KNEL/KNELServerBuild
2
0
Fork 0
Code Pull Requests Actions Packages Releases 1 Activity

refactor(provisioning): make scripts self-locating and read configs locally

Browse Source 
All provisioning scripts and modules now resolve their own location via
BASH_SOURCE and derive PROJECT_ROOT_PATH from it, removing a hard
dependency on the current working directory.

- Derive PROJECT_ROOT_PATH/CONFIGFILES_PATH/MODULES_PATH/SCRIPTS_PATH
  from BASH_SOURCE in SetupNewSystem.sh and every module
- Replace all curl ${DL_ROOT}/... downloads with cat of the matching
  local files under ProjectCode/ConfigFiles (the dl.knownelement.com CDN
  is no longer required for a git clone)
- Invoke modules by absolute path instead of cd ./Modules/X && bash ./x
- Fix secharden-audit-agents.sh: wrong path depth (../../ vs ../../..),
  wrong Project-Includes glob, and ConfigFiles/AudidD -> AuditD typo,
  all of which previously crashed the script
- Remove duplicate FrameworkVars source lines

Run from anywhere with: sudo bash ProjectCode/SetupNewSystem.sh

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble
2026-07-25 13:49:39 -05:00
parent 65d4985d16
commit 688b7190e6
7 changed files with 119 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ProjectCode/Modules/OAM/oam-librenms.sh
+23 -20
View File
@@ -1,9 +1,9 @@
#!/bin/bash #!/bin/bash
export PROJECT_ROOT_PATH SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT_PATH="$(realpath ../../../)"
#Framework variables are read from hee export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -11,19 +11,22 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars export AGENTS_PATH
AGENTS_PATH="$PROJECT_ROOT_PATH/ProjectCode/Agents"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../../../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
print_info "Setting up librenms agent..." print_info "Setting up librenms agent..."
cat ../../Agents/librenms/distro > /usr/local/bin/distro cat "$AGENTS_PATH/librenms/distro" > /usr/local/bin/distro
chmod +x /usr/local/bin/distro chmod +x /usr/local/bin/distro
if [ ! -d /usr/lib/check_mk_agent ]; then if [ ! -d /usr/lib/check_mk_agent ]; then
@@ -38,26 +41,26 @@ if [ ! -d /usr/lib/check_mk_agent/local ]; then
mkdir -p /usr/lib/check_mk_agent/local mkdir -p /usr/lib/check_mk_agent/local
fi fi
cat ../../Agents/librenms/check_mk_agent > /usr/bin/check_mk_agent cat "$AGENTS_PATH/librenms/check_mk_agent" > /usr/bin/check_mk_agent
chmod +x /usr/bin/check_mk_agent chmod +x /usr/bin/check_mk_agent
cat ../../Agents/librenms/check_mk@.service > /etc/systemd/system/check_mk@.service cat "$AGENTS_PATH/librenms/check_mk@.service" > /etc/systemd/system/check_mk@.service
cat ../../Agents/librenms/check_mk.socket > /etc/systemd/system/check_mk.socket cat "$AGENTS_PATH/librenms/check_mk.socket" > /etc/systemd/system/check_mk.socket
systemctl enable check_mk.socket systemctl enable check_mk.socket
systemctl start check_mk.socket systemctl start check_mk.socket
#Modules commented out below, we will roll out on systems that use them, most of the fleet doesn't use those modules #Modules commented out below, we will roll out on systems that use them, most of the fleet doesn't use those modules
cat ../../Agents/librenms/dmi.sh > /usr/lib/check_mk_agent/local/dmi.sh cat "$AGENTS_PATH/librenms/dmi.sh" > /usr/lib/check_mk_agent/local/dmi.sh
cat ../../Agents/librenms/dpkg.sh > /usr/lib/check_mk_agent/local/dpkg.sh cat "$AGENTS_PATH/librenms/dpkg.sh" > /usr/lib/check_mk_agent/local/dpkg.sh
