chore(archive): preserve KNELServerBuild remainder + layout notes [#474]

Archive the non-ported remainder of the legacy KNELServerBuild repo under archive/KNELServerBuild/ with its original structure intact, completing the legacy repo merge for everything except the live LibreNMS patterns (ported in the previous commit). Exclusions: - .git history (superseded; legacy repo remains at its original path) - ported files (Agents/librenms, Modules/OAM/oam-librenms.sh, ConfigFiles/SNMP/snmp-sudo.conf) - vendored KNELShellFramework tree (byte-identical duplicate of the copy already vendored at vendor/ in this repo) - SSH authorized-keys files (live access-control material; carrying them in an archive invites drift — key policy lives elsewhere) The whole tree is skip-listed in tests/shellcheck.sh (archived legacy code, not maintained — same standing as vendor/); check-rules.sh already prunes archive/. Rule 9 (conflict markers) now also excludes archive/ staged files: preserved-verbatim legacy scripts contain decorative "====" banners that false-positive as conflict markers (same archive exclusion precedent as rule 11). AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the Repository Layout, and fix the stale KNELIAC path to /home/reachableceo/projects/KNEL/KNELIAC. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-08-28 06:12:05 -05:00
parent 75de9d7104
commit 39bb855a98
89 changed files with 8589 additions and 3 deletions
@@ -0,0 +1,46 @@
+#
+# Known Element Enterprises Customized Config File
+# auditd
+# Initial version 2025-06-27 
+#
+
+local_events = yes
+write_logs = yes
+log_file = /var/log/audit/audit.log
+log_group = adm
+log_format = ENRICHED
+flush = INCREMENTAL_ASYNC
+freq = 50
+max_log_file = 8
+num_logs = 5
+priority_boost = 4
+name_format = NONE
+max_log_file_action = keep_logs
+space_left = 75
+space_left_action = email
+action_mail_acct = root
+
+admin_space_left_action = halt
+disk_full_action = SUSPEND
+disk_error_action = SUSPEND
+admin_space_left = 50
+
+verify_email = yes
+use_libwrap = yes
+tcp_listen_queue = 5
+tcp_max_per_addr = 1
+tcp_client_max_idle = 0
+transport = TCP
+distribute_network = no
+q_depth = 2000
+overflow_action = SYSLOG
+max_restarts = 10
+plugin_dir = /etc/audit/plugins.d
+end_of_event_timeout = 2
+##tcp_client_ports = 1024-65535
+##tcp_listen_port = 60
+
+##krb5_key_file = /etc/audit/audit.key
+krb5_principal = auditd
+
+##name = mydomain
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
@@ -0,0 +1,2 @@
+#/etc/cockpit/disallowed-users
+# List of users which are not allowed to login to Cockpit
@@ -0,0 +1,14 @@
+option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
+
+send host-name = gethostname();
+request subnet-mask, broadcast-address, time-offset, routers,
+        domain-name, host-name,
+        domain-name-servers, domain-search, ntp-servers,
+        rfc3442-classless-static-routes;
+
+# Pin DNS and NTP to the redundant pfv-netinfra-01/02 pair regardless of what
+# the DHCP server advertises, so every host on this build uses the same
+# authoritative recursive resolvers and time sources.
+supersede domain-name-servers 192.168.3.252, 192.168.3.253;
+supersede domain-search "knel.net";
+supersede ntp-servers 192.168.3.252, 192.168.3.253;
@@ -0,0 +1,23 @@
+# see "man logrotate" for details
+
+# global options do not affect preceding include directives
+
+# rotate log files weekly
+weekly
+
+# keep 4 weeks worth of backlogs
+rotate 4
+
+# create new (empty) log files after rotating old ones
+create 0640 root utmp
+
+# use date as a suffix of the rotated file
+#dateext
+
+# uncomment this if you want your log files compressed
+#compress
+
+# packages drop log rotation information into this directory
+include /etc/logrotate.d
+
+# system-specific logs may also be configured here.
@@ -0,0 +1 @@
+install cramfs /bin/true
@@ -0,0 +1 @@
+install dccp /bin/true
@@ -0,0 +1 @@
+install freevxfs /bin/true
@@ -0,0 +1 @@
+install hfs /bin/true
@@ -0,0 +1 @@
+install hfsplus /bin/true
@@ -0,0 +1 @@
+install jffs2 /bin/true
@@ -0,0 +1 @@
+install rds /bin/true
@@ -0,0 +1 @@
+install sctp /bin/true
@@ -0,0 +1 @@
+install squashfs /bin/true
@@ -0,0 +1 @@
+install tipc /bin/true
@@ -0,0 +1 @@
+install udf /bin/true
@@ -0,0 +1 @@
+install usb-storage /bin/true
@@ -0,0 +1,21 @@
+driftfile /var/lib/ntp/ntp.drift
+leapfile /usr/share/zoneinfo/leap-seconds.list
+
+# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
+# also serving NTP). IPs are used (not hostnames) because the knel.net name for
+# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
+# because NTP must come up before DNS is available. iburst speeds initial sync.
+server 192.168.3.252 iburst
+server 192.168.3.253 iburst
+
+# Hardened client: sync from the configured servers but never serve time to
+# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
+# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
+# address that upstream servers cannot reply to (symptoms: peers stuck in
+# .INIT. with reach 0). Use restrict rules to control access instead.
+restrict default ignore
+restrict 127.0.0.1
+restrict ::1
+restrict 192.168.3.252 nomodify notrap nopeer
+restrict 192.168.3.253 nomodify notrap nopeer
+
@@ -0,0 +1,2 @@
+# Uncomment to start SNMP subagent and enable CDP, SONMP and EDP protocol
+DAEMON_ARGS="-x -c -s -e"
@@ -0,0 +1,11 @@
+# Managed by KNELServerBuild — do not edit; changes will be overwritten.
+#
+# Redundant recursive DNS via pfv-netinfra-01/02 (Technitium + Pi-hole).
+# IPs are used (required: nameserver directives must be addresses, and the
+# knel.net name for these hosts resolves to a Tailscale CGNAT address rather
+# than the LAN address). If the primary is unreachable, glibc's resolver
+# automatically falls through to the secondary.
+domain knel.net
+search knel.net
+nameserver 192.168.3.252
+nameserver 192.168.3.253
@@ -0,0 +1,3 @@
+# See man 5 aliases for format
+postmaster:    root
+root: coo@turnsys.com
@@ -0,0 +1 @@
+/.*/    tsysrootaccount@knel.net
@@ -0,0 +1,46 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation R4, Server Room, SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
+
+#SMTP
+extend mailq /usr/lib/check_mk_agent/local/postfix-queues
+extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
+
+#Hardware Detection
+extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
+extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
+
+#SMART
+extend smart /usr/lib/check_mk_agent/local/smart
+
+#Temperature
+pass_persist    .1.3.6.1.4.1.9.9.13.1.3 /usr/local/bin/temper-snmp
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1
+
+# LLDP collection
+master agentx
@@ -0,0 +1,40 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
+
+#SMTP
+extend mailq /usr/lib/check_mk_agent/local/postfix-queues
+extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
+
+
+#Hardware Detection
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/model 
+extend serial /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/serial-number
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1
+
+# LLDP collection
+master agentx
@@ -0,0 +1,44 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation R4, Server Room, SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
+
+#SMTP
+extend mailq /usr/lib/check_mk_agent/local/postfix-queues
+extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
+
+# Socket statistics
+extend ss /usr/lib/check_mk_agent/local/ss.py
+
+#Hardware Detection
+# (uncomment for x86 platforms)
+extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
+extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1
+
+# LLDP collection
+master agentx
@@ -0,0 +1,19 @@
+# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com
+# hardening guide.
+KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
+
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-gcm@openssh.com,aes128-ctr
+
+MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
+
+HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
+
+RequiredRSASize 3072
+
+CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
+
+GSSAPIKexAlgorithms gss-curve25519-sha256-,gss-group16-sha512-
+
+HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
+
+PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
@@ -0,0 +1,20 @@
+Include /etc/ssh/sshd_config.d/*.conf
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+KbdInteractiveAuthentication no
+PrintMotd no
+PasswordAuthentication no
+AllowTcpForwarding no
+X11Forwarding no
+ChallengeResponseAuthentication no
+AcceptEnv LANG LC_*
+Subsystem       sftp    /usr/lib/openssh/sftp-server
+UsePAM yes
+Banner /etc/issue.net
+MaxAuthTries 2
+MaxStartups 10:30:100
+PermitRootLogin prohibit-password
+ClientAliveInterval 300
+ClientAliveCountMax 3
+AllowUsers root localuser subodev
+LoginGraceTime 60
@@ -0,0 +1,6 @@
+module(load="imuxsock") # provides support for local system logging
+module(load="imklog")   # provides kernel logging support
+#module(load="immark")  # provides --MARK-- message capability
+
+*.* @tsys-librenms.knel.net:514
+:omusrmsg:EOF
@@ -0,0 +1,31 @@
+[Journal]
+#Compress=yes
+#Seal=yes
+#SplitMode=uid
+#SyncIntervalSec=5m
+#RateLimitIntervalSec=30s
+#RateLimitBurst=10000
+#SystemMaxUse=
+#SystemKeepFree=
+#SystemMaxFileSize=
+#SystemMaxFiles=100
+#RuntimeMaxUse=
+#RuntimeKeepFree=
+#RuntimeMaxFileSize=
+#RuntimeMaxFiles=100
+#MaxRetentionSec=
+#MaxFileSec=1month
+#ForwardToSyslog=yes
+#ForwardToKMsg=no
+#ForwardToConsole=no
+#ForwardToWall=yes
+#TTYPath=/dev/console
+#MaxLevelStore=debug
+#MaxLevelSyslog=debug
+#MaxLevelKMsg=notice
+#MaxLevelConsole=info
+#MaxLevelWall=emerg
+#LineMax=48K
+#ReadKMsg=yes
+#Audit=no
+Storage=persistent
@@ -0,0 +1,258 @@
+# ~/.zshrc file for zsh interactive shells.
+# see /usr/share/doc/zsh/examples/zshrc for examples
+
+setopt autocd              # change directory just by typing its name
+#setopt correct            # auto correct mistakes
+setopt interactivecomments # allow comments in interactive mode
+setopt magicequalsubst     # enable filename expansion for arguments of the form ‘anything=expression’
+setopt nonomatch           # hide error message if there is no match for the pattern
+setopt notify              # report the status of background jobs immediately
+setopt numericglobsort     # sort filenames numerically when it makes sense
+setopt promptsubst         # enable command substitution in prompt
+
+WORDCHARS=${WORDCHARS//\/} # Don't consider certain characters part of the word
+
+# hide EOL sign ('%')
+PROMPT_EOL_MARK=""
+
+# configure key keybindings
+bindkey -v                                        # emacs key bindings
+bindkey ' ' magic-space                           # do history expansion on space
+bindkey '^U' backward-kill-line                   # ctrl + U
+bindkey '^[[3;5~' kill-word                       # ctrl + Supr
+bindkey '^[[3~' delete-char                       # delete
+bindkey '^[[1;5C' forward-word                    # ctrl + ->
+bindkey '^[[1;5D' backward-word                   # ctrl + <-
+bindkey '^[[5~' beginning-of-buffer-or-history    # page up
+bindkey '^[[6~' end-of-buffer-or-history          # page down
+bindkey '^[[H' beginning-of-line                  # home
+bindkey '^[[F' end-of-line                        # end
+bindkey '^[[Z' undo                               # shift + tab undo last action
+
+# enable completion features
+autoload -Uz compinit
+compinit -d ~/.cache/zcompdump
+zstyle ':completion:*:*:*:*:*' menu select
+zstyle ':completion:*' auto-description 'specify: %d'
+zstyle ':completion:*' completer _expand _complete
+zstyle ':completion:*' format 'Completing %d'
+zstyle ':completion:*' group-name ''
+zstyle ':completion:*' list-colors ''
+zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s
+zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}'
+zstyle ':completion:*' rehash true
+zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s
+zstyle ':completion:*' use-compctl false
+zstyle ':completion:*' verbose true
+zstyle ':completion:*:kill:*' command 'ps -u $USER -o pid,%cpu,tty,cputime,cmd'
+
+# History configurations
+HISTFILE=~/.zsh_history
+HISTSIZE=10000
+SAVEHIST=200000
+setopt hist_expire_dups_first # delete duplicates first when HISTFILE size exceeds HISTSIZE
+setopt hist_ignore_dups       # ignore duplicated commands history list
+setopt hist_ignore_space      # ignore commands that start with space
+setopt hist_verify            # show command with history expansion to user before running it
+#setopt share_history         # share command history data
+
+# force zsh to show the complete history
+alias history="history 0"
+
+# configure `time` format
+TIMEFMT=$'\nreal\t%E\nuser\t%U\nsys\t%S\ncpu\t%P'
+
+# make less more friendly for non-text input files, see lesspipe(1)
+#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
+
+# set variable identifying the chroot you work in (used in the prompt below)
+if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
+    debian_chroot=$(cat /etc/debian_chroot)
+fi
+
+# set a fancy prompt (non-color, unless we know we "want" color)
+case "$TERM" in
+    xterm-color|*-256color) color_prompt=yes;;
+esac
+
+# uncomment for a colored prompt, if the terminal has the capability; turned
+# off by default to not distract the user: the focus in a terminal window
+# should be on the output of commands, not on the prompt
+force_color_prompt=yes
+
+if [ -n "$force_color_prompt" ]; then
+    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
+        # We have color support; assume it's compliant with Ecma-48
+        # (ISO/IEC-6429). (Lack of such support is extremely rare, and such
+        # a case would tend to support setf rather than setaf.)
+        color_prompt=yes
+    else
+        color_prompt=
+    fi
+fi
+
+configure_prompt() {
+    prompt_symbol=㉿
+    # Skull emoji for root terminal
+    #[ "$EUID" -eq 0 ] && prompt_symbol=💀
+    case "$PROMPT_ALTERNATIVE" in
+        twoline)
+            PROMPT=$'%F{%(#.blue.green)}┌──${debian_chroot:+($debian_chroot)─}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))─}(%B%F{%(#.red.blue)}%n'$prompt_symbol$'%m%b%F{%(#.blue.green)})-[%B%F{reset}%(6~.%-1~/…/%4~.%5~)%b%F{%(#.blue.green)}]\n└─%B%(#.%F{red}#.%F{blue}$)%b%F{reset} '
+            # Right-side prompt with exit codes and background processes
+            #RPROMPT=$'%(?.. %? %F{red}%B⨯%b%F{reset})%(1j. %j %F{yellow}%B⚙%b%F{reset}.)'
+            ;;
+        oneline)
+            PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{%(#.red.blue)}%n@%m%b%F{reset}:%B%F{%(#.blue.green)}%~%b%F{reset}%(#.#.$) '
+            RPROMPT=
+            ;;
+        backtrack)
+            PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{red}%n@%m%b%F{reset}:%B%F{blue}%~%b%F{reset}%(#.#.$) '
+            RPROMPT=
+            ;;
+    esac
+    unset prompt_symbol
+}
+
+# The following block is surrounded by two delimiters.
+# These delimiters must not be modified. Thanks.
