mirror of
https://github.com/tommytran732/Linux-Setup-Scripts
synced 2024-11-22 09:31:34 -05:00
Better handling for Parallels
Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
parent
db0046bc8b
commit
59fb5c611b
@ -39,6 +39,8 @@ install_options(){
|
|||||||
esac
|
esac
|
||||||
}
|
}
|
||||||
|
|
||||||
|
install_options
|
||||||
|
|
||||||
# Increase compression level
|
# Increase compression level
|
||||||
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
||||||
|
|
||||||
@ -55,11 +57,15 @@ echo 'umask 077' | sudo tee -a /etc/bashrc
|
|||||||
sudo chmod 700 /home/*
|
sudo chmod 700 /home/*
|
||||||
|
|
||||||
# Setup NTS
|
# Setup NTS
|
||||||
|
if [ "${parallels}" = "1" ]; then
|
||||||
|
sudo dnf -y remove chrony
|
||||||
|
else
|
||||||
sudo rm -rf /etc/chrony.conf
|
sudo rm -rf /etc/chrony.conf
|
||||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
|
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
|
||||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
||||||
|
|
||||||
sudo systemctl restart chronyd
|
sudo systemctl restart chronyd
|
||||||
|
fi
|
||||||
|
|
||||||
# Remove nullok
|
# Remove nullok
|
||||||
sudo /usr/bin/sed -i 's/\s+nullok//g' /etc/pam.d/system-auth
|
sudo /usr/bin/sed -i 's/\s+nullok//g' /etc/pam.d/system-auth
|
||||||
@ -82,8 +88,6 @@ sudo chmod 644 /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
|||||||
sudo dracut -f
|
sudo dracut -f
|
||||||
sudo sysctl -p
|
sudo sysctl -p
|
||||||
|
|
||||||
install_options
|
|
||||||
|
|
||||||
if [ -d /boot/loader ]; then
|
if [ -d /boot/loader ]; then
|
||||||
if [ "${parallels}" = "1" ]; then
|
if [ "${parallels}" = "1" ]; then
|
||||||
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off root/g' /etc/kernel/cmdline
|
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off root/g' /etc/kernel/cmdline
|
||||||
|
@ -23,12 +23,38 @@ unpriv(){
|
|||||||
sudo -u nobody "$@"
|
sudo -u nobody "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
install_options(){
|
||||||
|
output "Are you using a Parallels Virtual Machine?"
|
||||||
|
output "[1] Yes"
|
||||||
|
output "[2] No"
|
||||||
|
read -r choice
|
||||||
|
case $choice in
|
||||||
|
1 ) parallels=1
|
||||||
|
;;
|
||||||
|
2 ) parallels=0
|
||||||
|
;;
|
||||||
|
* ) output "You did not enter a valid selection."
|
||||||
|
install_options
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
install_options
|
||||||
|
|
||||||
# Update Kali
|
# Update Kali
|
||||||
sudo apt full-upgrade -y
|
sudo apt full-upgrade -y
|
||||||
|
|
||||||
# Install all tools
|
# Install all tools
|
||||||
sudo apt install kali-linux-everything -y
|
sudo apt install kali-linux-everything -y
|
||||||
|
|
||||||
|
# Setup NTS
|
||||||
|
sudo systemctl mask systemd-timesyncd
|
||||||
|
|
||||||
|
if [ "${parallels}" = "0" ]; then
|
||||||
|
sudo apt install -y chrony
|
||||||
|
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||||
|
sudo systemctl restart chronyd
|
||||||
|
fi
|
||||||
|
|
||||||
# Kernel hardening
|
# Kernel hardening
|
||||||
unpriv curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | sudo tee /etc/modprobe.d/30_security-misc.conf
|
unpriv curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | sudo tee /etc/modprobe.d/30_security-misc.conf
|
||||||
sudo chmod 644 /etc/modprobe.d/30_security-misc.conf
|
sudo chmod 644 /etc/modprobe.d/30_security-misc.conf
|
||||||
|
@ -24,6 +24,23 @@ unpriv(){
|
|||||||
sudo -u nobody "$@"
|
sudo -u nobody "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
install_options(){
|
||||||
|
output "Are you using a Parallels Virtual Machine?"
|
||||||
|
output "[1] Yes"
|
||||||
|
output "[2] No"
|
||||||
|
read -r choice
|
||||||
|
case $choice in
|
||||||
|
1 ) parallels=1
|
||||||
|
;;
|
||||||
|
2 ) parallels=0
|
||||||
|
;;
|
||||||
|
* ) output "You did not enter a valid selection."
|
||||||
|
install_options
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
install_options
|
||||||
|
|
||||||
# Compliance and updates
|
# Compliance and updates
|
||||||
sudo systemctl mask debug-shell.service
|
sudo systemctl mask debug-shell.service
|
||||||
|
|
||||||
@ -47,10 +64,13 @@ sudo sed -i 's/USERGROUPS_ENAB yes/USERGROUPS_ENAB no/g' /etc/login.defs
|
|||||||
echo 'umask 077' | sudo tee --append /etc/profile
|
echo 'umask 077' | sudo tee --append /etc/profile
|
||||||
|
|
||||||
# Setup NTS
|
# Setup NTS
|
||||||
sudo systemctl disable systemd-timesyncd
|
sudo systemctl mask systemd-timesyncd
|
||||||
|
|
||||||
|
if [ "${parallels}" = "0" ]; then
|
||||||
sudo apt install -y chrony
|
sudo apt install -y chrony
|
||||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||||
sudo systemctl restart chronyd
|
sudo systemctl restart chronyd
|
||||||
|
fi
|
||||||
|
|
||||||
# Harden SSH
|
# Harden SSH
|
||||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||||
|
Loading…
Reference in New Issue
Block a user