340 lines
12 KiB
Bash
340 lines
12 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
readonly ENV_FILE="${ENV_FILE:-/root/setup-data/env.txt}"
|
|
readonly HASH_FILE="${HASH_FILE:-/root/setup-data/password.hash}"
|
|
readonly SSHD_DROPIN="/etc/ssh/sshd_config.d/00-hermes-hardening.conf"
|
|
readonly FAIL2BAN_JAIL="/etc/fail2ban/jail.d/hermes.local"
|
|
|
|
log() { printf '[+] %s\n' "$*"; }
|
|
warn() { printf '[!] %s\n' "$*" >&2; }
|
|
die() { printf '[x] %s\n' "$*" >&2; exit 1; }
|
|
|
|
backup_file() {
|
|
local file="$1"
|
|
[[ -f "$file" ]] || return 0
|
|
cp -a -- "$file" "${file}.bak.$(date +%F-%H%M%S-%N)"
|
|
}
|
|
|
|
trim() {
|
|
local value="$1"
|
|
value="${value#"${value%%[![:space:]]*}"}"
|
|
value="${value%"${value##*[![:space:]]}"}"
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
read_env_value() {
|
|
local key="$1" line value
|
|
line="$(grep -m1 -E "^[[:space:]]*${key}[[:space:]]*=" "$ENV_FILE" || true)"
|
|
[[ -n "$line" ]] || return 0
|
|
line="${line//$'\r'/}"
|
|
value="$(trim "${line#*=}")"
|
|
|
|
if (( ${#value} >= 2 )); then
|
|
if [[ "${value:0:1}" == '"' && "${value: -1}" == '"' ]]; then
|
|
value="${value:1:${#value}-2}"
|
|
elif [[ "${value:0:1}" == "'" && "${value: -1}" == "'" ]]; then
|
|
value="${value:1:${#value}-2}"
|
|
fi
|
|
fi
|
|
|
|
printf '%s' "$value" | tr -d '\r'
|
|
}
|
|
|
|
require_regular_root_file() {
|
|
local file="$1"
|
|
[[ -f "$file" && ! -L "$file" ]] || die "Required regular file not found: $file"
|
|
[[ "$(stat -c '%u' "$file")" == 0 ]] || die "$file must be owned by root"
|
|
chmod 600 -- "$file"
|
|
}
|
|
|
|
validate_boolean() {
|
|
local name="$1" value="$2"
|
|
[[ "$value" == yes || "$value" == no ]] || die "$name must be 'yes' or 'no'"
|
|
}
|
|
|
|
require_command() {
|
|
command -v "$1" >/dev/null 2>&1 || die "Required command not found: $1"
|
|
}
|
|
|
|
collect_user_configuration() {
|
|
local new_username ssh_public_key pass pass2 candidate_uid
|
|
local key_method source_username source_home source_key_file candidate_key key_test
|
|
|
|
log "Collecting configuration for a new administrative user"
|
|
while :; do
|
|
read -rp 'New username: ' new_username
|
|
if [[ ! "$new_username" =~ ^[a-z_][a-z0-9_-]{0,31}$ || "$new_username" == root ]]; then
|
|
warn "Use 1-32 lowercase letters, digits, underscore or hyphen; root is not allowed"
|
|
continue
|
|
fi
|
|
if id "$new_username" >/dev/null 2>&1; then
|
|
candidate_uid="$(id -u "$new_username")"
|
|
if (( candidate_uid < 1000 || candidate_uid == 65534 )); then
|
|
warn "System account cannot be modified: $new_username"
|
|
continue
|
|
fi
|
|
warn "User $new_username already exists; its password and SSH key will be updated"
|
|
fi
|
|
break
|
|
done
|
|
|
|
while :; do
|
|
printf '\nSSH key setup:\n'
|
|
printf ' 1 - copy a working key from an existing user (recommended)\n'
|
|
printf ' 2 - paste a public key manually\n'
|
|
read -rp 'Select [1]: ' key_method
|
|
key_method="${key_method:-1}"
|
|
|