+# START KALI CONFIG VARIABLES
+PROMPT_ALTERNATIVE=twoline
+NEWLINE_BEFORE_PROMPT=yes
+# STOP KALI CONFIG VARIABLES
+
+if [ "$color_prompt" = yes ]; then
+    # override default virtualenv indicator in prompt
+    VIRTUAL_ENV_DISABLE_PROMPT=1
+
+    configure_prompt
+
+    # enable syntax-highlighting
+    if [ -f /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]; then
+        . /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+        ZSH_HIGHLIGHT_HIGHLIGHTERS=(main brackets pattern)
+        ZSH_HIGHLIGHT_STYLES[default]=none
+        ZSH_HIGHLIGHT_STYLES[unknown-token]=underline
+        ZSH_HIGHLIGHT_STYLES[reserved-word]=fg=cyan,bold
+        ZSH_HIGHLIGHT_STYLES[suffix-alias]=fg=green,underline
+        ZSH_HIGHLIGHT_STYLES[global-alias]=fg=green,bold
+        ZSH_HIGHLIGHT_STYLES[precommand]=fg=green,underline
+        ZSH_HIGHLIGHT_STYLES[commandseparator]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[autodirectory]=fg=green,underline
+        ZSH_HIGHLIGHT_STYLES[path]=bold
+        ZSH_HIGHLIGHT_STYLES[path_pathseparator]=
+        ZSH_HIGHLIGHT_STYLES[path_prefix_pathseparator]=
+        ZSH_HIGHLIGHT_STYLES[globbing]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[history-expansion]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[command-substitution]=none
+        ZSH_HIGHLIGHT_STYLES[command-substitution-delimiter]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[process-substitution]=none
+        ZSH_HIGHLIGHT_STYLES[process-substitution-delimiter]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[single-hyphen-option]=fg=green
+        ZSH_HIGHLIGHT_STYLES[double-hyphen-option]=fg=green
+        ZSH_HIGHLIGHT_STYLES[back-quoted-argument]=none
+        ZSH_HIGHLIGHT_STYLES[back-quoted-argument-delimiter]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[single-quoted-argument]=fg=yellow
+        ZSH_HIGHLIGHT_STYLES[double-quoted-argument]=fg=yellow
+        ZSH_HIGHLIGHT_STYLES[dollar-quoted-argument]=fg=yellow
+        ZSH_HIGHLIGHT_STYLES[rc-quote]=fg=magenta
+        ZSH_HIGHLIGHT_STYLES[dollar-double-quoted-argument]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[back-double-quoted-argument]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[back-dollar-quoted-argument]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[assign]=none
+        ZSH_HIGHLIGHT_STYLES[redirection]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[comment]=fg=black,bold
+        ZSH_HIGHLIGHT_STYLES[named-fd]=none
+        ZSH_HIGHLIGHT_STYLES[numeric-fd]=none
+        ZSH_HIGHLIGHT_STYLES[arg0]=fg=cyan
+        ZSH_HIGHLIGHT_STYLES[bracket-error]=fg=red,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-1]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-2]=fg=green,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-3]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-4]=fg=yellow,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-5]=fg=cyan,bold
+        ZSH_HIGHLIGHT_STYLES[cursor-matchingbracket]=standout
+    fi
+else
+    PROMPT='${debian_chroot:+($debian_chroot)}%n@%m:%~%(#.#.$) '
+fi
+unset color_prompt force_color_prompt
+
+toggle_oneline_prompt(){
+    if [ "$PROMPT_ALTERNATIVE" = oneline ]; then
+        PROMPT_ALTERNATIVE=twoline
+    else
+        PROMPT_ALTERNATIVE=oneline
+    fi
+    configure_prompt
+    zle reset-prompt
+}
+zle -N toggle_oneline_prompt
+bindkey ^P toggle_oneline_prompt
+
+# If this is an xterm set the title to user@host:dir
+case "$TERM" in
+xterm*|rxvt*|Eterm|aterm|kterm|gnome*|alacritty)
+    TERM_TITLE=$'\e]0;${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%n@%m: %~\a'
+    ;;
+*)
+    ;;
+esac
+
+precmd() {
+    # Print the previously configured title
+    print -Pnr -- "$TERM_TITLE"
+
+    # Print a new line before the prompt, but only if it is not the first line
+    if [ "$NEWLINE_BEFORE_PROMPT" = yes ]; then
+        if [ -z "$_NEW_LINE_BEFORE_PROMPT" ]; then
+            _NEW_LINE_BEFORE_PROMPT=1
+        else
+            print ""
+        fi
+    fi
+}
+
+# enable color support of ls, less and man, and also add handy aliases
+if [ -x /usr/bin/dircolors ]; then
+    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
+    export LS_COLORS="$LS_COLORS:ow=30;44:" # fix ls color for folders with 777 permissions
+
+    alias ls='ls --color=auto'
+    #alias dir='dir --color=auto'
+    #alias vdir='vdir --color=auto'
+
+    alias grep='grep --color=auto'
+    alias fgrep='fgrep --color=auto'
+    alias egrep='egrep --color=auto'
+    alias diff='diff --color=auto'
+    alias ip='ip --color=auto'
+
+    export LESS_TERMCAP_mb=$'\E[1;31m'     # begin blink
+    export LESS_TERMCAP_md=$'\E[1;36m'     # begin bold
+    export LESS_TERMCAP_me=$'\E[0m'        # reset bold/blink
+    export LESS_TERMCAP_so=$'\E[01;33m'    # begin reverse video
+    export LESS_TERMCAP_se=$'\E[0m'        # reset reverse video
+    export LESS_TERMCAP_us=$'\E[1;32m'     # begin underline
+    export LESS_TERMCAP_ue=$'\E[0m'        # reset underline
+
+    # Take advantage of $LS_COLORS for completion as well
+    zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
+    zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#)*=0=01;31'
+fi
+
+# some more ls aliases
+alias ll='ls -l'
+alias la='ls -A'
+alias l='ls -CF'
+
+# enable auto-suggestions based on the history
+if [ -f /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]; then
+    . /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh
+    # change suggestion color
+    ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=#999'
+fi
+
+# enable command-not-found if installed
+if [ -f /etc/zsh_command_not_found ]; then
+    . /etc/zsh_command_not_found
+fi
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+
+
+#magic to detect main int
+echo "Determining management interface..."
+#export MAIN_INT=$(brctl show $(netstat -rn|grep 0.0.0.0|head -n1|awk '{print $NF}') | awk '{print $NF}'|tail -1|awk -F '.' '{print $1}')
+export MAIN_INT=$(brctl show|grep vmbr0|awk '{print $NF}'|awk -F '.' '{print $1}')
+
+echo "Management interface is: $MAIN_INT"
+
+#fix the issue
+echo "Fixing management interface..."
+ethtool -K $MAIN_INT tso off 
+ethtool -K $MAIN_INT gro off 
+ethtool -K $MAIN_INT gso off
+ethtool -K $MAIN_INT tx off
+ethtool -K $MAIN_INT rx off
+
+#https://forum.proxmox.com/threads/e1000-driver-hang.58284/
+#https://serverfault.com/questions/616485/e1000e-reset-adapter-unexpectedly-detected-hardware-unit-hang
+
+
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+#curl -s http://dl.turnsys.net/omsa.sh|/bin/bash
+
+gpg --keyserver hkp://pool.sks-keyservers.net:80 --recv-key 1285491434D8786F
+gpg -a --export 1285491434D8786F | apt-key add -
+echo "deb https://linux.dell.com/repo/community/openmanage/930/bionic bionic main" > /etc/apt/sources.list.d/linux.dell.com.sources.list
+wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman-curl-client-transport1_2.6.5-0ubuntu3_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman-client4_2.6.5-0ubuntu3_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman1_2.6.5-0ubuntu3_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman-server1_2.6.5-0ubuntu3_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/s/sblim-sfcc/libcimcclient0_2.2.8-0ubuntu2_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/openwsman_2.6.5-0ubuntu3_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/multiverse/c/cim-schema/cim-schema_2.48.0-0ubuntu1_all.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/s/sblim-sfc-common/libsfcutil0_1.0.1-0ubuntu4_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/multiverse/s/sblim-sfcb/sfcb_1.4.9-0ubuntu5_amd64.deb
+wget https://archive.ubuntu.com/ubuntu/pool/universe/s/sblim-cmpi-devel/libcmpicppimpl0_2.0.3-0ubuntu2_amd64.deb
+dpkg -i libwsman-curl-client-transport1_2.6.5-0ubuntu3_amd64.deb
+dpkg -i libwsman-client4_2.6.5-0ubuntu3_amd64.deb
+dpkg -i libwsman1_2.6.5-0ubuntu3_amd64.deb
+dpkg -i libwsman-server1_2.6.5-0ubuntu3_amd64.deb
+dpkg -i libcimcclient0_2.2.8-0ubuntu2_amd64.deb
+dpkg -i openwsman_2.6.5-0ubuntu3_amd64.deb
+dpkg -i cim-schema_2.48.0-0ubuntu1_all.deb
+dpkg -i libsfcutil0_1.0.1-0ubuntu4_amd64.deb
+dpkg -i sfcb_1.4.9-0ubuntu5_amd64.deb
+dpkg -i libcmpicppimpl0_2.0.3-0ubuntu2_amd64.deb
+
+apt update
+apt -y install srvadmin-all
+touch /opt/dell/srvadmin/lib64/openmanage/IGNORE_GENERATION
+
+#logout,login, then run
+# srvadmin-services.sh enable && srvadmin-services.sh start
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+#Script to set performance.
