refactor: reorganize merged repo into clean directory structure
Reorganize the merged KNELServerBuild + PFVCluster repo:
provisioning/ server provisioning (was ProjectCode/ +
Project-Includes/ + Project-ConfigFiles/)
tests/ test suite (was Project-Tests/)
perf/ Proxmox perf scripts (was top-level *.sh + scripts/)
docs/ all documentation (was ProjectDocs/ + PROJECT.md +
K8S.md + TODO.md)
dns-cluster-setup/ Technitium DNS cluster (unchanged)
netinfra/ netinfra audit scripts (unchanged)
switches/ switch configs (unchanged)
vendor/ vendored KNELShellFramework (unchanged)
Update all internal path references from old directory names
(ProjectCode/, Project-Includes/, Project-Tests/) to the new ones
(provisioning/, tests/) across all scripts.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
@@ -0,0 +1,66 @@
|
||||
#!/bin/bash
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
export AGENTS_PATH
|
||||
AGENTS_PATH="$PROJECT_ROOT_PATH/provisioning/Agents"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
print_info "Setting up librenms agent..."
|
||||
|
||||
cat "$AGENTS_PATH/librenms/distro" > /usr/local/bin/distro
|
||||
chmod +x /usr/local/bin/distro
|
||||
|
||||
if [ ! -d /usr/lib/check_mk_agent ]; then
|
||||
mkdir -p /usr/lib/check_mk_agent
|
||||
fi
|
||||
|
||||
if [ ! -d /usr/lib/check_mk_agent/plugins ]; then
|
||||
mkdir -p /usr/lib/check_mk_agent/plugins
|
||||
fi
|
||||
|
||||
if [ ! -d /usr/lib/check_mk_agent/local ]; then
|
||||
mkdir -p /usr/lib/check_mk_agent/local
|
||||
fi
|
||||
|
||||
cat "$AGENTS_PATH/librenms/check_mk_agent" > /usr/bin/check_mk_agent
|
||||
chmod +x /usr/bin/check_mk_agent
|
||||
|
||||
cat "$AGENTS_PATH/librenms/check_mk@.service" > /etc/systemd/system/check_mk@.service
|
||||
cat "$AGENTS_PATH/librenms/check_mk.socket" > /etc/systemd/system/check_mk.socket
|
||||
|
||||
systemctl enable check_mk.socket
|
||||
systemctl start check_mk.socket
|
||||
|
||||
#Modules commented out below, we will roll out on systems that use them, most of the fleet doesn't use those modules
|
||||
|
||||
cat "$AGENTS_PATH/librenms/dmi.sh" > /usr/lib/check_mk_agent/local/dmi.sh
|
||||
cat "$AGENTS_PATH/librenms/dpkg.sh" > /usr/lib/check_mk_agent/local/dpkg.sh
|
||||
#cat "$AGENTS_PATH/librenms/mysql.sh" > /usr/lib/check_mk_agent/local/mysql.sh
|
||||
cat "$AGENTS_PATH/librenms/ntp-client" > /usr/lib/check_mk_agent/local/ntp-client
|
||||
#cat "$AGENTS_PATH/librenms/ntp-server.sh" > /usr/lib/check_mk_agent/local/ntp-server.sh
|
||||
cat "$AGENTS_PATH/librenms/os-updates.sh" > /usr/lib/check_mk_agent/local/os-updates.sh
|
||||
cat "$AGENTS_PATH/librenms/postfixdetailed" > /usr/lib/check_mk_agent/local/postfixdetailed
|
||||
cat "$AGENTS_PATH/librenms/postfix-queues" > /usr/lib/check_mk_agent/local/postfix-queues
|
||||
#cat "$AGENTS_PATH/librenms/smart.sh" > /usr/lib/check_mk_agent/local/smart
|
||||
#cat "$AGENTS_PATH/librenms/smart.sh.config" > /usr/lib/check_mk_agent/local/smart.config
|
||||
|
||||
chmod +x /usr/lib/check_mk_agent/local/*
|
||||
@@ -0,0 +1,81 @@
|
||||
#!/bin/bash
|
||||
|
||||
#Made from instructions at https://www.tunetheweb.com/performance/http2/
|
||||
|
||||
OPENSSL_URL_BASE="https://www.openssl.org/source/"
|
||||