|
if [[ "$key_method" == 1 ]]; then
|
|
read -rp 'Existing username [hermes]: ' source_username
|
|
source_username="${source_username:-hermes}"
|
|
|
|
if ! id "$source_username" >/dev/null 2>&1; then
|
|
warn "User does not exist: $source_username"
|
|
continue
|
|
fi
|
|
|
|
source_home="$(getent passwd "$source_username" | cut -d: -f6)"
|
|
source_key_file="${source_home}/.ssh/authorized_keys"
|
|
if [[ ! -f "$source_key_file" || -L "$source_key_file" ]]; then
|
|
warn "A regular authorized_keys file was not found for $source_username"
|
|
continue
|
|
fi
|
|
|
|
ssh_public_key=""
|
|
key_test="$(mktemp)"
|
|
chmod 600 "$key_test"
|
|
while IFS= read -r candidate_key || [[ -n "$candidate_key" ]]; do
|
|
candidate_key="${candidate_key//$'\r'/}"
|
|
[[ -n "$candidate_key" && "$candidate_key" != \#* ]] || continue
|
|
printf '%s\n' "$candidate_key" > "$key_test"
|
|
if ssh-keygen -l -f "$key_test" >/dev/null 2>&1; then
|
|
ssh_public_key="$candidate_key"
|
|
break
|
|
fi
|
|
done < "$source_key_file"
|
|
rm -f -- "$key_test"
|
|
|
|
if [[ -z "$ssh_public_key" ]]; then
|
|
warn "No valid SSH public key was found for $source_username"
|
|
continue
|
|
fi
|
|
log "The SSH key was copied from user $source_username"
|
|
break
|
|
fi
|
|
|
|
if [[ "$key_method" == 2 ]]; then
|
|
read -rp "Paste the SSH public key for ${new_username}: " ssh_public_key
|
|
if [[ "$ssh_public_key" =~ ^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp(256|384|521)|sk-ssh-ed25519@openssh.com|sk-ecdsa-sha2-nistp256@openssh.com)[[:space:]]+[A-Za-z0-9+/]+={0,3}([[:space:]].*)?$ ]]; then
|
|
break
|
|
fi
|
|
warn "Public key format is invalid"
|
|
continue
|
|
fi
|
|
|
|
warn "Select 1 or 2"
|
|
done
|
|
|
|
while :; do
|
|
read -rsp "Password for ${new_username}: " pass
|
|
printf '\n'
|
|
read -rsp 'Repeat password: ' pass2
|
|
printf '\n'
|
|
[[ -n "$pass" ]] || { warn "Password must not be empty"; continue; }
|
|
[[ "$pass" == "$pass2" ]] && break
|
|
warn "Passwords do not match"
|
|
done
|
|
|
|
install -d -m 700 -o root -g root "$(dirname "$ENV_FILE")" "$(dirname "$HASH_FILE")"
|
|
umask 077
|
|
printf '%s' "$pass" | openssl passwd -6 -stdin > "$HASH_FILE"
|
|
cat > "$ENV_FILE" <<EOF
|
|
NEW_USERNAME=${new_username}
|
|
SSH_PORT=20202
|
|
SSH_PUBLIC_KEY=${ssh_public_key}
|
|
PASSWORD_AUTH=no
|
|
PASSWORDLESS_SUDO=no
|
|
MANAGE_UFW=yes
|
|
EOF
|
|
chmod 600 "$ENV_FILE" "$HASH_FILE"
|
|
}
|
|
|
|
[[ "$EUID" -eq 0 ]] || die "Run this script as root"
|
|
require_command openssl
|
|
require_command ssh-keygen
|
|
[[ ! -L "$ENV_FILE" && ! -L "$HASH_FILE" ]] || die "Configuration files must not be symbolic links"
|
|
if [[ -e "$ENV_FILE" ]]; then
|
|
require_regular_root_file "$ENV_FILE"
|
|
backup_file "$ENV_FILE"
|
|
fi
|
|
if [[ -e "$HASH_FILE" ]]; then
|
|
require_regular_root_file "$HASH_FILE"
|
|
backup_file "$HASH_FILE"
|
|
fi
|
|
collect_user_configuration
|
|
require_regular_root_file "$ENV_FILE"
|
|
require_regular_root_file "$HASH_FILE"