+
+
+
+cpufreq-set -r -g performance
+cpupower frequency-set --governor performance
+
+
@@ -0,0 +1,81 @@
+#!/bin/bash
+
+#Made from instructions at https://www.tunetheweb.com/performance/http2/
+
+OPENSSL_URL_BASE="https://www.openssl.org/source/"
+OPENSSL_FILE="openssl-1.1.0h.tar.gz"
+
+NGHTTP_URL_BASE="https://github.com/nghttp2/nghttp2/releases/download/v1.31.0/"
+NGHTTP_FILE="nghttp2-1.31.0.tar.gz"
+
+APR_URL_BASE="https://archive.apache.org/dist/apr/"
+APR_FILE="apr-1.6.3.tar.gz"
+
+APR_UTIL_URL_BASE="https://archive.apache.org/dist/apr/"
+APR_UTIL_FILE="apr-util-1.6.1.tar.gz"
+
+APACHE_URL_BASE="https://archive.apache.org/dist/httpd/"
+APACHE_FILE="httpd-2.4.33.tar.gz"
+
+CURL_URL_BASE="https://curl.haxx.se/download/"
+CURL_FILE="curl-7.60.0.tar.gz"
+
+
+#Download and install latest version of openssl
+wget $OPENSSL_URL_BASE/$OPENSSL_FILE
+tar xzf $OPENSSL_FILE
+cd openssl-1.1.0h 
+./config enable-weak-ssl-ciphers shared zlib-dynamic -DOPENSSL_TLS_SECURITY_LEVEL=0 --prefix=/usr/local/custom-ssl/openssl-1.1.0h ; make ; make install
+ln -s /usr/local/custom-ssl/openssl-1.1.0h /usr/local/openssl
+cd -
+
+#Download and install nghttp2 (needed for mod_http2).
+wget $NGHTTP_URL_BASE/$NGHTTP_FILE
+tar xzf $NGHTTP_FILE
+cd nghttp2-1.31.0 
+./configure --prefix=/usr/local/custom-ssl/nghttp ; make ; make install
+cd -
+
+#Updated ldconfig so curl build
+
+cat <<custom-ssl > /etc/ld.so.conf.d/custom-ssl.conf
+/usr/local/custom-ssl/openssl-1.1.0h/lib
+/usr/local/custom-ssl/nghttp/lib
+custom-ssl
+
+ldconfig
+
+#Download and install curl
+wget $CURL_URL_BASE/$CURL_FILE
+tar xzf curl-7.60.0.tar.gz
+cd curl-7.60.0
+./configure --prefix=/usr/local/custom-ssl/curl --with-nghttp2=/usr/local/custom-ssl/nghttp/ --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ ; make ; make install
+cd -
+
+
+#Download and install latest apr
+wget $APR_URL_BASE/$APR_FILE
+tar xzf $APR_FILE
+cd apr-1.6.3 
+./configure --prefix=/usr/local/custom-ssl/apr ; make ; make install
+cd -
+
+#Download and install latest apr-util
+wget $APR_UTIL_URL_BASE/$APR_UTIL_FILE
+tar xzf apr-util-1.6.1.tar.gz
+cd apr-util-1.6.1 
+./configure --prefix=/usr/local/custom-ssl/apr-util --with-apr=/usr/local/custom-ssl/apr ; make; make install
+cd -
+
+#Download and install apache
+wget $APACHE_URL_BASE/$APACHE_FILE
+tar xzf httpd-2.4.33.tar.gz
+cd httpd-2.4.33
+cp -r ../apr-1.6.3 srclib/apr
+cp -r ../apr-util-1.6.1 srclib/apr-util
+./configure --prefix=/usr/local/custom-ssl/apache  --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ --with-pcre=/usr/bin/pcre-config --enable-unique-id --enable-ssl --enable-so --with-included-apr --enable-http2 --with-nghttp2=/usr/local/custom-ssl/nghttp/
+make
+make install
+ln -s /usr/local/custom-ssl/apache /usr/local/apache
+cd -
+
@@ -0,0 +1,426 @@
+#!/bin/bash
+
+# TSYS Security Hardening - Two-Factor Authentication
+# Implements 2FA for SSH, Cockpit, and Webmin services
+# Uses Google Authenticator (TOTP) for time-based tokens
+
+
+#####
+#Core framework functions...
+#####
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+  source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+  source "$project_include_file"
+done
+
+# 2FA Configuration
+BACKUP_DIR="/root/backup/2fa"
+PAM_CONFIG_DIR="/etc/pam.d"
+SSH_CONFIG="/etc/ssh/sshd_config"
+COCKPIT_CONFIG="/etc/cockpit/cockpit.conf"
+
+# Create backup directory
+mkdir -p "$BACKUP_DIR"
+
+print_info "TSYS Two-Factor Authentication Setup"
+
+# Backup existing configurations
+function backup_configs() {
+    print_info "Creating backup of existing configurations..."
+    
+    # Backup SSH configuration
+    if [[ -f "$SSH_CONFIG" ]]; then
+        cp "$SSH_CONFIG" "$BACKUP_DIR/sshd_config.bak"
+        print_info "SSH config backed up"
+    fi
+    
+    # Backup PAM configurations
+    if [[ -d "$PAM_CONFIG_DIR" ]]; then
+        cp -r "$PAM_CONFIG_DIR" "$BACKUP_DIR/pam.d.bak"
+        print_info "PAM configs backed up"
+    fi
+    
+    # Backup Cockpit configuration if exists
+    if [[ -f "$COCKPIT_CONFIG" ]]; then
+        cp "$COCKPIT_CONFIG" "$BACKUP_DIR/cockpit.conf.bak"
+        print_info "Cockpit config backed up"
+    fi
+    
+    print_info "Backup completed: $BACKUP_DIR"
+}
+
+# Install required packages
+function install_2fa_packages() {
+    print_info "Installing 2FA packages..."
+    
+    # Update package cache
+    apt-get update
+    
+    # Install Google Authenticator PAM module
+    # Install QR code generator for terminal display
+    apt-get install -y libpam-google-authenticator qrencode
+    
+    print_info "2FA packages installed successfully"
+}
+
+# Configure SSH for 2FA
+function configure_ssh_2fa() {
+    print_info "Configuring SSH for 2FA..."
+    
+    # Configure SSH daemon
+    print_info "Updating SSH configuration..."
