.

ConfigFiles/SNMP/snmpd-physicalhost.conf

@@ -0,0 +1,42 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation R4, Server Room, SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/local/librenms/ntp-client.sh
+
+#SMTP
+extend mailq /usr/local/librenms/postfix-queues
+extend postfixdetailed /usr/local/librenms/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/local/librenms/os-updates.sh
+
+
+#Hardware Detection
+extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
+extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
+
+#SMART
+extend smart /bin/cat /var/cache/smart
+
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1

Modules/Security/secharden-wazuh.sh

@@ -1,10 +1,19 @@
 #!/bin/bash
 
+# We don't want to run this on the wazuh server, otherwise bad things happen...
+
+export TSYS_NSM_CHECK
+TSYS_NSM_CHECK="$(hostname |grep -c tsys-nsm ||true)"
+
+if [ "$TSYS_NSM_CHECK" -eq 0 ]; then
+
 curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
-echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
 apt-get update
-WAZUH_MANAGER="tsys-nsm.knel.net" apt-get install wazuh-agent
+WAZUH_MANAGER="tsys-nsm.knel.net" apt-get -y install wazuh-agent
 systemctl daemon-reload
 systemctl enable wazuh-agent
 systemctl start wazuh-agent
-echo "wazuh-agent hold" | dpkg --set-selections
+echo "wazuh-agent hold" | dpkg --set-selections
+
+fi

SetupNewSystem.sh

@@ -122,7 +122,7 @@ chmod 400 /root/.ssh/authorized_keys
 chown root: /root/.ssh/authorized_keys
 
 
-if [ "$LOCALUSER_CHECK" = 1 ]; then
+if [ "$LOCALUSER_CHECK" -gt 0 ]; then
   if [ ! -d $LOCALUSER_SSH_DIR ]; then 
      mkdir -p /home/localuser/.ssh/
   fi
@@ -160,8 +160,12 @@ sh /tmp/webmin-setup.sh -f && rm -f /tmp/webmin-setup.sh
 
 # Setup lynis repo, used for sec ops/compliance
 
-echo "deb https://packages.cisofy.com/community/lynis/deb/ stable main" > /etc/apt/sources.list.d/cisofy-lynis.list
-curl --silent --insecure -s https://packages.cisofy.com/keys/cisofy-software-public.key | apt-key add -
+if [ -f /etc/apt/trusted.gpg.d/cisofy-software-public.gpg ]; then
+rm -f /etc/apt/trusted.gpg.d/cisofy-software-public.gpg
+fi
+
+curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cisofy-software-public.gpg
+echo "deb [arch=amd64,arm64 signed-by=/etc/apt/trusted.gpg.d/cisofy-software-public.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list
 
 # Setup tailscale
 
@@ -206,6 +210,8 @@ gpg  \
 molly-guard  \
 fail2ban \
 lshw  \
+fzf \
+ripgrep \
 sudo  \
 mailutils \
 clamav \
@@ -253,6 +259,9 @@ fi
 export VIRT_TYPE
 VIRT_TYPE="$(virt-what)"
 
+export IS_VIRT_GUEST
+VIRT_GUEST="$(echo "$VIRT_TYPE"|egrep -c 'hyperv|kvm' ||true )"
+
 export VIRT_GUEST
 VIRT_GUEST="$(echo "$VIRT_TYPE"|egrep 'hyperv|kvm' ||true )"
 
@@ -270,6 +279,7 @@ if [[ $PHYSICAL_HOST -gt 0 ]]; then
 export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
  i7z \
  thermald \
+ cpufrequtils \
  linux-cpupower
 # power-profiles-daemon
 fi
@@ -282,8 +292,6 @@ function global-postPackageConfiguration()
 
 echo Now running "$FUNCNAME"
 
-apt-file update
-
 systemctl stop postfix
 
 curl --silent ${DL_ROOT}/ConfigFiles/SMTP/postfix_generic> /etc/postfix/generic
@@ -304,12 +312,12 @@ echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" roo
 
 chsh -s $(which zsh) root
 
-if [ "$LOCALUSER_CHECK" = 1 ]; then
+if [ "$LOCALUSER_CHECK" -gt 0 ]; then
 chsh -s "$(which zsh)" localuser
 fi
 
-if [ "$SUBODEV_CHECK" = 1 ]; then
-chsh -s "$(which zsh)" localuser
+if [ "$SUBODEV_CHECK" -gt 0 ]; then
+chsh -s "$(which zsh)" subodev
 fi
 
 ###Post package deployment bits
@@ -323,11 +331,15 @@ sed -i "s|-Lsd|-LS6d|" /lib/systemd/system/snmpd.service
 
 pi-detect
 
-if [ $IS_RASPI = 1 ] ; then
+if [ "$IS_RASPI" -eq 1 ] ; then
 curl --silent ${DL_ROOT}/ConfigFiles/SNMP/snmpd-rpi.conf > /etc/snmp/snmpd.conf 
 fi
 
-if [ $IS_RASPI != 1 ] ; then
+if [ "$IS_PHYSICAL_HOST" -eq 1 ] ; then
+curl --silent ${DL_ROOT}/ConfigFiles/SNMP/snmpd-physicalhost.conf > /etc/snmp/snmpd.conf 
+fi
+
+if [ "$IS_VIRT_GUEST" -eq 1 ] ; then
 curl --silent ${DL_ROOT}/ConfigFiles/SNMP/snmpd.conf > /etc/snmp/snmpd.conf
 fi
 
@@ -336,8 +348,6 @@ systemctl daemon-reload && systemctl restart  snmpd && /etc/init.d/snmpd restart
 systemctl stop rsyslog 
 systemctl start rsyslog
 
-logger "hi hi from $(hostname)"
-
 if [ "$KALI_CHECK" -eq 0 ]; then
   curl --silent ${DL_ROOT}/ConfigFiles/NTP/ntp.conf > /etc/ntpsec/ntp.conf
   systemctl restart ntp 
@@ -354,7 +364,7 @@ systemctl start postfix
 /usr/sbin/accton on
 
 
-if [ $PHYSICAL_HOST -gt 0 ]; then
+if [ "$PHYSICAL_HOST" -gt 0 ]; then
 cpufreq-set -r -g performance
 cpupower frequency-set --governor performance
 
@@ -374,7 +384,6 @@ echo Completed running "$FUNCNAME"
 }
 
 
-
 ####################################################################################################
 # Run various modules
 ####################################################################################################
@@ -455,8 +464,9 @@ global-postPackageConfiguration
 
 secharden-ssh
 secharden-wazuh
-#secharden-2fa
 #secharden-auto-upgrades
 #secharden-audit-agents
+
+#secharden-2fa
 #secharden-scap-stig
 #auth-cloudron-ldap