KNEL/KNELServerBuild
2
0
Fork 0
Code Pull Requests Actions Packages Releases 1 Activity

refactor(provisioning): make scripts self-locating and read configs locally

Browse Source 
All provisioning scripts and modules now resolve their own location via
BASH_SOURCE and derive PROJECT_ROOT_PATH from it, removing a hard
dependency on the current working directory.

- Derive PROJECT_ROOT_PATH/CONFIGFILES_PATH/MODULES_PATH/SCRIPTS_PATH
  from BASH_SOURCE in SetupNewSystem.sh and every module
- Replace all curl ${DL_ROOT}/... downloads with cat of the matching
  local files under ProjectCode/ConfigFiles (the dl.knownelement.com CDN
  is no longer required for a git clone)
- Invoke modules by absolute path instead of cd ./Modules/X && bash ./x
- Fix secharden-audit-agents.sh: wrong path depth (../../ vs ../../..),
  wrong Project-Includes glob, and ConfigFiles/AudidD -> AuditD typo,
  all of which previously crashed the script
- Remove duplicate FrameworkVars source lines

Run from anywhere with: sudo bash ProjectCode/SetupNewSystem.sh

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble
2026-07-25 13:49:39 -05:00
parent 65d4985d16
commit 688b7190e6
7 changed files with 119 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ProjectCode/Modules/Security/secharden-2fa.sh
+6 -10
View File
@@ -9,11 +9,10 @@
#Core framework functions...
#####
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)"
#Framework variables are read from hee
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -21,19 +20,16 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in ../../../Project-Includes/*; do
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
# 2FA Configuration
BACKUP_DIR="/root/backup/2fa"
PAM_CONFIG_DIR="/etc/pam.d"
ProjectCode/Modules/Security/secharden-audit-agents.sh
+12 -13
View File
@@ -4,10 +4,10 @@
#Core framework functions...
#####
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../)"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
#Framework variables are read from hee
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -15,20 +15,19 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in ../Project-Includes/*; do
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
export DL_ROOT
DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
# Material herein Sourced from
# https://cisofy.com/documentation/lynis/
@@ -42,10 +41,10 @@ DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
#Auditd
curl --silent ${DL_ROOT}/ConfigFiles/AudidD/auditd.conf > /etc/audit/auditd.conf
cat "$CONFIGFILES_PATH/AuditD/auditd.conf" > /etc/audit/auditd.conf
# Systemd
curl --silent ${DL_ROOT}/ConfigFiles/Systemd/journald.conf > /etc/systemd/journald.conf
cat "$CONFIGFILES_PATH/Systemd/journald.conf" > /etc/systemd/journald.conf
# logrotate
curl --silent ${DL_ROOT}/ConfigFiles/Logrotate/logrotate.conf > /etc/logrotate.conf
cat "$CONFIGFILES_PATH/Logrotate/logrotate.conf" > /etc/logrotate.conf
ProjectCode/Modules/Security/secharden-scap-stig.sh
+24 -25
View File
@@ -5,11 +5,10 @@
#Core framework functions...
#########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)"
#Framework variables are read from hee
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -17,19 +16,19 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in ../../../Project-Includes/*; do
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
#########################################
# Core script code begins here
@@ -82,24 +81,24 @@ systemctl --now disable autofs || true
apt-get -y --purge remove autofs || true
#disable usb storage
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/usb_storage.conf > /etc/modprobe.d/usb_storage.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/dccp.conf > /etc/modprobe.d/dccp.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/rds.conf > /etc/modprobe.d/rds.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/sctp.conf > /etc/modprobe.d/sctp.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/tipc.conf > /etc/modprobe.d/tipc.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/cramfs.conf > /etc/modprobe.d/cramfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/freevxfs.conf > /etc/modprobe.d/freevxfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/hfs.conf > /etc/modprobe.d/hfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/hfsplus.conf > /etc/modprobe.d/hfsplus.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/jffs2.conf > /etc/modprobe.d/jffs2.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/squashfs.conf > /etc/modprobe.d/squashfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/udf.conf > /etc/modprobe.d/udf.conf
cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf
#banners
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/BANNERS/issue > /etc/issue
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/BANNERS/issue.net > /etc/issue.net
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/BANNERS/motd > /etc/motd
cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd
#Cron perms
ProjectCode/Modules/Security/secharden-ssh.sh
+14 -15
View File
@@ -4,11 +4,10 @@
#Core framework functions...
#########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)"
#Framework variables are read from here
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -16,19 +15,19 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in ../../../Project-Includes/*; do
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
#########################################
# Core script code begins here
@@ -54,7 +53,7 @@ if [ ! -d $ROOT_SSH_DIR ]; then
mkdir /root/.ssh/
fi
cat ../../ConfigFiles/SSH/AuthorizedKeys/root-ssh-authorized-keys >/root/.ssh/authorized_keys
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/root-ssh-authorized-keys" >/root/.ssh/authorized_keys
chmod 400 /root/.ssh/authorized_keys
chown root: /root/.ssh/authorized_keys
@@ -63,7 +62,7 @@ if [ "$LOCALUSER_CHECK" -gt 0 ]; then
mkdir -p /home/localuser/.ssh/
fi
cat ../../ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys >/home/localuser/.ssh/authorized_keys
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/localuser/.ssh/authorized_keys
chown localuser /home/localuser/.ssh/authorized_keys &&
chmod 400 /home/localuser/.ssh/authorized_keys
fi
@@ -74,7 +73,7 @@ if [ "$SUBODEV_CHECK" = 1 ]; then
mkdir /home/subodev/.ssh/
fi
cat ../../ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys >/home/subodev/.ssh/authorized_keys
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/subodev/.ssh/authorized_keys
chmod 400 /home/subodev/.ssh/authorized_keys &&
chown subodev: /home/subodev/.ssh/authorized_keys
fi
@@ -84,7 +83,7 @@ DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || tr
if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
cat ../../ConfigFiles/SSH/Configs/tsys-sshd-config >/etc/ssh/sshd_config
cat "$CONFIGFILES_PATH/SSH/Configs/tsys-sshd-config" >/etc/ssh/sshd_config
fi
@@ -94,7 +93,7 @@ export UBUNTU_CHECK
UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)"
if [ "$UBUNTU_CHECK" -ne 1 ]; then
cat ../../ConfigFiles/SSH/Configs/ssh-audit-hardening.conf >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
cat "$CONFIGFILES_PATH/SSH/Configs/ssh-audit-hardening.conf" >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
chmod og-rwx /etc/ssh/sshd_config.d/*
fi
ProjectCode/Modules/Security/secharden-wazuh.sh
+6 -9
View File
@@ -4,10 +4,10 @@
#Core framework functions...
#########################################
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
#Framework variables are read from here
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -15,19 +15,16 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in ../../../Project-Includes/*; do
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
#########################################
# Core script code begins here