+    
+    # Enable challenge-response authentication
+    if ! grep -q "^ChallengeResponseAuthentication yes" "$SSH_CONFIG"; then
+        sed -i 's/^ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' "$SSH_CONFIG" || \
+        echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG"
+    fi
+
+    if ! grep -q "^KbdInteractiveAuthentication yes" "$SSH_CONFIG"; then
+        sed -i 's/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' "$SSH_CONFIG" || \
+        echo "KbdInteractiveAuthentication yes" >> "$SSH_CONFIG"
+    fi
+    
+    # Enable PAM authentication
+    if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then
+        sed -i 's/^UsePAM.*/UsePAM yes/' "$SSH_CONFIG" || \
+        echo "UsePAM yes" >> "$SSH_CONFIG"
+    fi
+    
+    # Configure authentication methods (key + 2FA)
+    if ! grep -q "^AuthenticationMethods" "$SSH_CONFIG"; then
+        echo "AuthenticationMethods publickey,keyboard-interactive" >> "$SSH_CONFIG"
+    else
+        sed -i 's/^AuthenticationMethods.*/AuthenticationMethods publickey,keyboard-interactive/' "$SSH_CONFIG"
+    fi
+    
+    print_info "SSH configuration updated"
+}
+
+# Configure PAM for 2FA
+function configure_pam_2fa() {
+    print_info "Configuring PAM for 2FA..."
+    
+    # Create backup of original PAM SSH config
+    cp "$PAM_CONFIG_DIR/sshd" "$PAM_CONFIG_DIR/sshd.bak.$(date +%Y%m%d)"
+    
+    # Configure PAM to use Google Authenticator
+    cat > "$PAM_CONFIG_DIR/sshd" << 'EOF'
+# PAM configuration for SSH with 2FA
+# Standard Un*x authentication
+@include common-auth
+
+# Google Authenticator 2FA
+auth required pam_google_authenticator.so nullok
+
+# Standard Un*x authorization
+@include common-account
+
+# SELinux needs to be the first session rule
+session required pam_selinux.so close
+session required pam_loginuid.so
+
+# Standard Un*x session setup and teardown
+@include common-session
+
+# Print the message of the day upon successful login
+session optional pam_motd.so motd=/run/motd.dynamic
+session optional pam_motd.so noupdate
+
+# Print the status of the user's mailbox upon successful login
+session optional pam_mail.so standard noenv
+
+# Set up user limits from /etc/security/limits.conf
+session required pam_limits.so
+
+# SELinux needs to intervene at login time
+session required pam_selinux.so open
+
+# Standard Un*x password updating
+@include common-password
+EOF
+    
+    print_info "PAM configuration updated for SSH 2FA"
+}
+
+# Configure Cockpit for 2FA
+function configure_cockpit_2fa() {
+    print_info "Configuring Cockpit for 2FA..."
+    
+    # Create Cockpit config directory if it doesn't exist
+    mkdir -p "$(dirname "$COCKPIT_CONFIG")"
+    
+    # Configure Cockpit to use PAM with 2FA
+    cat > "$COCKPIT_CONFIG" << 'EOF'
+[WebService]
+# Enable 2FA for Cockpit web interface
+LoginTitle = TSYS Server Management
+LoginTo = 300
+RequireHost = true
+
+[Session]
+# Use PAM for authentication (includes 2FA)
+Banner = /etc/cockpit/issue.cockpit
+IdleTimeout = 15
+EOF
+    
+    # Create PAM configuration for Cockpit
+    cat > "$PAM_CONFIG_DIR/cockpit" << 'EOF'
+# PAM configuration for Cockpit with 2FA
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth required pam_faillock.so preauth
+auth sufficient pam_unix.so try_first_pass
+auth required pam_google_authenticator.so nullok
+auth required pam_faillock.so authfail
+auth required pam_deny.so
+
+account required pam_nologin.so
+account include system-auth
+account required pam_faillock.so
+
+session required pam_selinux.so close
+session required pam_loginuid.so
+session optional pam_keyinit.so force revoke
+session include system-auth
+session required pam_selinux.so open
+session optional pam_motd.so
+EOF
+    
+    print_info "Cockpit 2FA configuration completed"
+}
+
+# Configure Webmin for 2FA (if installed)
+function configure_webmin_2fa() {
+    print_info "Checking for Webmin installation..."
+    
+    local webmin_config="/etc/webmin/miniserv.conf"
+    
+    if [[ -f "$webmin_config" ]]; then
+        print_info "Webmin found, configuring 2FA..."
+        
+        # Stop webmin service
+        systemctl stop webmin || true
+        
+        # Enable 2FA in Webmin configuration. `sed -i ... || echo` would never
+        # append, because sed returns 0 even when it matches nothing; guard with
+        # grep so the directive is added when absent and updated when present.
+        if grep -q '^twofactor_provider=' "$webmin_config"; then
+            sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config"
+        else
+            echo "twofactor_provider=totp" >> "$webmin_config"
+        fi
+
+        # Enable 2FA requirement
+        if grep -q '^twofactor=' "$webmin_config"; then
+            sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config"
+        else
+            echo "twofactor=1" >> "$webmin_config"
+        fi
+        
+        # Start webmin service
+        systemctl start webmin || true
+        
+        print_info "Webmin 2FA configuration completed"
+    else
+        print_info "Webmin not found, skipping configuration"
+    fi
+}
+
+# Setup 2FA for users
+function setup_user_2fa() {
+    print_info "Setting up 2FA for system users..."
+    
+    local users=("localuser" "root")
+    
+    for user in "${users[@]}"; do
+        if id "$user" &>/dev/null; then
+            print_info "Setting up 2FA for user: $user"
+
+            local user_home
+            user_home="$(getent passwd "$user" | cut -d: -f6)"
+            if [[ -z "$user_home" ]]; then
+                print_info "No home directory for $user, skipping"
+                continue
+            fi
+
+            # Create 2FA setup script for user
+            cat > "/tmp/setup-2fa-$user.sh" << 'EOF'
+#!/bin/bash
+echo "Setting up Google Authenticator for user: $USER"
+echo "Please follow the prompts to configure 2FA:"
+echo "1. Answer 'y' to update your time-based token"
+echo "2. Scan the QR code with your authenticator app"
+echo "3. Save the backup codes in a secure location"
+echo "4. Answer 'y' to the remaining questions for security"
+echo ""
+google-authenticator -t -d -f -r 3 -R 30 -W
+EOF
+            
+            chmod +x "/tmp/setup-2fa-$user.sh"
+            
+            # Instructions for user setup
+            cat > "$user_home/2fa-setup-instructions.txt" << EOF
+TSYS Two-Factor Authentication Setup Instructions
+==============================================
+
+Your system has been configured for 2FA. To complete setup:
+
+1. Install an authenticator app on your phone:
+   - Google Authenticator
+   - Authy
+   - Microsoft Authenticator
+
+2. Run the setup command:
+   sudo /tmp/setup-2fa-$user.sh
+
+3. Follow the prompts:
+   - Scan the QR code with your app
+   - Save the backup codes securely
+   - Answer 'y' to security questions
+
+4. Test your setup:
+   - SSH to the server
+   - Enter your 6-digit code when prompted
+
+IMPORTANT: Save backup codes in a secure location!
+Without them, you may be locked out if you lose your phone.
+
+For support, contact your system administrator.
+EOF
+            
+            chown "$user:$user" "$user_home/2fa-setup-instructions.txt"
+            print_info "2FA setup prepared for user: $user"
+        else
+            print_info "User $user not found, skipping"
+        fi
+    done
+}
+
+# Restart services
+function restart_services() {
+    print_info "Restarting services..."
