mrcharles
39bb855a98
Archive the non-ported remainder of the legacy KNELServerBuild repo
under archive/KNELServerBuild/ with its original structure intact,
completing the legacy repo merge for everything except the live
LibreNMS patterns (ported in the previous commit).
Exclusions:
- .git history (superseded; legacy repo remains at its original path)
- ported files (Agents/librenms, Modules/OAM/oam-librenms.sh,
ConfigFiles/SNMP/snmp-sudo.conf)
- vendored KNELShellFramework tree (byte-identical duplicate of the
copy already vendored at vendor/ in this repo)
- SSH authorized-keys files (live access-control material; carrying
them in an archive invites drift — key policy lives elsewhere)
The whole tree is skip-listed in tests/shellcheck.sh (archived legacy
code, not maintained — same standing as vendor/); check-rules.sh
already prunes archive/. Rule 9 (conflict markers) now also excludes
archive/ staged files: preserved-verbatim legacy scripts contain
decorative "====" banners that false-positive as conflict markers
(same archive exclusion precedent as rule 11).
AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the
Repository Layout, and fix the stale KNELIAC path to
/home/reachableceo/projects/KNEL/KNELIAC.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
126 lines
3.2 KiB
Bash
126 lines
3.2 KiB
Bash
#!/bin/bash
|
|
|
|
|
|
#########################################
|
|
#Core framework functions...
|
|
#########################################
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
export PROJECT_ROOT_PATH
|
|
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
|
|
export GIT_VENDOR_PATH_ROOT
|
|
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
|
|
|
export KNELShellFrameworkRoot
|
|
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
|
|
|
export CONFIGFILES_PATH
|
|
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
|
|
|
|
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
|
|
|
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
|
source "$framework_include_file"
|
|
done
|
|
|
|
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
|
source "$project_include_file"
|
|
done
|
|
|
|
|
|
#########################################
|
|
# Core script code begins here
|
|
#########################################
|
|
|
|
# Sourced from
|
|
|
|
# https://complianceascode.readthedocs.io/en/latest/manual/developer/01_introduction.html
|
|
# https://github.com/ComplianceAsCode/content
|
|
# https://github.com/ComplianceAsCode
|
|
|
|
#apparmor
|
|
#enforcing
|
|
#enabled in bootloader config
|
|
|
|
#aide
|
|
|
|
#auditd
|
|
|
|
#disable auto mounting
|
|
#disable usb storage
|
|
|
|
|
|
#motd
|
|
#remote login warning banner
|
|
|
|
#Ensure time sync is working
|
|
#systemd-timesync
|
|
#ntp
|
|
#chrony
|
|
|
|
#password complexity
|
|
#password expiration warning
|
|
#password expiration time
|
|
#password hashing algo
|
|
|
|
#fix grub perms
|
|
|
|
if [ "$IS_RASPI" = 0 ] ; then
|
|
|
|
chown root:root /boot/grub/grub.cfg
|
|
chmod og-rwx /boot/grub/grub.cfg
|
|
chmod 0400 /boot/grub/grub.cfg
|
|
|
|
fi
|
|
|
|
|
|
#disable auto mounting
|
|
systemctl --now disable autofs || true
|
|
apt-get -y --purge remove autofs || true
|
|
|
|
#disable usb storage
|
|
cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
|
|
cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf
|
|
|
|
#banners
|
|
|
|
cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
|
|
cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
|
|
cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd
|
|
|
|
#Cron perms
|
|
|
|
if [ -f /etc/cron.deny ]; then
|
|
rm /etc/cron.deny || true
|
|
fi
|
|
|
|
touch /etc/cron.allow
|
|
chmod g-wx,o-rwx /etc/cron.allow
|
|
chown root:root /etc/cron.allow
|
|
|
|
chmod og-rwx /etc/crontab
|
|
chmod og-rwx /etc/cron.hourly/
|
|
chmod og-rwx /etc/cron.daily/
|
|
chmod og-rwx /etc/cron.weekly/
|
|
chmod og-rwx /etc/cron.monthly/
|
|
chown root:root /etc/cron.d/
|
|
chmod og-rwx /etc/cron.d/
|
|
|
|
# At perms
|
|
|
|
rm -f /etc/at.deny || true
|
|
touch /etc/at.allow
|
|
chmod g-wx,o-rwx /etc/at.allow
|
|
chown root:root /etc/at.allow |