#cat ../../Agents/librenms/mysql.sh > /usr/lib/check_mk_agent/local/mysql.sh #cat "$AGENTS_PATH/librenms/mysql.sh" > /usr/lib/check_mk_agent/local/mysql.sh
cat ../../Agents/librenms/ntp-client > /usr/lib/check_mk_agent/local/ntp-client cat "$AGENTS_PATH/librenms/ntp-client" > /usr/lib/check_mk_agent/local/ntp-client
#cat ../../Agents/librenms/ntp-server.sh > /usr/lib/check_mk_agent/local/ntp-server.sh #cat "$AGENTS_PATH/librenms/ntp-server.sh" > /usr/lib/check_mk_agent/local/ntp-server.sh
cat ../../Agents/librenms/os-updates.sh > /usr/lib/check_mk_agent/local/os-updates.sh cat "$AGENTS_PATH/librenms/os-updates.sh" > /usr/lib/check_mk_agent/local/os-updates.sh
cat ../../Agents/librenms/postfixdetailed > /usr/lib/check_mk_agent/local/postfixdetailed cat "$AGENTS_PATH/librenms/postfixdetailed" > /usr/lib/check_mk_agent/local/postfixdetailed
cat ../../Agents/librenms/postfix-queues > /usr/lib/check_mk_agent/local/postfix-queues cat "$AGENTS_PATH/librenms/postfix-queues" > /usr/lib/check_mk_agent/local/postfix-queues
#cat ../../Agents/librenms/smart.sh > /usr/lib/check_mk_agent/local/smart #cat "$AGENTS_PATH/librenms/smart.sh" > /usr/lib/check_mk_agent/local/smart
#cat ../../Agents/librenms/smart.sh.config > /usr/lib/check_mk_agent/local/smart.config #cat "$AGENTS_PATH/librenms/smart.sh.config" > /usr/lib/check_mk_agent/local/smart.config
chmod +x /usr/lib/check_mk_agent/local/* chmod +x /usr/lib/check_mk_agent/local/*
ProjectCode/Modules/Security/secharden-2fa.sh
+6 -10
View File
@@ -9,11 +9,10 @@
#Core framework functions... #Core framework functions...
##### #####
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)" PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
#Framework variables are read from hee
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -21,19 +20,16 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../../../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
# 2FA Configuration # 2FA Configuration
BACKUP_DIR="/root/backup/2fa" BACKUP_DIR="/root/backup/2fa"
PAM_CONFIG_DIR="/etc/pam.d" PAM_CONFIG_DIR="/etc/pam.d"
ProjectCode/Modules/Security/secharden-audit-agents.sh
+12 -13
View File
@@ -4,10 +4,10 @@
#Core framework functions... #Core framework functions...
##### #####
export PROJECT_ROOT_PATH SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT_PATH="$(realpath ../../)"
#Framework variables are read from hee export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -15,20 +15,19 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
export DL_ROOT
DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
# Material herein Sourced from # Material herein Sourced from
# https://cisofy.com/documentation/lynis/ # https://cisofy.com/documentation/lynis/
@@ -42,10 +41,10 @@ DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
#Auditd #Auditd
curl --silent ${DL_ROOT}/ConfigFiles/AudidD/auditd.conf > /etc/audit/auditd.conf cat "$CONFIGFILES_PATH/AuditD/auditd.conf" > /etc/audit/auditd.conf
# Systemd # Systemd
curl --silent ${DL_ROOT}/ConfigFiles/Systemd/journald.conf > /etc/systemd/journald.conf cat "$CONFIGFILES_PATH/Systemd/journald.conf" > /etc/systemd/journald.conf
# logrotate # logrotate
curl --silent ${DL_ROOT}/ConfigFiles/Logrotate/logrotate.conf > /etc/logrotate.conf cat "$CONFIGFILES_PATH/Logrotate/logrotate.conf" > /etc/logrotate.conf
ProjectCode/Modules/Security/secharden-scap-stig.sh
+24 -25
View File
@@ -5,11 +5,10 @@
#Core framework functions... #Core framework functions...