+    
+    # Test SSH configuration
+    if sshd -t; then
+        systemctl restart sshd
+        print_info "SSH service restarted"
+    else
+        print_error "SSH configuration test failed"
+        return 1
+    fi
+    
+    # Restart Cockpit if installed
+    if systemctl is-enabled cockpit.socket &>/dev/null; then
+        systemctl restart cockpit.socket
+        print_info "Cockpit service restarted"
+    fi
+    
+    # Restart Webmin if installed
+    if systemctl is-enabled webmin &>/dev/null; then
+        systemctl restart webmin
+        print_info "Webmin service restarted"
+    fi
+}
+
+# Validation and testing
+function validate_2fa_setup() {
+    print_info "Validating 2FA setup..."
+    
+    # Check if Google Authenticator is installed
+    if command -v google-authenticator &>/dev/null; then
+        print_info "Google Authenticator installed"
+    else
+        print_error "Google Authenticator not found"
+        return 1
+    fi
+    
+    # Check SSH configuration
+    if grep -q "AuthenticationMethods publickey,keyboard-interactive" "$SSH_CONFIG"; then
+        print_info "SSH 2FA configuration valid"
+    else
+        print_error "SSH 2FA configuration invalid"
+        return 1
+    fi
+    
+    # Check PAM configuration
+    if grep -q "pam_google_authenticator.so" "$PAM_CONFIG_DIR/sshd"; then
+        print_info "PAM 2FA configuration valid"
+    else
+        print_error "PAM 2FA configuration invalid"
+        return 1
+    fi
+    
+    # Check service status
+    if systemctl is-active sshd &>/dev/null; then
+        print_info "SSH service is running"
+    else
+        print_error "SSH service is not running"
+        return 1
+    fi
+    
+    print_info "2FA validation completed successfully"
+}
+
+# Display final instructions
+function show_final_instructions() {
+    print_info "2FA Setup Completed"
+    
+    print_info "Two-Factor Authentication has been configured for:"
+    print_info "- SSH (requires key + 2FA token)"
+    print_info "- Cockpit web interface"
+    if [[ -f "/etc/webmin/miniserv.conf" ]]; then
+        print_info "- Webmin administration panel"
+    fi
+    
+    print_info "IMPORTANT: Complete user setup immediately!"
+    print_info "1. Check /home/*/2fa-setup-instructions.txt for user setup"
+    print_info "2. Run setup scripts for each user"
+    print_info "3. Test 2FA before logging out"
+    
+    print_info "Backup location: $BACKUP_DIR"
+    print_info "To disable 2FA, restore configurations from backup"
+    
+    print_info "2FA setup completed successfully!"
+}
+
+# Main execution
+function main() {
+    # Check if running as root
+    if [[ $EUID -ne 0 ]]; then
+        print_error "This script must be run as root"
+        exit 1
+    fi
+    
+    # Execute setup steps
+    backup_configs
+    install_2fa_packages
+    configure_ssh_2fa
+    configure_pam_2fa
+    configure_cockpit_2fa
+    configure_webmin_2fa
+    setup_user_2fa
+    restart_services
+    validate_2fa_setup
+    show_final_instructions
+}
+
+# Run main function
+main "$@"
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+#####
+#Core framework functions...
+#####
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+export CONFIGFILES_PATH
+CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+  source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+  source "$project_include_file"
+done
+
+# Material herein Sourced from
+
+# https://cisofy.com/documentation/lynis/
+# https://jbcsec.com/configure-linux-ssh/
+# https://opensource.com/article/20/5/linux-security-lynis
+# https://forum.greenbone.net/t/ssh-authentication/13536
+
+# openvas
+
+#lynis
+
+#Auditd
+
+cat "$CONFIGFILES_PATH/AuditD/auditd.conf" > /etc/audit/auditd.conf
+
+# Systemd
+cat "$CONFIGFILES_PATH/Systemd/journald.conf" > /etc/systemd/journald.conf
+
+# logrotate
+cat "$CONFIGFILES_PATH/Logrotate/logrotate.conf" > /etc/logrotate.conf
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+# Sourced from https://wiki.debian.org/UnattendedUpgrades
@@ -0,0 +1,126 @@
+#!/bin/bash
+
+
+#########################################
+#Core framework functions...
+#########################################
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+export CONFIGFILES_PATH
+CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+  source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+  source "$project_include_file"
+done
+
+
+#########################################
+# Core script code begins here
+#########################################
+
+# Sourced from
+
+# https://complianceascode.readthedocs.io/en/latest/manual/developer/01_introduction.html
+# https://github.com/ComplianceAsCode/content
+# https://github.com/ComplianceAsCode
+
+#apparmor
+#enforcing
+#enabled in bootloader config
+
+#aide
+
+#auditd
+
+#disable auto mounting
+#disable usb storage
+
+
+#motd
+#remote login warning banner
+
+#Ensure time sync is working
+#systemd-timesync
+#ntp
+#chrony
+
+#password complexity
+#password expiration warning
+#password expiration time
+#password hashing algo
+
+#fix grub perms
+
+if [ "$IS_RASPI" = 0 ] ; then
+
+chown root:root /boot/grub/grub.cfg 
+chmod og-rwx /boot/grub/grub.cfg
+chmod 0400 /boot/grub/grub.cfg
+
+fi
+
+
+#disable auto mounting
+systemctl --now disable autofs  || true
+apt-get -y --purge remove autofs || true
+
+#disable usb storage
+cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
+cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
+cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
+cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
+cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
+cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
+cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
+cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
+cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
+cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
+cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
+cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf
+
+#banners
+
+cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
+cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
+cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd
+
+#Cron perms
+
+if [ -f /etc/cron.deny ]; then
+rm /etc/cron.deny || true
+fi
+
+touch /etc/cron.allow
+chmod g-wx,o-rwx /etc/cron.allow
+chown root:root /etc/cron.allow
+
+chmod og-rwx /etc/crontab
+chmod og-rwx /etc/cron.hourly/
+chmod og-rwx /etc/cron.daily/
+chmod og-rwx /etc/cron.weekly/
+chmod og-rwx /etc/cron.monthly/
+chown root:root /etc/cron.d/
+chmod og-rwx /etc/cron.d/
+
+# At perms
+
+rm -f /etc/at.deny || true
+touch /etc/at.allow
+chmod g-wx,o-rwx /etc/at.allow
+chown root:root /etc/at.allow
@@ -0,0 +1,105 @@
+#!/bin/bash
+
+#########################################
+#Core framework functions...
+#########################################
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+export CONFIGFILES_PATH
+CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+    source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+    source "$project_include_file"
+done
+
+
+#########################################
+# Core script code begins here
+#########################################
+
+export SUBODEV_CHECK
+SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
+
+export LOCALUSER_CHECK
+LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
+
+export ROOT_SSH_DIR
+ROOT_SSH_DIR="/root/.ssh"
+
+export LOCALUSER_SSH_DIR
+LOCALUSER_SSH_DIR="/home/localuser/.ssh"
+
+export SUBODEV_SSH_DIR
+SUBODEV_SSH_DIR="/home/subodev/.ssh"
+
+
+if [ ! -d $ROOT_SSH_DIR ]; then
+    mkdir /root/.ssh/
+fi
+
+cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/root-ssh-authorized-keys" >/root/.ssh/authorized_keys
+chmod 400 /root/.ssh/authorized_keys
+chown root: /root/.ssh/authorized_keys
+
+if [ "$LOCALUSER_CHECK" -gt 0 ]; then
+    if [ ! -d $LOCALUSER_SSH_DIR ]; then
+        mkdir -p /home/localuser/.ssh/
+    fi
+    
+    cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/localuser/.ssh/authorized_keys
+    chown localuser /home/localuser/.ssh/authorized_keys &&
+    chmod 400 /home/localuser/.ssh/authorized_keys
+fi
+
+if [ "$SUBODEV_CHECK" = 1 ]; then
+    
+    if [ ! -d $SUBODEV_SSH_DIR ]; then
+        mkdir /home/subodev/.ssh/
+    fi
+    
+    cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/subodev/.ssh/authorized_keys
+    chmod 400 /home/subodev/.ssh/authorized_keys &&
+    chown subodev: /home/subodev/.ssh/authorized_keys
+fi
+
+export DEV_WORKSTATION_CHECK
+DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || true)"
+
+if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
+    
+    cat "$CONFIGFILES_PATH/SSH/Configs/tsys-sshd-config" >/etc/ssh/sshd_config
+fi
+
+
+#Don't deploy this config to a ubuntu server, it breaks openssh server. Works on kali/debian.