OPENSSL_FILE="openssl-1.1.0h.tar.gz"
|
||||
|
||||
NGHTTP_URL_BASE="https://github.com/nghttp2/nghttp2/releases/download/v1.31.0/"
|
||||
NGHTTP_FILE="nghttp2-1.31.0.tar.gz"
|
||||
|
||||
APR_URL_BASE="https://archive.apache.org/dist/apr/"
|
||||
APR_FILE="apr-1.6.3.tar.gz"
|
||||
|
||||
APR_UTIL_URL_BASE="https://archive.apache.org/dist/apr/"
|
||||
APR_UTIL_FILE="apr-util-1.6.1.tar.gz"
|
||||
|
||||
APACHE_URL_BASE="https://archive.apache.org/dist/httpd/"
|
||||
APACHE_FILE="httpd-2.4.33.tar.gz"
|
||||
|
||||
CURL_URL_BASE="https://curl.haxx.se/download/"
|
||||
CURL_FILE="curl-7.60.0.tar.gz"
|
||||
|
||||
|
||||
#Download and install latest version of openssl
|
||||
wget $OPENSSL_URL_BASE/$OPENSSL_FILE
|
||||
tar xzf $OPENSSL_FILE
|
||||
cd openssl-1.1.0h
|
||||
./config enable-weak-ssl-ciphers shared zlib-dynamic -DOPENSSL_TLS_SECURITY_LEVEL=0 --prefix=/usr/local/custom-ssl/openssl-1.1.0h ; make ; make install
|
||||
ln -s /usr/local/custom-ssl/openssl-1.1.0h /usr/local/openssl
|
||||
cd -
|
||||
|
||||
#Download and install nghttp2 (needed for mod_http2).
|
||||
wget $NGHTTP_URL_BASE/$NGHTTP_FILE
|
||||
tar xzf $NGHTTP_FILE
|
||||
cd nghttp2-1.31.0
|
||||
./configure --prefix=/usr/local/custom-ssl/nghttp ; make ; make install
|
||||
cd -
|
||||
|
||||
#Updated ldconfig so curl build
|
||||
|
||||
cat <<custom-ssl > /etc/ld.so.conf.d/custom-ssl.conf
|
||||
/usr/local/custom-ssl/openssl-1.1.0h/lib
|
||||
/usr/local/custom-ssl/nghttp/lib
|
||||
custom-ssl
|
||||
|
||||
ldconfig
|
||||
|
||||
#Download and install curl
|
||||
wget $CURL_URL_BASE/$CURL_FILE
|
||||
tar xzf curl-7.60.0.tar.gz
|
||||
cd curl-7.60.0
|
||||
./configure --prefix=/usr/local/custom-ssl/curl --with-nghttp2=/usr/local/custom-ssl/nghttp/ --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ ; make ; make install
|
||||
cd -
|
||||
|
||||
|
||||
#Download and install latest apr
|
||||
wget $APR_URL_BASE/$APR_FILE
|
||||
tar xzf $APR_FILE
|
||||
cd apr-1.6.3
|
||||
./configure --prefix=/usr/local/custom-ssl/apr ; make ; make install
|
||||
cd -
|
||||
|
||||
#Download and install latest apr-util
|
||||
wget $APR_UTIL_URL_BASE/$APR_UTIL_FILE
|
||||
tar xzf apr-util-1.6.1.tar.gz
|
||||
cd apr-util-1.6.1
|
||||
./configure --prefix=/usr/local/custom-ssl/apr-util --with-apr=/usr/local/custom-ssl/apr ; make; make install
|
||||
cd -
|
||||
|
||||
#Download and install apache
|
||||
wget $APACHE_URL_BASE/$APACHE_FILE
|
||||
tar xzf httpd-2.4.33.tar.gz
|
||||
cd httpd-2.4.33
|
||||
cp -r ../apr-1.6.3 srclib/apr
|
||||
cp -r ../apr-util-1.6.1 srclib/apr-util
|
||||
./configure --prefix=/usr/local/custom-ssl/apache --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ --with-pcre=/usr/bin/pcre-config --enable-unique-id --enable-ssl --enable-so --with-included-apr --enable-http2 --with-nghttp2=/usr/local/custom-ssl/nghttp/
|
||||
make
|
||||
make install
|
||||
ln -s /usr/local/custom-ssl/apache /usr/local/apache
|
||||
cd -
|
||||
|
||||
@@ -0,0 +1,426 @@
|
||||
#!/bin/bash
|
||||
|
||||
# TSYS Security Hardening - Two-Factor Authentication
|
||||
# Implements 2FA for SSH, Cockpit, and Webmin services
|
||||
# Uses Google Authenticator (TOTP) for time-based tokens
|
||||
|
||||
|
||||
#####
|
||||
#Core framework functions...
