diff --git a/Fedora-Workstation-39.sh b/Fedora-Workstation-39.sh index 3525daf..5ace1fd 100644 --- a/Fedora-Workstation-39.sh +++ b/Fedora-Workstation-39.sh @@ -55,8 +55,7 @@ sudo firewall-cmd --reload sudo firewall-cmd --lockdown-on # Harden SSH -echo 'GSSAPIAuthentication no' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf -echo 'VerifyHostKeyDNS yes' | sudo tee -a /etc/ssh/ssh_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf # Security kernel settings diff --git a/GCP-Debian-11.sh b/GCP-Debian-11.sh index 9fc0fdd..a112508 100644 --- a/GCP-Debian-11.sh +++ b/GCP-Debian-11.sh @@ -50,11 +50,10 @@ sudo ufw enable sudo ufw allow OpenSSH # Harden SSH -echo 'GSSAPIAuthentication no -VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf -sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf -unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf +sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf sudo mkdir -p /etc/systemd/system/ssh.service.d unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/ssh.service.d/override.conf sudo systemctl daemon-reload diff --git a/Proxmox-8.sh b/Proxmox-8.sh index 0a15070..0ec216a 100644 --- a/Proxmox-8.sh +++ b/Proxmox-8.sh @@ -33,13 +33,10 @@ curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.con systemctl restart chronyd # Harden SSH -echo 'GSSAPIAuthentication no -VerifyHostKeyDNS yes' | tee /etc/ssh/ssh_config.d/10-custom.conf -chmod 644 /etc/ssh/ssh_config.d/10-custom.conf -echo 'PasswordAuthentication no -KerberosAuthentication no -GSSAPIAuthentication no' | tee /etc/ssh/sshd_config.d/10-custom.conf +curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | tee /etc/ssh/sshd_config.d/10-custom.conf chmod 644 /etc/ssh/sshd_config.d/10-custom.conf +curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /etc/ssh/ssh_config.d/10-custom.conf +chmod 644 /etc/ssh/ssh_config.d/10-custom.conf mkdir -p /etc/systemd/system/ssh.service.d curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | tee /etc/systemd/system/ssh.service.d/override.conf systemctl daemon-reload diff --git a/RHEL-Server-9.sh b/RHEL-Server-9.sh index 442c80d..23e459e 100644 --- a/RHEL-Server-9.sh +++ b/RHEL-Server-9.sh @@ -42,12 +42,10 @@ sudo firewall-cmd --reload sudo firewall-cmd --lockdown-on # Harden SSH -mkdir -p /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d -echo 'GSSAPIAuthentication no -VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf -sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf -unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf +sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/sshd.service.d/override.conf sudo systemctl daemon-reload sudo systemctl restart sshd diff --git a/Ubuntu-22.04-Server.sh b/Ubuntu-22.04-Server.sh index 84ef5d3..2b76784 100644 --- a/Ubuntu-22.04-Server.sh +++ b/Ubuntu-22.04-Server.sh @@ -59,11 +59,10 @@ sudo ufw enable sudo ufw allow SSH # Harden SSH -echo 'GSSAPIAuthentication no -VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf -sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf -unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf +sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf sudo mkdir -p /etc/systemd/system/ssh.service.d unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/ssh.service.d/override.conf sudo systemctl daemon-reload diff --git a/Ubuntu-23.10-Desktop.sh b/Ubuntu-23.10-Desktop.sh index ef21fb1..a00997d 100644 --- a/Ubuntu-23.10-Desktop.sh +++ b/Ubuntu-23.10-Desktop.sh @@ -66,8 +66,7 @@ sudo snap install ufw sudo ufw enable # Harden SSH -echo 'GSSAPIAuthentication no -VerifyHostKeyDNS yes' | sudo tee -a /etc/ssh/ssh_config.d/10-custom.conf +unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf # Kernel hardening diff --git a/etc/ssh/ssh_config.d/10-custom.conf b/etc/ssh/ssh_config.d/10-custom.conf new file mode 100644 index 0000000..9ee0fd6 --- /dev/null +++ b/etc/ssh/ssh_config.d/10-custom.conf @@ -0,0 +1,2 @@ +GSSAPIAuthentication no +VerifyHostKeyDNS yes \ No newline at end of file diff --git a/etc/ssh/sshd_config/10-custom.conf b/etc/ssh/sshd_config.d/10-custom.conf similarity index 100% rename from etc/ssh/sshd_config/10-custom.conf rename to etc/ssh/sshd_config.d/10-custom.conf