+
+export UBUNTU_CHECK
+UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)"
+
+if [ "$UBUNTU_CHECK" -ne 1 ]; then
+    cat "$CONFIGFILES_PATH/SSH/Configs/ssh-audit-hardening.conf" >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
+    chmod og-rwx /etc/ssh/sshd_config.d/*
+fi
+
+# Perms on sshd_config
+chmod og-rwx /etc/ssh/sshd_config
+
+#todo
+
+# only strong MAC algos are used
@@ -0,0 +1,57 @@
+#!/bin/bash
+
+#########################################
+#Core framework functions...
+#########################################
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+  source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+  source "$project_include_file"
+done
+
+
+#########################################
+# Core script code begins here
+#########################################
+
+# We don't want to run this on the wazuh server, otherwise bad things happen...
+
+export TSYS_NSM_CHECK
+TSYS_NSM_CHECK="$(hostname |grep -c tsys-nsm ||true)"
+
+if [ "$TSYS_NSM_CHECK" -eq 0 ]; then
+
+    if [ -f /usr/share/keyrings/wazuh.gpg ]; then
+        rm -f /usr/share/keyrings/wazuh.gpg
+    fi
+
+curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
+chmod 644 /usr/share/keyrings/wazuh.gpg
+echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
+apt-get update
+
+WAZUH_MANAGER="tsys-nsm.knel.net" apt-get -y install wazuh-agent
+
+systemctl daemon-reload
+systemctl enable wazuh-agent
+systemctl start wazuh-agent || true
+
+echo "wazuh-agent hold" | dpkg --set-selections
+
+fi
@@ -0,0 +1,431 @@
+#!/usr/bin/bash
+
+#####
+#Core framework functions...
+#####
+
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+export CONFIGFILES_PATH
+CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
+
+export MODULES_PATH
+MODULES_PATH="$PROJECT_ROOT_PATH/ProjectCode/Modules"
+
+export SCRIPTS_PATH
+SCRIPTS_PATH="$PROJECT_ROOT_PATH/ProjectCode/scripts"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+  source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+  source "$project_include_file"
+done
+
+# Start actual script logic here...
+
+#################
+#Global variables
+#################
+
+apt-get -y install git sudo dmidecode curl
+
+export UBUNTU_CHECK
+UBUNTU_CHECK="$(distro | grep -c Ubuntu || true)"
+
+export IS_PHYSICAL_HOST
+IS_PHYSICAL_HOST="$(/usr/sbin/dmidecode -t System | grep -c Dell || true)"
+
+export SUBODEV_CHECK
+SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
+
+export LOCALUSER_CHECK
+LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
+
+#######################
+# Support functions
+#######################
+
+function global-oam() {
+  print_info "Now running $FUNCNAME...."
+
+  cat "$SCRIPTS_PATH/up2date.sh" >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh
+
+  bash "$MODULES_PATH/OAM/oam-librenms.sh"
+
+  print_info "Completed running $FUNCNAME"
+
+}
+
+function global-systemServiceConfigurationFiles() {
+  print_info "Now running $FUNCNAME...."
+
+  cat "$CONFIGFILES_PATH/ZSH/tsys-zshrc" >/etc/zshrc
+  cat "$CONFIGFILES_PATH/SMTP/aliases" >/etc/aliases
+  cat "$CONFIGFILES_PATH/Syslog/rsyslog.conf" >/etc/rsyslog.conf
+
+  newaliases
+
+  print_info "Completed running $FUNCNAME"
+}
+
+function global-installPackages() {
+  print_info "Now running $FUNCNAME...."
+
+  # Setup webmin repo, used for RBAC/2fa PAM
+
+  curl https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh >/tmp/webmin-setup.sh
+  sh /tmp/webmin-setup.sh -f && rm -f /tmp/webmin-setup.sh
+
+  # Setup tailscale
+
+  curl -fsSL https://tailscale.com/install.sh | sh
+
+  #
+  #Patch the system
+  #
+
+  /usr/local/bin/up2date.sh
+
+  #Remove stuff we don't want
+
+  export DEBIAN_FRONTEND="noninteractive" \
+  && apt-get -qq --yes --purge \
+  remove \
+    systemd-timesyncd \
+    chrony \
+    telnet \
+    inetutils-telnet \
+    wpasupplicant \
+    modemmanager \
+    nano \
+    multipath-tools \
+    || true
+
+    apt-get -y --purge autoremove
+
+  # add stuff we want
+
+  print_info ""Now installing all the packages...""
+
+  DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
+    virt-what \
+    auditd \
+    audispd-plugins \
+    cloud-guest-utils \
+    aide \
+    htop \
+    snmpd \
+    ncdu \
+    iftop \
+    iotop \
+    cockpit \
+    cockpit-bridge \
+    cockpit-doc \
+    cockpit-networkmanager \
+    cockpit-packagekit \
+    cockpit-pcp \
+    cockpit-sosreport \
+    cockpit-storaged \
+    cockpit-system \
+    cockpit-ws \
+    nethogs \
+    sysstat \
+    ngrep \
+    acct \
+    lsb-release \
+    screen \
+    tailscale \
+    tmux \
+    vim \
+    command-not-found \
+    lldpd \
+    ansible-core \
+    net-tools \
+    dos2unix \
+    gpg \
+    molly-guard \
+    lshw \
+    fzf \
+    ripgrep \
+    sudo \
+    mailutils \
+    clamav \
+    sl \
+    logwatch \
+    git \
+    net-tools \
+    tshark \
+    tcpdump \
+    lynis \
+    glances \
+    zsh \
+    zsh-autosuggestions \
+    zsh-syntax-highlighting \
+    fonts-powerline \
+    webmin \
+    usermin \
+    ntpsec \
+    ntpsec-ntpdate \
+    tuned \
+    cockpit \
+    iptables \
+    netfilter-persistent \
+    iptables-persistent \
+    pflogsumm \
+    postfix
+
+  export KALI_CHECK
+  KALI_CHECK="$(distro | grep -c kali || true)"
+
+  export VIRT_TYPE
+  VIRT_TYPE="$(virt-what)"
+
+  export IS_VIRT_GUEST
+  IS_VIRT_GUEST="$(echo "$VIRT_TYPE" | egrep -c 'hyperv|kvm' || true)"
+
+  export IS_KVM_GUEST
+  IS_KVM_GUEST="$(echo "$VIRT_TYPE" | grep -c 'kvm' || true)"
+
+  if [[ $IS_KVM_GUEST = 1 ]]; then
+    apt -y install qemu-guest-agent
+  fi
+
+  if [[ $KALI_CHECK -eq 0 ]];then
+  DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
+    latencytop \
+    cockpit-tests || true
+  fi
+
+  if [[ $IS_PHYSICAL_HOST -gt 0 ]]; then
+    export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
+      i7z \
+      thermald \
+      cpufrequtils \
+      linux-cpupower
+  # power-profiles-daemon
+  fi
+
+############################
+# Secrets agents
+############################
+
+# bitwarden cli
+
+# vault cli
+
+  print_info "Completed running $FUNCNAME"
+}
+
+function global-postPackageConfiguration() {
+
+  print_info "Now running $FUNCNAME"
+
+  systemctl --now enable auditd
+
+  systemctl stop postfix
+
+  cat "$CONFIGFILES_PATH/SMTP/postfix_generic" >/etc/postfix/generic
+  postmap /etc/postfix/generic
+
+  postconf -e "inet_protocols = ipv4"
+  postconf -e "inet_interfaces = 127.0.0.1"
+  postconf -e "mydestination= 127.0.0.1"
+  postconf -e "relayhost = tsys-cloudron.knel.net"
+  postconf -e "smtp_generic_maps = hash:/etc/postfix/generic"
+  # smtp_generic_maps = hash:/etc/postfix/generic
+
+  systemctl restart postfix
+
+  #This is under test/dev and may fail
+  echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
+
+  chsh -s $(which zsh) root
+
+  if [ "$LOCALUSER_CHECK" -gt 0 ]; then
+    chsh -s "$(which zsh)" localuser
+  fi
+
+  if [ "$SUBODEV_CHECK" -gt 0 ]; then
+    chsh -s "$(which zsh)" subodev
+  fi
+
+  ###Post package deployment bits
+
+  cat "$CONFIGFILES_PATH/DHCP/dhclient.conf" >/etc/dhcp/dhclient.conf
+
+  # Authoritative recursive DNS via the redundant pfv-netinfra-01/02 pair.