|
||||
#####
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
# 2FA Configuration
|
||||
BACKUP_DIR="/root/backup/2fa"
|
||||
PAM_CONFIG_DIR="/etc/pam.d"
|
||||
SSH_CONFIG="/etc/ssh/sshd_config"
|
||||
COCKPIT_CONFIG="/etc/cockpit/cockpit.conf"
|
||||
|
||||
# Create backup directory
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
|
||||
print_info "TSYS Two-Factor Authentication Setup"
|
||||
|
||||
# Backup existing configurations
|
||||
function backup_configs() {
|
||||
print_info "Creating backup of existing configurations..."
|
||||
|
||||
# Backup SSH configuration
|
||||
if [[ -f "$SSH_CONFIG" ]]; then
|
||||
cp "$SSH_CONFIG" "$BACKUP_DIR/sshd_config.bak"
|
||||
print_info "SSH config backed up"
|
||||
fi
|
||||
|
||||
# Backup PAM configurations
|
||||
if [[ -d "$PAM_CONFIG_DIR" ]]; then
|
||||
cp -r "$PAM_CONFIG_DIR" "$BACKUP_DIR/pam.d.bak"
|
||||
print_info "PAM configs backed up"
|
||||
fi
|
||||
|
||||
# Backup Cockpit configuration if exists
|
||||
if [[ -f "$COCKPIT_CONFIG" ]]; then
|
||||
cp "$COCKPIT_CONFIG" "$BACKUP_DIR/cockpit.conf.bak"
|
||||
print_info "Cockpit config backed up"
|
||||
fi
|
||||
|
||||
print_info "Backup completed: $BACKUP_DIR"
|
||||
}
|
||||
|
||||
# Install required packages
|
||||
function install_2fa_packages() {
|
||||
print_info "Installing 2FA packages..."
|
||||
|
||||
# Update package cache
|
||||
apt-get update
|
||||
|
||||
# Install Google Authenticator PAM module
|
||||
# Install QR code generator for terminal display
|
||||
apt-get install -y libpam-google-authenticator qrencode
|
||||
|
||||
print_info "2FA packages installed successfully"
|
||||
}
|
||||
|
||||
# Configure SSH for 2FA
|
||||
function configure_ssh_2fa() {
|
||||
print_info "Configuring SSH for 2FA..."
|
||||
|
||||
# Configure SSH daemon
|
||||
print_info "Updating SSH configuration..."
|
||||
|
||||
# Enable challenge-response authentication
|
||||
if ! grep -q "^ChallengeResponseAuthentication yes" "$SSH_CONFIG"; then
|
||||
sed -i 's/^ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' "$SSH_CONFIG" || \
|
||||
echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG"
|
||||
fi
|
||||
|
||||
if ! grep -q "^KbdInteractiveAuthentication yes" "$SSH_CONFIG"; then
|
||||
sed -i 's/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' "$SSH_CONFIG" || \
|
||||
echo "KbdInteractiveAuthentication yes" >> "$SSH_CONFIG"
|
||||
fi
|
||||
|
||||
# Enable PAM authentication
|
||||
if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then
|
||||
sed -i 's/^UsePAM.*/UsePAM yes/' "$SSH_CONFIG" || \
|
||||
echo "UsePAM yes" >> "$SSH_CONFIG"
|
||||
fi
|
||||
|
||||
# Configure authentication methods (key + 2FA)
|
||||
if ! grep -q "^AuthenticationMethods" "$SSH_CONFIG"; then
|
||||
echo "AuthenticationMethods publickey,keyboard-interactive" >> "$SSH_CONFIG"
|
||||
else
|
||||
sed -i 's/^AuthenticationMethods.*/AuthenticationMethods publickey,keyboard-interactive/' "$SSH_CONFIG"
|
||||
fi
|
||||
|
||||
print_info "SSH configuration updated"
|
||||
}
|
||||
|
||||
# Configure PAM for 2FA
|
||||
function configure_pam_2fa() {
|
||||
print_info "Configuring PAM for 2FA..."