|
|
|
|
# Parse only known dotenv keys. Never source a root-owned configuration file.
|
|
NEW_USERNAME="$(read_env_value NEW_USERNAME)"
|
|
SSH_PORT="$(read_env_value SSH_PORT)"
|
|
SSH_PUBLIC_KEY="$(read_env_value SSH_PUBLIC_KEY)"
|
|
PASSWORD_AUTH="$(read_env_value PASSWORD_AUTH)"
|
|
PASSWORDLESS_SUDO="$(read_env_value PASSWORDLESS_SUDO)"
|
|
MANAGE_UFW="$(read_env_value MANAGE_UFW)"
|
|
|
|
SSH_PORT="${SSH_PORT:-20202}"
|
|
PASSWORD_AUTH="${PASSWORD_AUTH:-no}"
|
|
PASSWORDLESS_SUDO="${PASSWORDLESS_SUDO:-no}"
|
|
MANAGE_UFW="${MANAGE_UFW:-no}"
|
|
NEW_PASSWORD_HASH="$(tr -d '\r\n' < "$HASH_FILE")"
|
|
|
|
[[ "$NEW_USERNAME" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || die "Invalid NEW_USERNAME"
|
|
[[ "$NEW_USERNAME" != root ]] || die "NEW_USERNAME must not be root"
|
|
if id "$NEW_USERNAME" >/dev/null 2>&1; then
|
|
existing_uid="$(id -u "$NEW_USERNAME")"
|
|
(( existing_uid >= 1000 && existing_uid != 65534 )) || die "Refusing to modify a system account: $NEW_USERNAME"
|
|
fi
|
|
[[ "$SSH_PORT" =~ ^[0-9]+$ ]] || die "SSH_PORT must be numeric"
|
|
(( 10#$SSH_PORT >= 1 && 10#$SSH_PORT <= 65535 )) || die "SSH_PORT must be between 1 and 65535"
|
|
validate_boolean PASSWORD_AUTH "$PASSWORD_AUTH"
|
|
validate_boolean PASSWORDLESS_SUDO "$PASSWORDLESS_SUDO"
|
|
validate_boolean MANAGE_UFW "$MANAGE_UFW"
|
|
[[ "$NEW_PASSWORD_HASH" == \$* && "$NEW_PASSWORD_HASH" != *:* ]] || die "Invalid password hash"
|
|
|
|
if [[ -z "$SSH_PUBLIC_KEY" ]]; then
|
|
die "SSH_PUBLIC_KEY is required; refusing to configure a password-only SSH account"
|
|
fi
|
|
|
|
log "Checking packages installed by step 2"
|
|
|
|
for command_name in sshd ssh-keygen visudo systemctl; do
|
|
require_command "$command_name"
|
|
done
|
|
|
|
key_check="$(mktemp)"
|
|
trap 'rm -f -- "${key_check:-}"' EXIT
|
|
chmod 600 "$key_check"
|
|
printf '%s\n' "$SSH_PUBLIC_KEY" > "$key_check"
|
|
ssh-keygen -l -f "$key_check" >/dev/null 2>&1 || die "SSH_PUBLIC_KEY is not a valid public key"
|
|
|
|
if id "$NEW_USERNAME" >/dev/null 2>&1; then
|
|
log "User $NEW_USERNAME already exists"
|
|
else
|
|
log "Creating user $NEW_USERNAME"
|
|
useradd --create-home --shell /bin/bash -- "$NEW_USERNAME"
|
|
fi
|
|
|
|
log "Setting password hash and sudo membership for $NEW_USERNAME"
|
|
printf '%s:%s\n' "$NEW_USERNAME" "$NEW_PASSWORD_HASH" | chpasswd -e
|
|
usermod -aG sudo -- "$NEW_USERNAME"
|
|
|
|
SUDOERS_FILE="/etc/sudoers.d/${NEW_USERNAME}"
|
|
backup_file "$SUDOERS_FILE"
|
|
if [[ "$PASSWORDLESS_SUDO" == yes ]]; then
|
|
printf '%s ALL=(ALL:ALL) NOPASSWD:ALL\n' "$NEW_USERNAME" > "$SUDOERS_FILE"
|
|
else
|
|
printf '%s ALL=(ALL:ALL) ALL\n' "$NEW_USERNAME" > "$SUDOERS_FILE"
|
|
fi
|
|
chmod 440 "$SUDOERS_FILE"
|
|
visudo -cf "$SUDOERS_FILE" >/dev/null || die "sudoers validation failed"
|
|
|
|
user_home="$(getent passwd "$NEW_USERNAME" | cut -d: -f6)"
|
|
user_group="$(id -gn "$NEW_USERNAME")"
|
|
[[ -n "$user_home" && "$user_home" == /* ]] || die "Could not determine user home"
|
|
[[ -d "$user_home" && ! -L "$user_home" ]] || die "User home is not a regular directory: $user_home"
