From 95311581a0c30740e196db10dad65fe5cc5921ab Mon Sep 17 00:00:00 2001 From: Tommy Date: Fri, 1 Dec 2023 23:14:27 -0700 Subject: [PATCH] Remove `sudo` Signed-off-by: Tommy --- Proxmox-8.sh | 80 ++++++++++++++++++++++++++-------------------------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/Proxmox-8.sh b/Proxmox-8.sh index eeab234..0304edc 100644 --- a/Proxmox-8.sh +++ b/Proxmox-8.sh @@ -21,25 +21,25 @@ output(){ } # Setup NTS -sudo rm -rf /etc/chrony/chrony.conf -curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf -sudo systemctl restart chronyd +rm -rf /etc/chrony/chrony.conf +curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | tee /etc/chrony/chrony.conf +systemctl restart chronyd # Harden SSH echo 'GSSAPIAuthentication no -VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf -sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf +VerifyHostKeyDNS yes' | tee /etc/ssh/ssh_config.d/10-custom.conf +chmod 644 /etc/ssh/ssh_config.d/10-custom.conf echo 'PasswordAuthentication no KerberosAuthentication no -GSSAPIAuthentication no' | sudo tee /etc/ssh/sshd_config.d/10-custom.conf -sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf -sudo mkdir -p /etc/systemd/system/ssh.service.d -curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/ssh.service.d/override.conf -sudo systemctl daemon-reload -sudo systemctl restart sshd +GSSAPIAuthentication no' | tee /etc/ssh/sshd_config.d/10-custom.conf +chmod 644 /etc/ssh/sshd_config.d/10-custom.conf +mkdir -p /etc/systemd/system/ssh.service.d +curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | tee /etc/systemd/system/ssh.service.d/override.conf +systemctl daemon-reload +systemctl restart sshd # Setup repositories -sudo sed -i '1 {s/^/#/}' /etc/apt/sources.list.d/pve-enterprise.list +sed -i '1 {s/^/#/}' /etc/apt/sources.list.d/pve-enterprise.list echo 'deb https://deb.debian.org/debian/ bookworm main contrib non-free non-free-firmware @@ -49,55 +49,55 @@ deb https://deb.debian.org/debian/ bookworm-updates main contrib non-free non-fr deb https://deb.debian.org/debian/ bookworm-backports main contrib non-free non-free-firmware -deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription' | sudo tee /etc/apt/sources.list +deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription' | tee /etc/apt/sources.list -echo 'deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription' | sudo tee /etc/apt/sources.list.d/ceph.list +echo 'deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription' | tee /etc/apt/sources.list.d/ceph.list # Update and install packages -sudo apt update -sudo apt upgrade -y -sudo apt install -y --no-install-recommends intel-microcode tuned fwupd dropbear-initramfs +apt update +apt upgrade -y +apt install -y --no-install-recommends intel-microcode tuned fwupd dropbear-initramfs ### This part assumes that you are using systemd-boot -sudo echo -e "spectre_v2=on spec_store_bypass_disable=on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force nosmt=force l1d_flush=on mmio_stale_data=full,nosmt random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=on efi=disable_early_pci_dma iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none page_alloc.shuffle=1 randomize_kstack_offset=on extra_latent_entropy debugfs=off $(cat /etc/kernel/cmdline)" > /etc/kernel/cmdline -sudo proxmox-boot-tool refresh +echo -e "spectre_v2=on spec_store_bypass_disable=on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force nosmt=force l1d_flush=on mmio_stale_data=full,nosmt random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=on efi=disable_early_pci_dma iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none page_alloc.shuffle=1 randomize_kstack_offset=on extra_latent_entropy debugfs=off $(cat /etc/kernel/cmdline)" > /etc/kernel/cmdline +proxmox-boot-tool refresh ### # Kernel hardening -curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | sudo tee /etc/modprobe.d/30_security-misc.conf -curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | sudo tee /etc/sysctl.d/990-security-misc.conf -sudo sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/990-security-misc.conf -sudo sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf -sudo sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf -curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | sudo tee /etc/sysctl.d/30_silent-kernel-printk.conf -curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | sudo tee /etc/sysctl.d/30_security-misc_kexec-disable.conf -sudo mkdir -p /etc/systemd/system/NetworkManager.service.d -curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf +curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | tee /etc/modprobe.d/30_security-misc.conf +curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | tee /etc/sysctl.d/990-security-misc.conf +sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/990-security-misc.conf +sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf +sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf +curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | tee /etc/sysctl.d/30_silent-kernel-printk.conf +curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | tee /etc/sysctl.d/30_security-misc_kexec-disable.conf +mkdir -p /etc/systemd/system/NetworkManager.service.d +curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf echo "* hard core 0" | tee -a /etc/security/limits.conf -sudo sed -i 's/#GSSAPIAuthentication no/GSSAPIAuthentication no/g' /etc/ssh/sshd_config +sed -i 's/#GSSAPIAuthentication no/GSSAPIAuthentication no/g' /etc/ssh/sshd_config # Setup automatic updates -sudo mkdir -p /etc/systemd/system/pve-daily-update.service.d +mkdir -p /etc/systemd/system/pve-daily-update.service.d echo '[Service] -ExecStart=/usr/bin/pveupgrade' | sudo tee /etc/systemd/system/pve-daily-update.service.d/override.conf -sudo systemctl daemon-reload -sudo systemctl enable --now pve-daily-update.timer +ExecStart=/usr/bin/pveupgrade' | tee /etc/systemd/system/pve-daily-update.service.d/override.conf +systemctl daemon-reload +systemctl enable --now pve-daily-update.timer -sudo mkdir -p /etc/systemd/system/fwupd-refresh.service.d +mkdir -p /etc/systemd/system/fwupd-refresh.service.d echo '[Service] ExecStart=/usr/bin/fwupdmgr update' | tee /etc/systemd/system/fwupd-refresh.service.d/override.conf -sudo systemctl daemon-reload -sudo systemctl enable --now fwupd-refresh.timer +systemctl daemon-reload +systemctl enable --now fwupd-refresh.timer # Disable Nagging -sudo sed -Ezi.bak "s/(Ext.Msg.show\(\{\s+title: gettext\('No valid sub)/void\(\{ \/\/\1/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js +sed -Ezi.bak "s/(Ext.Msg.show\(\{\s+title: gettext\('No valid sub)/void\(\{ \/\/\1/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js -sudo systemctl restart pveproxy.service +systemctl restart pveproxy.service # Setup tuned -sudo tuned-adm profile virtual-host +tuned-adm profile virtual-host # Enable fstrim.timer -sudo systemctl enable --now fstrim.timer \ No newline at end of file +systemctl enable --now fstrim.timer \ No newline at end of file