|
||||
|
||||
# Create backup of original PAM SSH config
|
||||
cp "$PAM_CONFIG_DIR/sshd" "$PAM_CONFIG_DIR/sshd.bak.$(date +%Y%m%d)"
|
||||
|
||||
# Configure PAM to use Google Authenticator
|
||||
cat > "$PAM_CONFIG_DIR/sshd" << 'EOF'
|
||||
# PAM configuration for SSH with 2FA
|
||||
# Standard Un*x authentication
|
||||
@include common-auth
|
||||
|
||||
# Google Authenticator 2FA
|
||||
auth required pam_google_authenticator.so nullok
|
||||
|
||||
# Standard Un*x authorization
|
||||
@include common-account
|
||||
|
||||
# SELinux needs to be the first session rule
|
||||
session required pam_selinux.so close
|
||||
session required pam_loginuid.so
|
||||
|
||||
# Standard Un*x session setup and teardown
|
||||
@include common-session
|
||||
|
||||
# Print the message of the day upon successful login
|
||||
session optional pam_motd.so motd=/run/motd.dynamic
|
||||
session optional pam_motd.so noupdate
|
||||
|
||||
# Print the status of the user's mailbox upon successful login
|
||||
session optional pam_mail.so standard noenv
|
||||
|
||||
# Set up user limits from /etc/security/limits.conf
|
||||
session required pam_limits.so
|
||||
|
||||
# SELinux needs to intervene at login time
|
||||
session required pam_selinux.so open
|
||||
|
||||
# Standard Un*x password updating
|
||||
@include common-password
|
||||
EOF
|
||||
|
||||
print_info "PAM configuration updated for SSH 2FA"
|
||||
}
|
||||
|
||||
# Configure Cockpit for 2FA
|
||||
function configure_cockpit_2fa() {
|
||||
print_info "Configuring Cockpit for 2FA..."
|
||||
|
||||
# Create Cockpit config directory if it doesn't exist
|
||||
mkdir -p "$(dirname "$COCKPIT_CONFIG")"
|
||||
|
||||
# Configure Cockpit to use PAM with 2FA
|
||||
cat > "$COCKPIT_CONFIG" << 'EOF'
|
||||
[WebService]
|
||||
# Enable 2FA for Cockpit web interface
|
||||
LoginTitle = TSYS Server Management
|
||||
LoginTo = 300
|
||||
RequireHost = true
|
||||
|
||||
[Session]
|
||||
# Use PAM for authentication (includes 2FA)
|
||||
Banner = /etc/cockpit/issue.cockpit
|
||||
IdleTimeout = 15
|
||||
EOF
|
||||
|
||||
# Create PAM configuration for Cockpit
|
||||
cat > "$PAM_CONFIG_DIR/cockpit" << 'EOF'
|
||||
# PAM configuration for Cockpit with 2FA
|
||||
auth requisite pam_nologin.so
|
||||
auth required pam_env.so
|
||||
auth required pam_faillock.so preauth
|
||||
auth sufficient pam_unix.so try_first_pass
|
||||
auth required pam_google_authenticator.so nullok
|
||||
auth required pam_faillock.so authfail
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_nologin.so
|
||||
account include system-auth
|
||||
account required pam_faillock.so
|
||||
|
||||
session required pam_selinux.so close
|
||||
session required pam_loginuid.so
|
||||
session optional pam_keyinit.so force revoke
|
||||
session include system-auth
|
||||
session required pam_selinux.so open
|
||||
session optional pam_motd.so
|
||||
EOF
|
||||
|
||||
print_info "Cockpit 2FA configuration completed"
|
||||
}
|
||||
|
||||
# Configure Webmin for 2FA (if installed)
|
||||
function configure_webmin_2fa() {
|
||||
print_info "Checking for Webmin installation..."
