From 32ad987dd9cac016249ce65ba180e33c096f0e23 Mon Sep 17 00:00:00 2001 From: buildplan Date: Mon, 30 Jun 2025 10:31:01 +0100 Subject: [PATCH 1/5] name change --- setup_harden_debian_ubuntu.sh => du_setup.sh | 0 setup_harden_debian_ubuntu.sh.sha256 | 1 - 2 files changed, 1 deletion(-) rename setup_harden_debian_ubuntu.sh => du_setup.sh (100%) delete mode 100644 setup_harden_debian_ubuntu.sh.sha256 diff --git a/setup_harden_debian_ubuntu.sh b/du_setup.sh similarity index 100% rename from setup_harden_debian_ubuntu.sh rename to du_setup.sh diff --git a/setup_harden_debian_ubuntu.sh.sha256 b/setup_harden_debian_ubuntu.sh.sha256 deleted file mode 100644 index 1e10689..0000000 --- a/setup_harden_debian_ubuntu.sh.sha256 +++ /dev/null @@ -1 +0,0 @@ -c4ff92d755b8c862c0a5c885b0a1dfa68832a1a5465e1e9913386374202c6a7a setup_harden_debian_ubuntu.sh From 83eb481978d0937b2b45c01832fafb19dffe1b59 Mon Sep 17 00:00:00 2001 From: buildplan <170122315+buildplan@users.noreply.github.com> Date: Mon, 30 Jun 2025 10:33:20 +0100 Subject: [PATCH 2/5] Update README.md --- README.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 789e0bc..89be993 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # Debian & Ubuntu Server Setup & Hardening Script -**Version:** 4.3 +**Version:** v0.50 -**Last Updated:** 2025-06-29 +**Last Updated:** 2025-06-30 **Compatible With:** @@ -29,7 +29,7 @@ This script automates the initial setup and security hardening of a fresh Debian * **Optional Software**: Offers interactive installation of: * Docker & Docker Compose * Tailscale (Mesh VPN) - * **Comprehensive Logging**: Logs all actions to `/var/log/setup_harden_debian_ubuntu_*.log`. + * **Comprehensive Logging**: Logs all actions to `/var/log/du_setup_*.log`. * **Automation-Friendly**: Supports `--quiet` mode for automated provisioning. ## Installation & Usage @@ -46,8 +46,8 @@ This script automates the initial setup and security hardening of a fresh Debian ### 1\. Download & Prepare Script ``` -wget https://raw.githubusercontent.com/buildplan/setup_harden_server/main/setup_harden_debian_ubuntu.sh -chmod +x setup_harden_debian_ubuntu.sh +wget https://raw.githubusercontent.com/buildplan/setup_harden_server/main/du_setup.sh +chmod +x du_setup.sh ``` ### 2\. Verify Script Integrity (Recommended) @@ -60,17 +60,17 @@ This command downloads the official checksum file and automatically compares it ``` # Download the official checksum file -wget https://raw.githubusercontent.com/buildplan/setup_harden_server/main/setup_harden_debian_ubuntu.sh.sha256 +wget https://raw.githubusercontent.com/buildplan/setup_harden_server/main/du_setup.sh.sha256 -# Run the check (it should output: setup_harden_debian_ubuntu.sh: OK) -sha256sum -c setup_harden_debian_ubuntu.sh.sha256 +# Run the check (it should output: du_setup.sh: OK) +sha256sum -c du_setup.sh.sha256 ``` **Option B: Manual Check** ``` # Generate the hash of your downloaded script -sha256sum setup_harden_debian_ubuntu.sh +sha256sum du_setup.sh ``` Compare the output hash to the one below. They must match exactly. @@ -82,13 +82,13 @@ Compare the output hash to the one below. They must match exactly. **Interactively (Recommended)** ``` -sudo ./setup_harden_debian_ubuntu.sh +sudo ./du_setup.sh ``` **Quiet Mode (For Automation)** ``` -sudo ./setup_harden_debian_ubuntu.sh --quiet +sudo ./du_setup.sh --quiet ``` > **Warning**: The script pauses to verify SSH access on the new port before disabling old access methods. **Test the new SSH connection from a separate terminal before proceeding\!** @@ -116,7 +116,7 @@ sudo ./setup_harden_debian_ubuntu.sh --quiet ## Logs & Backups - * **Log Files**: `/var/log/setup_harden_debian_ubuntu_*.log` + * **Log Files**: `/var/log/du_setup_*.log` * **Backup Logs**: `/var/log/backup_rsync.log` (for remote backup operations) * **Audit Logs**: `/var/log/setup_harden_security_audit_*.log` (for Lynis and debsecan results) * **Configuration Backups**: `/root/setup_harden_backup_*` From f335a8d9c63253082f1ad84cd6e301e2055263cf Mon Sep 17 00:00:00 2001 From: buildplan Date: Mon, 30 Jun 2025 10:35:43 +0100 Subject: [PATCH 3/5] name change --- du_setup.sh | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/du_setup.sh b/du_setup.sh index c96e289..f9db79f 100644 --- a/du_setup.sh +++ b/du_setup.sh @@ -1,7 +1,7 @@ #!