+  # Replace whatever is at /etc/resolv.conf (including a systemd-resolved or
+  # NetworkManager symlink) with the managed static file so every lookup goes
+  # to our servers and nothing else rewrites it behind our backs.
+  rm -f /etc/resolv.conf
+  cat "$CONFIGFILES_PATH/Resolv/resolv.conf" >/etc/resolv.conf
+  chmod 644 /etc/resolv.conf
+
+  systemctl stop snmpd && /etc/init.d/snmpd stop
+
+  cat "$CONFIGFILES_PATH/SNMP/snmp-sudo.conf" >/etc/sudoers.d/Debian-snmp
+  sed -i "s|-Lsd|-LS6d|" /lib/systemd/system/snmpd.service
+
+  pi-detect
+
+  if [ "$IS_RASPI" = 1 ]; then
+    cat "$CONFIGFILES_PATH/SNMP/snmpd-rpi.conf" >/etc/snmp/snmpd.conf || true
+  fi
+
+  if [ "$IS_PHYSICAL_HOST" = 1 ]; then
+    cat "$CONFIGFILES_PATH/SNMP/snmpd-physicalhost.conf" >/etc/snmp/snmpd.conf || true
+  fi
+
+  if [ "$IS_VIRT_GUEST" = 1 ]; then
+    cat "$CONFIGFILES_PATH/SNMP/snmpd.conf" >/etc/snmp/snmpd.conf || true
+  fi
+
+  systemctl daemon-reload && systemctl restart snmpd && /etc/init.d/snmpd restart
+
+  cat "$CONFIGFILES_PATH/NetworkDiscovery/lldpd" >/etc/default/lldpd
+  systemctl restart lldpd
+
+  cat "$CONFIGFILES_PATH/Cockpit/disallowed-users" >/etc/cockpit/disallowed-users
+  systemctl restart cockpit
+
+  export LIBRENMS_CHECK
+  LIBRENMS_CHECK="$(hostname | grep -c tsys-librenms || true)"
+
+  if [ "$LIBRENMS_CHECK" -eq 0 ]; then
+    DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install rsyslog
+    systemctl stop rsyslog
+    systemctl start rsyslog
+  fi
+
+  export NTP_SERVER_CHECK
+  NTP_SERVER_CHECK="$(hostname | egrep -c 'pfv-netboot|pfvsvrpi|pfv-netinfra' || true)"
+
+  if [ "$NTP_SERVER_CHECK" -eq 0 ]; then
+
+    cat "$CONFIGFILES_PATH/NTP/ntp.conf" >/etc/ntpsec/ntp.conf
+    systemctl restart ntpsec.service
+  fi
+
+  systemctl stop postfix
+  systemctl start postfix
+
+  /usr/sbin/accton on
+
+  if [ "$IS_PHYSICAL_HOST" -gt 0 ]; then
+    cpufreq-set -r -g performance
+    cpupower frequency-set --governor performance
+
+  # Potentially merge the below if needed.
+  # power-profiles-daemon
+  # powerprofilesctl set performance
+  #tsys1# systemctl enable power-profiles-daemon
+  #tsys1# systemctl start power-profiles-daemon
+
+  fi
+
+  if [ "$IS_VIRT_GUEST" = 1 ]; then
+    tuned-adm profile virtual-guest
+  fi
+
+  print_info "Completed running $FUNCNAME"
+}
+
+####################################################################################################
+# Run various modules
+####################################################################################################
+
+####################################################################################################
+# Security Hardening
+####################################################################################################
+
+# SSH
+
+function secharden-ssh() {
+  print_info "Now running $FUNCNAME"
+
+  bash "$MODULES_PATH/Security/secharden-ssh.sh"
+
+  print_info "Completed running $FUNCNAME"
+}
+
+function secharden-wazuh() {
+  print_info "Now running $FUNCNAME"
+  bash "$MODULES_PATH/Security/secharden-wazuh.sh"
+  print_info "Completed running $FUNCNAME"
+}
+
+function secharden-2fa() {
+  print_info "Now running $FUNCNAME"
+  bash "$MODULES_PATH/Security/secharden-2fa.sh"
+  print_info "Completed running $FUNCNAME"
+}
+
+function secharden-scap-stig() {
+  print_info "Now running $FUNCNAME"
+  bash "$MODULES_PATH/Security/secharden-scap-stig.sh"
+  print_info "Completed running $FUNCNAME"
+}
+
+function secharden-agents() {
+  print_info "Now running $FUNCNAME"
+  bash "$MODULES_PATH/Security/secharden-audit-agents.sh"
+  print_info "Completed running $FUNCNAME"
+}
+
+function secharden-auto-upgrades() {
+  print_info "Now running $FUNCNAME"
+  #curl --silent ${DL_ROOT}/Modules/Security/secharden-ssh.sh|$(which bash)
+  print_info "Completed running $FUNCNAME"
+}
+
+
+
+
+####################################################################################################
+# Authentication
+####################################################################################################
+
+function auth-cloudron-ldap() {
+  print_info "Now running "$FUNCNAME""
+  #curl --silent ${DL_ROOT}/Modules/Auth/auth-cloudron-ldap.sh|$(which bash)
+  print_info "Completed running "$FUNCNAME""
+}
+
+####################################################################################################
+# RUn the various functions in the correct order
+####################################################################################################
+
+echo >$LOGFILENAME
+
+print_info "Execution starting at $CURRENT_TIMESTAMP..."
+
+PreflightCheck
+global-oam
+global-installPackages
+global-systemServiceConfigurationFiles
+global-postPackageConfiguration
+
+secharden-ssh
+secharden-wazuh
+secharden-scap-stig
+secharden-2fa
+#secharden-agents
+#secharden-auto-upgrades
+
+#auth-cloudron-ldap
+
+print_info "Execution ended at $CURRENT_TIMESTAMP..."
@@ -0,0 +1,4 @@
+if command -v tmux &> /dev/null && [ -n "$PS1" ] && [[ ! "$TERM" =~ screen ]] && [[ ! "$TERM" =~ tmux ]] && [ -z "$TMUX" ]; then
+          tmux a -t default || exec tmux new -s default && exit;
+fi
+
@@ -0,0 +1 @@
+export HISTTIMEFORMAT="%m/%d/%Y %T "
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+rm -f /etc/apt/sources.list.d/*
+echo "deb https://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-install-repo.list
+wget https://download.proxmox.com/debian/proxmox-release-bookworm.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg
+apt update && apt -y full-upgrade
+apt-get -y install ifupdown2 ipmitool ethtool net-tools lshw
+
+#curl -s http://dl.turnsys.net/newSrv.sh|/bin/bash
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+echo "Running apt-get update"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes update
+
+echo "Running apt-get dist-upgrade"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes dist-upgrade
+
+echo "Running apt-get upgrade"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes upgrade
+
+
+echo "Running apt-get purge"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --purge autoremove --yes
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq autoclean --yes
+