIT_CODE." - print_info "Troubleshooting steps:" - print_info " - Verify SSH key: cat $SSH_KEY.pub" - print_info " - Copy key: ssh-copy-id -p \"$BACKUP_PORT\" -i $SSH_KEY.pub $SSH_COPY_ID_FLAGS \"$BACKUP_DEST\"" - print_info " - Test SSH: ssh -p \"$BACKUP_PORT\" -i $SSH_KEY \"$BACKUP_DEST\" true" - if [[ -n "$SSH_COPY_ID_FLAGS" ]]; then - print_info " - For Hetzner, ensure ~/.ssh/ exists: ssh -p \"$BACKUP_PORT\" \"$BACKUP_DEST\" \"mkdir -p ~/.ssh && chmod 700 ~/.ssh\"" - fi fi + + print_info "Common troubleshooting steps:" + print_info " - Ensure the root SSH key is copied to the destination: ssh-copy-id -p \"$BACKUP_PORT\" -i \"$SSH_KEY.pub\" \"$BACKUP_DEST\"" + print_info " - Check firewall rules on both this server and the destination." fi - # Clean up test directory - if ! rm -rf "$TEST_DIR" 2>/dev/null; then - print_warning "Failed to clean up test directory $TEST_DIR." - log "Cleanup of $TEST_DIR failed." - print_info "Action: Manually remove $TEST_DIR with 'rm -rf $TEST_DIR' as root." - fi - + # Clean up the temporary test directory + rm -rf "$TEST_DIR" 2>/dev/null print_success "Backup test completed." log "Backup test completed." return 0 diff --git a/du_setup.sh.sha256 b/du_setup.sh.sha256 index de8dff8..2a3ab68 100644 --- a/du_setup.sh.sha256 +++ b/du_setup.sh.sha256 @@ -1 +1 @@ -d8c56a3927972cb0e6a5c1f732a03bcdd050715a949ff58232e3bfe6d0c6d260 du_setup.sh +7d8fa1b1682018eb5d3470630b6b28b620f090f1066035b4c483737f2697d736 du_setup.sh