|
||||
|
||||
local webmin_config="/etc/webmin/miniserv.conf"
|
||||
|
||||
if [[ -f "$webmin_config" ]]; then
|
||||
print_info "Webmin found, configuring 2FA..."
|
||||
|
||||
# Stop webmin service
|
||||
systemctl stop webmin || true
|
||||
|
||||
# Enable 2FA in Webmin configuration. `sed -i ... || echo` would never
|
||||
# append, because sed returns 0 even when it matches nothing; guard with
|
||||
# grep so the directive is added when absent and updated when present.
|
||||
if grep -q '^twofactor_provider=' "$webmin_config"; then
|
||||
sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config"
|
||||
else
|
||||
echo "twofactor_provider=totp" >> "$webmin_config"
|
||||
fi
|
||||
|
||||
# Enable 2FA requirement
|
||||
if grep -q '^twofactor=' "$webmin_config"; then
|
||||
sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config"
|
||||
else
|
||||
echo "twofactor=1" >> "$webmin_config"
|
||||
fi
|
||||
|
||||
# Start webmin service
|
||||
systemctl start webmin || true
|
||||
|
||||
print_info "Webmin 2FA configuration completed"
|
||||
else
|
||||
print_info "Webmin not found, skipping configuration"
|
||||
fi
|
||||
}
|
||||
|
||||
# Setup 2FA for users
|
||||
function setup_user_2fa() {
|
||||
print_info "Setting up 2FA for system users..."
|
||||
|
||||
local users=("localuser" "root")
|
||||
|
||||
for user in "${users[@]}"; do
|
||||
if id "$user" &>/dev/null; then
|
||||
print_info "Setting up 2FA for user: $user"
|
||||
|
||||
local user_home
|
||||
user_home="$(getent passwd "$user" | cut -d: -f6)"
|
||||
if [[ -z "$user_home" ]]; then
|
||||
print_info "No home directory for $user, skipping"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Create 2FA setup script for user
|
||||
cat > "/tmp/setup-2fa-$user.sh" << 'EOF'
|
||||
#!/bin/bash
|
||||
echo "Setting up Google Authenticator for user: $USER"
|
||||
echo "Please follow the prompts to configure 2FA:"
|
||||
echo "1. Answer 'y' to update your time-based token"
|
||||
echo "2. Scan the QR code with your authenticator app"
|
||||
echo "3. Save the backup codes in a secure location"
|
||||
echo "4. Answer 'y' to the remaining questions for security"
|
||||
echo ""
|
||||
google-authenticator -t -d -f -r 3 -R 30 -W
|
||||
EOF
|
||||
|
||||
chmod +x "/tmp/setup-2fa-$user.sh"
|
||||
|
||||
# Instructions for user setup
|
||||
cat > "$user_home/2fa-setup-instructions.txt" << EOF
|
||||
TSYS Two-Factor Authentication Setup Instructions
|
||||
==============================================
|
||||
|
||||
Your system has been configured for 2FA. To complete setup:
|
||||
|
||||
1. Install an authenticator app on your phone:
|
||||
- Google Authenticator
|
||||
- Authy
|
||||
- Microsoft Authenticator
|
||||
|
||||
2. Run the setup command:
|
||||
sudo /tmp/setup-2fa-$user.sh
|
||||
|
||||
3. Follow the prompts:
|
||||
- Scan the QR code with your app
|
||||
- Save the backup codes securely
|
||||
- Answer 'y' to security questions
|
||||
|
||||
4. Test your setup:
|
||||
- SSH to the server
|
||||
- Enter your 6-digit code when prompted
|
||||
|
||||
IMPORTANT: Save backup codes in a secure location!
|
||||
Without them, you may be locked out if you lose your phone.
|
||||
|
||||
For support, contact your system administrator.
|
||||
EOF
|
||||
|
||||
chown "$user:$user" "$user_home/2fa-setup-instructions.txt"
|
||||
print_info "2FA setup prepared for user: $user"
|
||||
else
|
||||
print_info "User $user not found, skipping"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# Restart services
|
||||
function restart_services() {
|
||||
print_info "Restarting services..."