|
|
|
|
# OpenSSH StrictModes rejects keys when the home directory, .ssh or
|
|
# authorized_keys has unsafe ownership or permissions. Repair all three on
|
|
# every run so an existing user can be fixed by running this script again.
|
|
chown "$NEW_USERNAME:$user_group" "$user_home"
|
|
chmod 750 "$user_home"
|
|
install -d -m 700 -o "$NEW_USERNAME" -g "$user_group" "$user_home/.ssh"
|
|
touch -- "$user_home/.ssh/authorized_keys"
|
|
chown "$NEW_USERNAME:$user_group" "$user_home/.ssh/authorized_keys"
|
|
chmod 600 "$user_home/.ssh/authorized_keys"
|
|
if ! grep -Fqx -- "$SSH_PUBLIC_KEY" "$user_home/.ssh/authorized_keys"; then
|
|
printf '%s\n' "$SSH_PUBLIC_KEY" >> "$user_home/.ssh/authorized_keys"
|
|
fi
|
|
|
|
if command -v restorecon >/dev/null 2>&1; then
|
|
restorecon -RF "$user_home/.ssh" || warn "SELinux context could not be restored"
|
|
fi
|
|
|
|
ssh-keygen -l -f "$user_home/.ssh/authorized_keys" >/dev/null 2>&1 || \
|
|
die "The installed authorized_keys file contains no valid SSH key"
|
|
log "Installed SSH key fingerprint: $(ssh-keygen -l -f "$user_home/.ssh/authorized_keys" | head -n1)"
|
|
|
|
log "Writing isolated SSH configuration"
|
|
install -d -m 755 /etc/ssh/sshd_config.d
|
|
backup_file "$SSHD_DROPIN"
|
|
cat > "$SSHD_DROPIN" <<EOF
|
|
# Managed by ochenstarik-server-3.sh
|
|
Port ${SSH_PORT}
|
|
PermitRootLogin no
|
|
PasswordAuthentication ${PASSWORD_AUTH}
|
|
PubkeyAuthentication yes
|
|
KbdInteractiveAuthentication no
|
|
ChallengeResponseAuthentication no
|
|
UsePAM yes
|
|
EOF
|
|
chmod 644 "$SSHD_DROPIN"
|
|
|
|
sshd -t || die "sshd syntax validation failed"
|
|
effective_port="$(sshd -T | awk '$1 == "port" { print $2; exit }')"
|
|
effective_root="$(sshd -T | awk '$1 == "permitrootlogin" { print $2; exit }')"
|
|
effective_password="$(sshd -T | awk '$1 == "passwordauthentication" { print $2; exit }')"
|
|
[[ "$effective_port" == "$SSH_PORT" ]] || die "Effective SSH port is $effective_port, expected $SSH_PORT"
|
|
[[ "$effective_root" == no ]] || die "Effective PermitRootLogin is $effective_root, expected no"
|
|
[[ "$effective_password" == "$PASSWORD_AUTH" ]] || die "Effective PasswordAuthentication is $effective_password, expected $PASSWORD_AUTH"
|
|
|
|
if [[ "$MANAGE_UFW" == yes ]]; then
|
|
log "Allowing SSH, HTTPS, and application ports in UFW without resetting existing rules"
|
|
ufw allow "${SSH_PORT}/tcp"
|
|
ufw allow "443/tcp"
|
|
ufw allow "63636/tcp"
|
|
ufw --force enable
|
|
else
|
|
warn "MANAGE_UFW=no: firewall was not enabled or modified"
|
|
fi
|
|
|
|
log "Configuring fail2ban without replacing existing jail.local"
|
|
install -d -m 755 /etc/fail2ban/jail.d
|
|
backup_file "$FAIL2BAN_JAIL"
|
|
cat > "$FAIL2BAN_JAIL" <<EOF
|
|
[sshd]
|
|
enabled = true
|
|
port = ${SSH_PORT}
|
|
bantime = 1h
|
|
findtime = 10m
|
|
maxretry = 5
|
|
EOF
|
|
fail2ban-client -t
|
|
systemctl enable --now fail2ban
|
|
systemctl restart fail2ban
|
|
|
|
log "Restarting SSH service"
|
|
SSH_SERVICE=""
|
|
for service_name in ssh sshd; do
|
|
if systemctl cat "$service_name" >/dev/null 2>&1; then
|
|
SSH_SERVICE="$service_name"
|
|
break
|
|
fi
|
|
done
|
|
[[ -n "$SSH_SERVICE" ]] || die "SSH systemd service not found"
|
|
systemctl restart "$SSH_SERVICE"
|
|
systemctl enable "$SSH_SERVICE" >/dev/null 2>&1 || true
|
|
|
|
systemctl is-active --quiet "$SSH_SERVICE" || die "SSH service is not active"
|
|
fail2ban-client status sshd || warn "fail2ban sshd status check failed"
|
|
|
|
printf '\nDone.\n'
|
|
printf 'New SSH port: %s\n' "$SSH_PORT"
|
|
printf 'Administrative user: %s\n' "$NEW_USERNAME"
|
|
printf 'Password SSH authentication: %s\n' "$PASSWORD_AUTH"
|
|
printf 'Passwordless sudo: %s\n' "$PASSWORDLESS_SUDO"
|
|
printf '\nOpen a NEW terminal and test before closing the current root session:\n'
|
|
printf 'ssh -p %s %s@<server-ip>\n' "$SSH_PORT" "$NEW_USERNAME"
|
|
printf 'After that login succeeds, remove the temporary port 22 rule: sudo ufw delete allow 22/tcp\n'
|
|
printf 'To enable Telegram login notifications, run ochenstarik-server-tg-4.sh.\n'
|