From 77e2443f9972bc7ffd5e7c4f5cd632726af04836 Mon Sep 17 00:00:00 2001
From: Tommy <contact@tommytran.io>
Date: Tue, 4 Jul 2023 01:24:28 -0700
Subject: [PATCH] Create Ubuntu-22.04-Server.sh

Signed-off-by: Tommy <contact@tommytran.io>
---
 Ubuntu-22.04-Server.sh | 45 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 Ubuntu-22.04-Server.sh

diff --git a/Ubuntu-22.04-Server.sh b/Ubuntu-22.04-Server.sh
new file mode 100644
index 0000000..9fc4f82
--- /dev/null
+++ b/Ubuntu-22.04-Server.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+#Meant to be run on Ubuntu Pro Minimal 
+
+#Security kernel settings
+sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf -o /etc/modprobe.d/30_security-misc.conf
+sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_security-misc.conf -o /etc/sysctl.d/30_security-misc.conf
+sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_silent-kernel-printk.conf -o /etc/sysctl.d/30_silent-kernel-printk.conf
+sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_security-misc_kexec-disable.conf -o /etc/sysctl.d/30_security-misc_kexec-disable.conf
+
+echo "GSSAPIAuthentication no" | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
+echo "VerifyHostKeyDNS yes" | sudo tee -a /etc/ssh/ssh_config.d/10-custom.conf
+sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
+
+#Setup NTS
+sudo systemctl disable systemd-timesyncd
+sudo apt install -y chrony
+rm -rf /etc/chrony/chrony.conf
+sudo curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf -o /etc/chrony/chrony.conf
+sudo systemctl restart chronyd
+
+#Setup UFW
+#UFW Snap is strictly confined, unlike its .deb counterpart
+sudo apt purge -y ufw
+sudo snap install ufw
+sudo ufw enable
+sudo ufw allow 22
+
+sudo systemctl stop apport.service
+sudo systemctl disable apport.service
+sudo systemctl mask apport.service
+sudo systemctl stop whoopsie.service
+sudo systemctl disable whoopsie.service
+sudo systemctl mask whoopsie.service
+
+#Update packages and firmware
+sudo apt update -y
+sudo apt full-upgrade -y
+sudo apt install fwupd
+
+mkdir -p /etc/systemd/system/fwupd-refresh.service.d
+echo '[Service]
+ExecStart=ExecStart=/usr/bin/fwupdmgr update' | tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
+systemctl daemon-reload
+systemctl enable --now fwupd-refresh.timer