mirror of
https://github.com/tommytran732/Linux-Setup-Scripts
synced 2025-02-20 17:31:33 -05:00
Compare commits
No commits in common. "552d18820eabb528bae6a2accf48be37d208b9f7" and "db0046bc8b67c4a2136fcbc0cef1a9bd4fcad28a" have entirely different histories.
552d18820e
...
db0046bc8b
@ -39,8 +39,6 @@ install_options(){
|
||||
esac
|
||||
}
|
||||
|
||||
install_options
|
||||
|
||||
# Increase compression level
|
||||
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
||||
|
||||
@ -57,15 +55,11 @@ echo 'umask 077' | sudo tee -a /etc/bashrc
|
||||
sudo chmod 700 /home/*
|
||||
|
||||
# Setup NTS
|
||||
if [ "${parallels}" = "1" ]; then
|
||||
sudo dnf -y remove chrony
|
||||
else
|
||||
sudo rm -rf /etc/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
||||
sudo rm -rf /etc/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
||||
|
||||
sudo systemctl restart chronyd
|
||||
fi
|
||||
sudo systemctl restart chronyd
|
||||
|
||||
# Remove nullok
|
||||
sudo /usr/bin/sed -i 's/\s+nullok//g' /etc/pam.d/system-auth
|
||||
@ -88,6 +82,8 @@ sudo chmod 644 /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
||||
sudo dracut -f
|
||||
sudo sysctl -p
|
||||
|
||||
install_options
|
||||
|
||||
if [ -d /boot/loader ]; then
|
||||
if [ "${parallels}" = "1" ]; then
|
||||
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off root/g' /etc/kernel/cmdline
|
||||
@ -142,31 +138,31 @@ sudo dnf -y remove fedora-bookmarks fedora-chromium-config firefox mozilla-files
|
||||
# Remove Network + hardware tools packages
|
||||
sudo dnf -y remove '*cups' nmap-ncat nfs-utils nmap-ncat openssh-server net-snmp-libs net-tools opensc traceroute rsync tcpdump teamd geolite2* mtr dmidecode sgpio
|
||||
|
||||
# Remove support for some languages and spelling
|
||||
#Remove support for some languages and spelling
|
||||
sudo dnf -y remove ibus-typing-booster '*speech*' '*zhuyin*' '*pinyin*' '*m17n*' '*hangul*' '*anthy*' words
|
||||
|
||||
# Remove codec + image + printers
|
||||
#Remove codec + image + printers
|
||||
sudo dnf -y remove openh264 ImageMagick* sane* simple-scan
|
||||
|
||||
# Remove Active Directory + Sysadmin + reporting tools
|
||||
#Remove Active Directory + Sysadmin + reporting tools
|
||||
sudo dnf -y remove 'sssd*' realmd cyrus-sasl-gssapi quota* dos2unix kpartx sos samba-client gvfs-smb
|
||||
|
||||
# Remove vm and virtual stuff
|
||||
#Remove vm and virtual stuff
|
||||
sudo dnf -y remove 'podman*' '*libvirt*' 'open-vm*' qemu-guest-agent 'hyperv*' spice-vdagent virtualbox-guest-additions vino xorg-x11-drv-vmware xorg-x11-drv-amdgpu
|
||||
|
||||
# Remove NetworkManager
|
||||
#Remove NetworkManager
|
||||
sudo dnf -y remove NetworkManager-pptp-gnome NetworkManager-ssh-gnome NetworkManager-openconnect-gnome NetworkManager-openvpn-gnome NetworkManager-vpnc-gnome ppp* ModemManager
|
||||
|
||||
# Remove Gnome apps
|
||||
#Remove Gnome apps
|
||||
sudo dnf remove -y chrome-gnome-shell eog gnome-photos gnome-connections gnome-tour gnome-themes-extra gnome-screenshot gnome-remote-desktop gnome-font-viewer gnome-calculator gnome-calendar gnome-contacts \
|
||||
gnome-maps gnome-weather gnome-logs gnome-boxes gnome-disk-utility gnome-clocks gnome-color-manager gnome-characters baobab totem \
|
||||
gnome-shell-extension-background-logo gnome-shell-extension-apps-menu gnome-shell-extension-launch-new-instance gnome-shell-extension-places-menu gnome-shell-extension-window-list \
|
||||
gnome-classic* gnome-user* gnome-text-editor loupe snapshot
|
||||
|
||||
# Remove apps
|
||||
#Remove apps
|
||||
sudo dnf remove -y rhythmbox yelp evince libreoffice* cheese file-roller* mediawriter
|
||||
|
||||
# Remove other packages
|
||||
#Remove other packages
|
||||
sudo dnf remove -y lvm2 rng-tools thermald '*perl*' yajl
|
||||
|
||||
# Disable openh264 repo
|
||||
|
||||
@ -23,39 +23,12 @@ unpriv(){
|
||||
sudo -u nobody "$@"
|
||||
}
|
||||
|
||||
install_options(){
|
||||
output "Are you using a Parallels Virtual Machine?"