######################################### #########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)" PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
#Framework variables are read from hee
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -17,19 +16,19 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../../../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
######################################### #########################################
# Core script code begins here # Core script code begins here
@@ -82,24 +81,24 @@ systemctl --now disable autofs || true
apt-get -y --purge remove autofs || true apt-get -y --purge remove autofs || true
#disable usb storage #disable usb storage
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/usb_storage.conf > /etc/modprobe.d/usb_storage.conf cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/dccp.conf > /etc/modprobe.d/dccp.conf cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/rds.conf > /etc/modprobe.d/rds.conf cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/sctp.conf > /etc/modprobe.d/sctp.conf cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/tipc.conf > /etc/modprobe.d/tipc.conf cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/cramfs.conf > /etc/modprobe.d/cramfs.conf cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/freevxfs.conf > /etc/modprobe.d/freevxfs.conf cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/hfs.conf > /etc/modprobe.d/hfs.conf cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/hfsplus.conf > /etc/modprobe.d/hfsplus.conf cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/jffs2.conf > /etc/modprobe.d/jffs2.conf cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/squashfs.conf > /etc/modprobe.d/squashfs.conf cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/udf.conf > /etc/modprobe.d/udf.conf cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf
#banners #banners
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/BANNERS/issue > /etc/issue cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/BANNERS/issue.net > /etc/issue.net cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/BANNERS/motd > /etc/motd cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd
#Cron perms #Cron perms
ProjectCode/Modules/Security/secharden-ssh.sh
+14 -15
View File
@@ -4,11 +4,10 @@
#Core framework functions... #Core framework functions...
######################################### #########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../../../)" PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
#Framework variables are read from here
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -16,19 +15,19 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../../../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
######################################### #########################################
# Core script code begins here # Core script code begins here
@@ -54,7 +53,7 @@ if [ ! -d $ROOT_SSH_DIR ]; then
mkdir /root/.ssh/ mkdir /root/.ssh/
fi fi
cat ../../ConfigFiles/SSH/AuthorizedKeys/root-ssh-authorized-keys >/root/.ssh/authorized_keys cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/root-ssh-authorized-keys" >/root/.ssh/authorized_keys
chmod 400 /root/.ssh/authorized_keys chmod 400 /root/.ssh/authorized_keys
chown root: /root/.ssh/authorized_keys chown root: /root/.ssh/authorized_keys
@@ -63,7 +62,7 @@ if [ "$LOCALUSER_CHECK" -gt 0 ]; then
mkdir -p /home/localuser/.ssh/ mkdir -p /home/localuser/.ssh/
fi fi
cat ../../ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys >/home/localuser/.ssh/authorized_keys cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/localuser/.ssh/authorized_keys
chown localuser /home/localuser/.ssh/authorized_keys && chown localuser /home/localuser/.ssh/authorized_keys &&
chmod 400 /home/localuser/.ssh/authorized_keys chmod 400 /home/localuser/.ssh/authorized_keys
fi fi
@@ -74,7 +73,7 @@ if [ "$SUBODEV_CHECK" = 1 ]; then
mkdir /home/subodev/.ssh/ mkdir /home/subodev/.ssh/
fi fi
cat ../../ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys >/home/subodev/.ssh/authorized_keys cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/subodev/.ssh/authorized_keys
chmod 400 /home/subodev/.ssh/authorized_keys && chmod 400 /home/subodev/.ssh/authorized_keys &&
chown subodev: /home/subodev/.ssh/authorized_keys chown subodev: /home/subodev/.ssh/authorized_keys
fi fi
@@ -84,7 +83,7 @@ DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || tr
if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
cat ../../ConfigFiles/SSH/Configs/tsys-sshd-config >/etc/ssh/sshd_config cat "$CONFIGFILES_PATH/SSH/Configs/tsys-sshd-config" >/etc/ssh/sshd_config
fi fi
@@ -94,7 +93,7 @@ export UBUNTU_CHECK
UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)" UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)"
if [ "$UBUNTU_CHECK" -ne 1 ]; then if [ "$UBUNTU_CHECK" -ne 1 ]; then
cat ../../ConfigFiles/SSH/Configs/ssh-audit-hardening.conf >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf cat "$CONFIGFILES_PATH/SSH/Configs/ssh-audit-hardening.conf" >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
chmod og-rwx /etc/ssh/sshd_config.d/* chmod og-rwx /etc/ssh/sshd_config.d/*
fi fi
ProjectCode/Modules/Security/secharden-wazuh.sh
+6 -9
View File
@@ -4,10 +4,10 @@
#Core framework functions... #Core framework functions...