|
||||
|
||||
# Test SSH configuration
|
||||
if sshd -t; then
|
||||
systemctl restart sshd
|
||||
print_info "SSH service restarted"
|
||||
else
|
||||
print_error "SSH configuration test failed"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Restart Cockpit if installed
|
||||
if systemctl is-enabled cockpit.socket &>/dev/null; then
|
||||
systemctl restart cockpit.socket
|
||||
print_info "Cockpit service restarted"
|
||||
fi
|
||||
|
||||
# Restart Webmin if installed
|
||||
if systemctl is-enabled webmin &>/dev/null; then
|
||||
systemctl restart webmin
|
||||
print_info "Webmin service restarted"
|
||||
fi
|
||||
}
|
||||
|
||||
# Validation and testing
|
||||
function validate_2fa_setup() {
|
||||
print_info "Validating 2FA setup..."
|
||||
|
||||
# Check if Google Authenticator is installed
|
||||
if command -v google-authenticator &>/dev/null; then
|
||||
print_info "Google Authenticator installed"
|
||||
else
|
||||
print_error "Google Authenticator not found"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Check SSH configuration
|
||||
if grep -q "AuthenticationMethods publickey,keyboard-interactive" "$SSH_CONFIG"; then
|
||||
print_info "SSH 2FA configuration valid"
|
||||
else
|
||||
print_error "SSH 2FA configuration invalid"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Check PAM configuration
|
||||
if grep -q "pam_google_authenticator.so" "$PAM_CONFIG_DIR/sshd"; then
|
||||
print_info "PAM 2FA configuration valid"
|
||||
else
|
||||
print_error "PAM 2FA configuration invalid"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Check service status
|
||||
if systemctl is-active sshd &>/dev/null; then
|
||||
print_info "SSH service is running"
|
||||
else
|
||||
print_error "SSH service is not running"
|
||||
return 1
|
||||
fi
|
||||
|
||||
print_info "2FA validation completed successfully"
|
||||
}
|
||||
|
||||
# Display final instructions
|
||||
function show_final_instructions() {
|
||||
print_info "2FA Setup Completed"
|
||||
|
||||
print_info "Two-Factor Authentication has been configured for:"
|
||||
print_info "- SSH (requires key + 2FA token)"
|
||||
print_info "- Cockpit web interface"
|
||||
if [[ -f "/etc/webmin/miniserv.conf" ]]; then
|
||||
print_info "- Webmin administration panel"
|
||||
fi
|
||||
|
||||
print_info "IMPORTANT: Complete user setup immediately!"
|
||||
print_info "1. Check /home/*/2fa-setup-instructions.txt for user setup"
|
||||
print_info "2. Run setup scripts for each user"
|
||||
print_info "3. Test 2FA before logging out"
|
||||
|
||||
print_info "Backup location: $BACKUP_DIR"
|
||||
print_info "To disable 2FA, restore configurations from backup"
|
||||
|
||||
print_info "2FA setup completed successfully!"
|
||||
}
|
||||
|
||||
# Main execution
|
||||
function main() {
|
||||
# Check if running as root
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
print_error "This script must be run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Execute setup steps
|
||||
backup_configs
|
||||
install_2fa_packages
|
||||
configure_ssh_2fa
|
||||
configure_pam_2fa
|
||||
configure_cockpit_2fa
|
||||
configure_webmin_2fa
|
||||
setup_user_2fa
|
||||
restart_services
|
||||
validate_2fa_setup
|
||||
show_final_instructions
|
||||
}
|
||||
|
||||
# Run main function
|
||||
main "$@"
|
||||
@@ -0,0 +1,50 @@
|
||||
#!/bin/bash
|
||||
|
||||
#####
|
||||
#Core framework functions...