/bin/bash # Debian 12 and Ubuntu Server Hardening Interactive Script -# Version: 4.3 | 2025-06-29 +# Version: 0.50 | 2025-06-30 # Changelog: # - v4.3: Add SHA256 integrity verification # - v4.2: Added Security Audit Tools (Integrating Lynis and Optionally Debsecan) & option to do Backup Testing @@ -18,19 +18,19 @@ # README at GitHub: https://github.com/buildplan/setup_harden_server # # Prerequisites: -# - Run as root on a fresh Debian 12 or Ubuntu server (e.g., sudo ./setup_harden_debian_ubuntu.sh or run as root ./setup_harden_debian_ubuntu.sh). +# - Run as root on a fresh Debian 12 or Ubuntu server (e.g., sudo ./du_setup.sh or run as root ./du_setup.sh). # - Internet connectivity is required for package installation. # # Usage: -# Download: wget https://raw.githubusercontent.com/buildplan/setup_harden_server/refs/heads/main/setup_harden_debian_ubuntu.sh -# Make it executable: chmod +x setup_harden_debian_ubuntu.sh -# Run it: sudo ./setup_harden_debian_ubuntu.sh [--quiet] +# Download: wget https://raw.githubusercontent.com/buildplan/setup_harden_server/refs/heads/main/du_setup.sh +# Make it executable: chmod +x du_setup.sh +# Run it: sudo ./du_setup.sh [--quiet] # # Options: # --quiet: Suppress non-critical output for automation. (Not recommended always best to review all the options) # # Notes: -# - The script creates a log file in /var/log/setup_harden_debian_ubuntu_*.log. +# - The script creates a log file in /var/log/du_setup_*.log. # - Critical configurations are backed up before modification. Backup files are at /root/setup_harden_backup_*. # - A new admin user is created with a mandatory password or SSH key for authentication. # - Root SSH login is disabled; all access is via the new user with sudo privileges. @@ -58,7 +58,7 @@ NC='\033[0m' # No Color # Script variables SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -LOG_FILE="/var/log/setup_harden_debian_ubuntu_$(date +%Y%m%d_%H%M%S).log" +LOG_FILE="/var/log/du_setup_$(date +%Y%m%d_%H%M%S).log" BACKUP_LOG="/var/log/backup_rsync.log" VERBOSE=true BACKUP_DIR="/root/setup_harden_backup_$(date +%Y%m%d_%H%M%S)" @@ -88,7 +88,7 @@ print_header() { echo -e "${CYAN}╔═════════════════════════════════════════════════════════════════╗${NC}" echo -e "${CYAN}║ ║${NC}" echo -e "${CYAN}║ DEBIAN/UBUNTU SERVER SETUP AND HARDENING SCRIPT ║${NC}" - echo -e "${CYAN}║ v4.3 | 2025-06-29 ║${NC}" + echo -e "${CYAN}║ v0.50 | 2025-06-30 ║${NC}" echo -e "${CYAN}║ ║${NC}" echo -e "${CYAN}╚═════════════════════════════════════════════════════════════════╝${NC}" echo @@ -232,7 +232,7 @@ check_system() { print_section "System Compatibility Check" if [[ $(id -u) -ne 0 ]]; then - print_error "This script must be run as root (e.g., sudo ./setup_harden_debian_ubuntu.sh)." + print_error "This script must be run as root (e.g., sudo ./du_setup.sh)." exit 1 fi print_success "Running with root privileges." From ef0d5e528b41b8cddfee9cd2c506aedf49c7dacb Mon Sep 17 00:00:00 2001 From: buildplan Date: Mon, 30 Jun 2025 10:38:28 +0100 Subject: [PATCH 4/5] name and versioning change --- du_setup.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/du_setup.sh b/du_setup.sh index f9db79f..12a6a67 100644 --- a/du_setup.sh +++ b/du_setup.sh @@ -3,6 +3,7 @@ # Debian 12 and Ubuntu Server Hardening Interactive Script # Version: 0.50 | 2025-06-30 # Changelog: +# - v0.50: versioning format change and repo name change # - v4.3: Add SHA256 integrity verification # - v4.2: Added Security Audit Tools (Integrating Lynis and Optionally Debsecan) & option to do Backup Testing # Fixed debsecan compatibility (Debian-only), added global BACKUP_LOG, added backup testing From 12fa9ac3024bf8ac74cb214015e50a5c801eb8c2 Mon Sep 17 00:00:00 2001 From: buildplan Date: Mon, 30 Jun 2025 10:46:56 +0100 Subject: [PATCH 5/5] SHA256 checksum updated --- README.md | 2 +- du_setup.sh.sha256 | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 du_setup.sh.sha256 diff --git a/README.md b/README.md index 89be993..1e25b2a 100644 --- a/README.md +++ b/README.md @@ -75,7 +75,7 @@ sha256sum du_setup.sh Compare the output hash to the one below. They must match exactly. -`c4ff92d755b8c862c0a5c885b0a1dfa68832a1a5465e1e9913386374202c6a7a` +`86d08c58198c1b754329484f6bba79326d847649467851dfa89da250b3e6fd6b` ### 3\. Run the Script diff --git a/du_setup.sh.sha256 b/du_setup.sh.sha256 new file mode 100644 index 0000000..fec7868 --- /dev/null +++ b/du_setup.sh.sha256 @@ -0,0 +1 @@ +86d08c58198c1b754329484f6bba79326d847649467851dfa89da250b3e6fd6b du_setup.sh