######################################### #########################################
export PROJECT_ROOT_PATH SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT_PATH="$(realpath ../../../)"
#Framework variables are read from here export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -15,19 +15,16 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../../../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
#Framework variables are read from hee
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
######################################### #########################################
# Core script code begins here # Core script code begins here
ProjectCode/SetupNewSystem.sh
+34 -41
View File
@@ -5,11 +5,10 @@
##### #####
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(realpath ../)" PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/.." && pwd)"
#Framework variables are read from hee
export GIT_VENDOR_PATH_ROOT export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/" GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
@@ -17,13 +16,22 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework" KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do export MODULES_PATH
MODULES_PATH="$PROJECT_ROOT_PATH/ProjectCode/Modules"
export SCRIPTS_PATH
SCRIPTS_PATH="$PROJECT_ROOT_PATH/ProjectCode/scripts"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file" source "$framework_include_file"
done done
for project_include_file in ../Project-Includes/*; do for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file" source "$project_include_file"
done done
@@ -47,9 +55,6 @@ SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
export LOCALUSER_CHECK export LOCALUSER_CHECK
LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)" LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
export DL_ROOT
DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
####################### #######################
# Support functions # Support functions
####################### #######################
@@ -57,11 +62,9 @@ DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
function global-oam() { function global-oam() {
print_info "Now running $FUNCNAME...." print_info "Now running $FUNCNAME...."
cat ./scripts/up2date.sh >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh cat "$SCRIPTS_PATH/up2date.sh" >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh
cd Modules/OAM || exit bash "$MODULES_PATH/OAM/oam-librenms.sh"
bash ./oam-librenms.sh
cd - || exit
print_info "Completed running $FUNCNAME" print_info "Completed running $FUNCNAME"
@@ -70,9 +73,9 @@ function global-oam() {
function global-systemServiceConfigurationFiles() { function global-systemServiceConfigurationFiles() {
print_info "Now running $FUNCNAME...." print_info "Now running $FUNCNAME...."
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ZSH/tsys-zshrc >/etc/zshrc cat "$CONFIGFILES_PATH/ZSH/tsys-zshrc" >/etc/zshrc
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/aliases >/etc/aliases cat "$CONFIGFILES_PATH/SMTP/aliases" >/etc/aliases
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/Syslog/rsyslog.conf >/etc/rsyslog.conf cat "$CONFIGFILES_PATH/Syslog/rsyslog.conf" >/etc/rsyslog.conf
newaliases newaliases
@@ -235,7 +238,7 @@ function global-postPackageConfiguration() {
systemctl stop postfix systemctl stop postfix
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/postfix_generic >/etc/postfix/generic cat "$CONFIGFILES_PATH/SMTP/postfix_generic" >/etc/postfix/generic
postmap /etc/postfix/generic postmap /etc/postfix/generic
postconf -e "inet_protocols = ipv4" postconf -e "inet_protocols = ipv4"
@@ -262,33 +265,33 @@ function global-postPackageConfiguration() {
###Post package deployment bits ###Post package deployment bits