|
||||
#####
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
export CONFIGFILES_PATH
|
||||
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/provisioning/ConfigFiles"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
# Material herein Sourced from
|
||||
|
||||
# https://cisofy.com/documentation/lynis/
|
||||
# https://jbcsec.com/configure-linux-ssh/
|
||||
# https://opensource.com/article/20/5/linux-security-lynis
|
||||
# https://forum.greenbone.net/t/ssh-authentication/13536
|
||||
|
||||
# openvas
|
||||
|
||||
#lynis
|
||||
|
||||
#Auditd
|
||||
|
||||
cat "$CONFIGFILES_PATH/AuditD/auditd.conf" > /etc/audit/auditd.conf
|
||||
|
||||
# Systemd
|
||||
cat "$CONFIGFILES_PATH/Systemd/journald.conf" > /etc/systemd/journald.conf
|
||||
|
||||
# logrotate
|
||||
cat "$CONFIGFILES_PATH/Logrotate/logrotate.conf" > /etc/logrotate.conf
|
||||
@@ -0,0 +1,3 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Sourced from https://wiki.debian.org/UnattendedUpgrades
|
||||
@@ -0,0 +1,126 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
#########################################
|
||||
#Core framework functions...
|
||||
#########################################
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
export CONFIGFILES_PATH
|
||||
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/provisioning/ConfigFiles"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
|
||||
#########################################
|
||||
# Core script code begins here
|
||||
#########################################
|
||||
|
||||
# Sourced from
|
||||
|
||||
# https://complianceascode.readthedocs.io/en/latest/manual/developer/01_introduction.html
|
||||
# https://github.com/ComplianceAsCode/content
|
||||
# https://github.com/ComplianceAsCode
|
||||
|
||||
#apparmor
|
||||
#enforcing
|
||||
#enabled in bootloader config
|
||||
|
||||
#aide
|
||||
|
||||
#auditd
|
||||
|
||||
#disable auto mounting
|
||||
#disable usb storage
|
||||
|
||||
|
||||
#motd
|
||||
#remote login warning banner
|
||||
|
||||
#Ensure time sync is working
|
||||
#systemd-timesync
|
||||
#ntp
|
||||
#chrony
|
||||
|
||||
#password complexity
|
||||
#password expiration warning
|
||||
#password expiration time
|
||||
#password hashing algo
|
||||
|
||||
#fix grub perms
|
||||
|
||||
if [ "$IS_RASPI" = 0 ] ; then
|
||||
|
||||
chown root:root /boot/grub/grub.cfg
|
||||
chmod og-rwx /boot/grub/grub.cfg
|
||||
chmod 0400 /boot/grub/grub.cfg
|
||||
|
||||
fi
|
||||
|
||||
|
||||
#disable auto mounting
|
||||
systemctl --now disable autofs || true
|
||||
apt-get -y --purge remove autofs || true
|
||||
|
||||
#disable usb storage
|
||||
cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
|
||||
cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf
|
||||
|
||||
#banners
|
||||
|
||||
cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
|
||||
cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
|
||||
cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd
|
||||
|
||||
#Cron perms
|
||||
|
||||
if [ -f /etc/cron.deny ]; then
|
||||
rm /etc/cron.deny || true
|
||||
fi
|
||||
|
||||
touch /etc/cron.allow
|
||||
chmod g-wx,o-rwx /etc/cron.allow
|
||||
chown root:root /etc/cron.allow
|
||||
|
||||
chmod og-rwx /etc/crontab
|
||||
chmod og-rwx /etc/cron.hourly/
|
||||
chmod og-rwx /etc/cron.daily/
|
||||
chmod og-rwx /etc/cron.weekly/
|
||||
chmod og-rwx /etc/cron.monthly/
|
||||
chown root:root /etc/cron.d/
|
||||
chmod og-rwx /etc/cron.d/
|
||||
|
||||
# At perms
|
||||
|
||||
rm -f /etc/at.deny || true
|
||||
touch /etc/at.allow
|
||||
chmod g-wx,o-rwx /etc/at.allow
|
||||
chown root:root /etc/at.allow
|
||||
@@ -0,0 +1,105 @@
|
||||
#!/bin/bash
|
||||
|
||||
#########################################
|
||||
#Core framework functions...