|
||||
output "[1] Yes"
|
||||
output "[2] No"
|
||||
read -r choice
|
||||
case $choice in
|
||||
1 ) parallels=1
|
||||
;;
|
||||
2 ) parallels=0
|
||||
;;
|
||||
* ) output "You did not enter a valid selection."
|
||||
install_options
|
||||
esac
|
||||
}
|
||||
|
||||
install_options
|
||||
|
||||
# Update Kali
|
||||
sudo apt full-upgrade -y
|
||||
|
||||
# Install all tools
|
||||
sudo apt install kali-linux-everything -y
|
||||
|
||||
# Setup NTS
|
||||
sudo systemctl disable --now systemd-timesyncd
|
||||
sudo systemctl mask systemd-timesyncd
|
||||
|
||||
if [ "${parallels}" = "0" ]; then
|
||||
sudo apt install -y chrony
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||
sudo systemctl restart chronyd
|
||||
fi
|
||||
|
||||
# Kernel hardening
|
||||
unpriv curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | sudo tee /etc/modprobe.d/30_security-misc.conf
|
||||
sudo chmod 644 /etc/modprobe.d/30_security-misc.conf
|
||||
|
||||
@ -47,7 +47,6 @@ sudo chmod 700 /home/*
|
||||
|
||||
# Setup NTS
|
||||
sudo systemctl disable --now systemd-timesyncd
|
||||
sudo systemctl mask systemd-timesyncd
|
||||
sudo apt install -y chrony
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||
sudo systemctl restart chronyd
|
||||
|
||||
@ -24,23 +24,6 @@ unpriv(){
|
||||
sudo -u nobody "$@"
|
||||
}
|
||||
|
||||
install_options(){
|
||||
output "Are you using a Parallels Virtual Machine?"
|
||||
output "[1] Yes"
|
||||
output "[2] No"
|
||||
read -r choice
|
||||
case $choice in
|
||||
1 ) parallels=1
|
||||
;;
|
||||
2 ) parallels=0
|
||||
;;
|
||||
* ) output "You did not enter a valid selection."
|
||||
install_options
|
||||
esac
|
||||
}
|
||||
|
||||
install_options
|
||||
|
||||
# Compliance and updates
|
||||
sudo systemctl mask debug-shell.service
|
||||
|
||||
@ -64,14 +47,10 @@ sudo sed -i 's/USERGROUPS_ENAB yes/USERGROUPS_ENAB no/g' /etc/login.defs
|
||||
echo 'umask 077' | sudo tee --append /etc/profile
|
||||
|
||||
# Setup NTS
|
||||
sudo systemctl disable --now systemd-timesyncd
|
||||
sudo systemctl mask systemd-timesyncd
|
||||
|
||||
if [ "${parallels}" = "0" ]; then
|
||||
sudo apt install -y chrony
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||
sudo systemctl restart chronyd
|
||||
fi
|
||||
sudo systemctl disable systemd-timesyncd
|
||||
sudo apt install -y chrony
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||
sudo systemctl restart chronyd
|
||||
|
||||
# Harden SSH
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
|
||||
Loading…
Reference in New Issue
Block a user