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/DHCP/dhclient.conf >/etc/dhcp/dhclient.conf cat "$CONFIGFILES_PATH/DHCP/dhclient.conf" >/etc/dhcp/dhclient.conf
systemctl stop snmpd && /etc/init.d/snmpd stop systemctl stop snmpd && /etc/init.d/snmpd stop
cat ./ConfigFiles/SNMP/snmp-sudo.conf >/etc/sudoers.d/Debian-snmp cat "$CONFIGFILES_PATH/SNMP/snmp-sudo.conf" >/etc/sudoers.d/Debian-snmp
sed -i "s|-Lsd|-LS6d|" /lib/systemd/system/snmpd.service sed -i "s|-Lsd|-LS6d|" /lib/systemd/system/snmpd.service
pi-detect pi-detect
if [ "$IS_RASPI" = 1 ]; then if [ "$IS_RASPI" = 1 ]; then
cat ./ConfigFiles/SNMP/snmpd-rpi.conf >/etc/snmp/snmpd.conf || true cat "$CONFIGFILES_PATH/SNMP/snmpd-rpi.conf" >/etc/snmp/snmpd.conf || true
fi fi
if [ "$IS_PHYSICAL_HOST" = 1 ]; then if [ "$IS_PHYSICAL_HOST" = 1 ]; then
cat ./ConfigFiles/SNMP/snmpd-physicalhost.conf >/etc/snmp/snmpd.conf || true cat "$CONFIGFILES_PATH/SNMP/snmpd-physicalhost.conf" >/etc/snmp/snmpd.conf || true
fi fi
if [ "$IS_VIRT_GUEST" = 1 ]; then if [ "$IS_VIRT_GUEST" = 1 ]; then
cat ./ConfigFiles/SNMP/snmpd.conf >/etc/snmp/snmpd.conf || true cat "$CONFIGFILES_PATH/SNMP/snmpd.conf" >/etc/snmp/snmpd.conf || true
fi fi
systemctl daemon-reload && systemctl restart snmpd && /etc/init.d/snmpd restart systemctl daemon-reload && systemctl restart snmpd && /etc/init.d/snmpd restart
cat ./ConfigFiles/NetworkDiscovery/lldpd >/etc/default/lldpd cat "$CONFIGFILES_PATH/NetworkDiscovery/lldpd" >/etc/default/lldpd
systemctl restart lldpd systemctl restart lldpd
cat ./ConfigFiles/Cockpit/disallowed-users >/etc/cockpit/disallowed-users cat "$CONFIGFILES_PATH/Cockpit/disallowed-users" >/etc/cockpit/disallowed-users
systemctl restart cockpit systemctl restart cockpit
export LIBRENMS_CHECK export LIBRENMS_CHECK
@@ -305,7 +308,7 @@ function global-postPackageConfiguration() {
if [ "$NTP_SERVER_CHECK" -eq 0 ]; then if [ "$NTP_SERVER_CHECK" -eq 0 ]; then
cat ./ConfigFiles/NTP/ntp.conf >/etc/ntpsec/ntp.conf cat "$CONFIGFILES_PATH/NTP/ntp.conf" >/etc/ntpsec/ntp.conf
systemctl restart ntpsec.service systemctl restart ntpsec.service
fi fi
@@ -346,42 +349,32 @@ function global-postPackageConfiguration() {
function secharden-ssh() { function secharden-ssh() {
print_info "Now running $FUNCNAME" print_info "Now running $FUNCNAME"
cd ./Modules/Security || exit bash "$MODULES_PATH/Security/secharden-ssh.sh"
bash ./secharden-ssh.sh
cd -
print_info "Completed running $FUNCNAME" print_info "Completed running $FUNCNAME"
} }
function secharden-wazuh() { function secharden-wazuh() {
print_info "Now running $FUNCNAME" print_info "Now running $FUNCNAME"
cd ./Modules/Security || exit bash "$MODULES_PATH/Security/secharden-wazuh.sh"
bash ./secharden-wazuh.sh
cd -
print_info "Completed running $FUNCNAME" print_info "Completed running $FUNCNAME"
} }
function secharden-2fa() { function secharden-2fa() {
print_info "Now running $FUNCNAME" print_info "Now running $FUNCNAME"
cd ./Modules/Security || exit bash "$MODULES_PATH/Security/secharden-2fa.sh"
bash ./secharden-2fa.sh
cd -
print_info "Completed running $FUNCNAME" print_info "Completed running $FUNCNAME"
} }
function secharden-scap-stig() { function secharden-scap-stig() {
print_info "Now running $FUNCNAME" print_info "Now running $FUNCNAME"
cd ./Modules/Security || exit bash "$MODULES_PATH/Security/secharden-scap-stig.sh"
bash ./secharden-scap-stig.sh
cd -
print_info "Completed running $FUNCNAME" print_info "Completed running $FUNCNAME"
} }
function secharden-agents() { function secharden-agents() {
print_info "Now running $FUNCNAME" print_info "Now running $FUNCNAME"
cd ./Modules/Security || exit bash "$MODULES_PATH/Security/secharden-audit-agents.sh"
bash ./secharden-audit-agents.sh
cd -
print_info "Completed running $FUNCNAME" print_info "Completed running $FUNCNAME"
} }