|
||||
#########################################
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
export CONFIGFILES_PATH
|
||||
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/provisioning/ConfigFiles"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
|
||||
#########################################
|
||||
# Core script code begins here
|
||||
#########################################
|
||||
|
||||
export SUBODEV_CHECK
|
||||
SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
|
||||
|
||||
export LOCALUSER_CHECK
|
||||
LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
|
||||
|
||||
export ROOT_SSH_DIR
|
||||
ROOT_SSH_DIR="/root/.ssh"
|
||||
|
||||
export LOCALUSER_SSH_DIR
|
||||
LOCALUSER_SSH_DIR="/home/localuser/.ssh"
|
||||
|
||||
export SUBODEV_SSH_DIR
|
||||
SUBODEV_SSH_DIR="/home/subodev/.ssh"
|
||||
|
||||
|
||||
if [ ! -d $ROOT_SSH_DIR ]; then
|
||||
mkdir /root/.ssh/
|
||||
fi
|
||||
|
||||
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/root-ssh-authorized-keys" >/root/.ssh/authorized_keys
|
||||
chmod 400 /root/.ssh/authorized_keys
|
||||
chown root: /root/.ssh/authorized_keys
|
||||
|
||||
if [ "$LOCALUSER_CHECK" -gt 0 ]; then
|
||||
if [ ! -d $LOCALUSER_SSH_DIR ]; then
|
||||
mkdir -p /home/localuser/.ssh/
|
||||
fi
|
||||
|
||||
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/localuser/.ssh/authorized_keys
|
||||
chown localuser /home/localuser/.ssh/authorized_keys &&
|
||||
chmod 400 /home/localuser/.ssh/authorized_keys
|
||||
fi
|
||||
|
||||
if [ "$SUBODEV_CHECK" = 1 ]; then
|
||||
|
||||
if [ ! -d $SUBODEV_SSH_DIR ]; then
|
||||
mkdir /home/subodev/.ssh/
|
||||
fi
|
||||
|
||||
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/subodev/.ssh/authorized_keys
|
||||
chmod 400 /home/subodev/.ssh/authorized_keys &&
|
||||
chown subodev: /home/subodev/.ssh/authorized_keys
|
||||
fi
|
||||
|
||||
export DEV_WORKSTATION_CHECK
|
||||
DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || true)"
|
||||
|
||||
if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
|
||||
|
||||
cat "$CONFIGFILES_PATH/SSH/Configs/tsys-sshd-config" >/etc/ssh/sshd_config
|
||||
fi
|
||||
|
||||
|
||||
#Don't deploy this config to a ubuntu server, it breaks openssh server. Works on kali/debian.
|
||||
|
||||
export UBUNTU_CHECK
|
||||
UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)"
|
||||
|
||||
if [ "$UBUNTU_CHECK" -ne 1 ]; then
|
||||
cat "$CONFIGFILES_PATH/SSH/Configs/ssh-audit-hardening.conf" >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
|
||||
chmod og-rwx /etc/ssh/sshd_config.d/*
|
||||
fi
|
||||
|
||||
# Perms on sshd_config
|
||||
chmod og-rwx /etc/ssh/sshd_config
|
||||
|
||||
#todo
|
||||
|
||||
# only strong MAC algos are used
|
||||
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
|
||||
#########################################
|
||||
#Core framework functions...
|
||||
#########################################
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
|
||||
#########################################
|
||||
# Core script code begins here
|
||||
#########################################
|
||||
|
||||
# We don't want to run this on the wazuh server, otherwise bad things happen...
|
||||
|
||||
export TSYS_NSM_CHECK
|
||||
TSYS_NSM_CHECK="$(hostname |grep -c tsys-nsm ||true)"
|
||||
|
||||
if [ "$TSYS_NSM_CHECK" -eq 0 ]; then
|
||||
|
||||
if [ -f /usr/share/keyrings/wazuh.gpg ]; then
|
||||
rm -f /usr/share/keyrings/wazuh.gpg
|
||||
fi
|
||||
|
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
|
||||
chmod 644 /usr/share/keyrings/wazuh.gpg
|
||||
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
|
||||
apt-get update
|
||||
|
||||
WAZUH_MANAGER="tsys-nsm.knel.net" apt-get -y install wazuh-agent
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable wazuh-agent
|
||||
systemctl start wazuh-agent || true
|
||||
|
||||
echo "wazuh-agent hold" | dpkg --set-selections
|
||||
|
||||
fi
|
||||
Reference in New Issue
Block a user