1
0
mirror of https://github.com/tommytran732/Linux-Setup-Scripts synced 2024-11-09 11:41:33 -05:00

Compare commits

..

2 Commits

Author SHA1 Message Date
3ff024e21b
Make sample script also POSIX compliant
Signed-off-by: Tommy <contact@tommytran.io>
2024-06-26 00:12:29 -07:00
e3104f037f
POSIX Compliance
Signed-off-by: Tommy <contact@tommytran.io>
2024-06-25 22:24:45 -07:00
9 changed files with 82 additions and 71 deletions

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2021-2024 Thien Tran # Copyright (C) 2021-2024 Thien Tran
# #
@ -17,7 +17,7 @@
#Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead #Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
unpriv(){ unpriv(){
@ -128,7 +128,7 @@ sudo sed -i 's; interface: 242.242.0.1;# interface: 242.242.0.1;g' /etc/unboun
sudo sed -i 's; access-control: 242.242.0.0/16 allow;# access-control: 242.242.0.0/16 allow;g' /etc/unbound/unbound.conf sudo sed -i 's; access-control: 242.242.0.0/16 allow;# access-control: 242.242.0.0/16 allow;g' /etc/unbound/unbound.conf
sudo chmod 644 /etc/unbound/unbound.conf sudo chmod 644 /etc/unbound/unbound.conf
sudo mkdir /etc/systemd/system/unbound.service.d sudo mkdir /etc/systemd/system/unbound.service.d
unpriv curl https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf | sudo tee /etc/systemd/system/unbound.service.d/override.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/unbound.service.d/override.conf | sudo tee /etc/systemd/system/unbound.service.d/override.conf
sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
sudo systemctl enable --now unbound sudo systemctl enable --now unbound
sudo systemctl disable systemd-resolved sudo systemctl disable systemd-resolved

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2021-2024 Thien Tran # Copyright (C) 2021-2024 Thien Tran
# #
@ -17,7 +17,7 @@
#Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead #Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
unpriv(){ unpriv(){
@ -198,7 +198,7 @@ flatpak update -y
# Install Microsoft Edge if x86_64 # Install Microsoft Edge if x86_64
MACHINE_TYPE=$(uname -m) MACHINE_TYPE=$(uname -m)
if [ "${MACHINE_TYPE}" == 'x86_64' ]; then if [ "${MACHINE_TYPE}" = 'x86_64' ]; then
output 'x86_64 machine, installing Microsoft Edge.' output 'x86_64 machine, installing Microsoft Edge.'
echo '[microsoft-edge] echo '[microsoft-edge]
name=microsoft-edge name=microsoft-edge

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2021-2024 Thien Tran # Copyright (C) 2021-2024 Thien Tran
# #
@ -17,7 +17,7 @@
# You need to add either the non-subscription repo or the testing repo from the Proxmox WebUI after running this script. # You need to add either the non-subscription repo or the testing repo from the Proxmox WebUI after running this script.
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
# Compliance and updates # Compliance and updates
@ -65,7 +65,7 @@ apt autoremove -y
apt install -y intel-microcode tuned fwupd dropbear-initramfs apt install -y intel-microcode tuned fwupd dropbear-initramfs
### This part assumes that you are using systemd-boot ### This part assumes that you are using systemd-boot
echo -e "mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off $(cat /etc/kernel/cmdline)" > /etc/kernel/cmdline echo "mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off $(cat /etc/kernel/cmdline)" > /etc/kernel/cmdline
proxmox-boot-tool refresh proxmox-boot-tool refresh
### ###

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2021-2024 Thien Tran # Copyright (C) 2021-2024 Thien Tran
# #
@ -15,7 +15,7 @@
# the License. # the License.
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
unpriv(){ unpriv(){
@ -145,25 +145,7 @@ forward-zone:
sudo chmod 644 /etc/unbound/unbound.conf sudo chmod 644 /etc/unbound/unbound.conf
sudo mkdir -p /etc/systemd/system/unbound.service.d sudo mkdir -p /etc/systemd/system/unbound.service.d
echo $'[Service] unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/unbound.service.d/override.conf | sudo tee /etc/systemd/system/unbound.service.d/override.conf
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like \'so-rcvbuf\'. Explicitly disable for visibility.
ProtectKernelTunables=true
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes' | sudo tee /etc/systemd/system/unbound.service.d/override.conf
sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
sudo systemctl enable --now unbound sudo systemctl enable --now unbound

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2021-2024 Thien Tran # Copyright (C) 2021-2024 Thien Tran
# #
@ -17,7 +17,7 @@
#Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead #Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
unpriv(){ unpriv(){
@ -177,7 +177,7 @@ fi
# Install Microsoft Edge if x86_64 # Install Microsoft Edge if x86_64
MACHINE_TYPE=$(uname -m) MACHINE_TYPE=$(uname -m)
if [ "${MACHINE_TYPE}" == 'x86_64' ] || [ -f /media/psf/RosettaLinux/rosetta ] || [ -f /media/rosetta/rosetta ]; then if [ "${MACHINE_TYPE}" = 'x86_64' ] || [ -f /media/psf/RosettaLinux/rosetta ] || [ -f /media/rosetta/rosetta ]; then
output 'x86_64 machine, installing Microsoft Edge.' output 'x86_64 machine, installing Microsoft Edge.'
unpriv curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /usr/share/keyrings/microsoft.gpg unpriv curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /usr/share/keyrings/microsoft.gpg
chmod 644 /usr/share/keyrings/microsoft.gpg chmod 644 /usr/share/keyrings/microsoft.gpg

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2021-2024 Thien Tran # Copyright (C) 2021-2024 Thien Tran
# #
@ -17,7 +17,7 @@
#Meant to be run on Ubuntu Pro Minimal #Meant to be run on Ubuntu Pro Minimal
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
unpriv(){ unpriv(){
@ -176,38 +176,8 @@ forward-zone:
sudo chmod 644 /etc/unbound/unbound.conf.d/custom.conf sudo chmod 644 /etc/unbound/unbound.conf.d/custom.conf
mkdir -p /etc/systemd/system/unbound.service.d sudo mkdir -p /etc/systemd/system/unbound.service.d
echo $'[Service] unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/unbound.service.d/override-chroot.conf | sudo tee /etc/systemd/system/unbound.service.d/override.conf
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like \'so-rcvbuf\'. Explicitly disable for visibility.
ProtectKernelTunables=false
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes
ReadWritePaths=@UNBOUND_RUN_DIR@ @UNBOUND_CHROOT_DIR@
# Below rules are needed when chroot is enabled (usually it\'s enabled by default).
# If chroot is disabled like chroot: "" then they may be safely removed.
TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/dev:ro
TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/run:ro
BindReadOnlyPaths=-/run/systemd/notify:@UNBOUND_CHROOT_DIR@/run/systemd/notify
BindReadOnlyPaths=-/dev/urandom:@UNBOUND_CHROOT_DIR@/dev/urandom
BindPaths=-/dev/log:@UNBOUND_CHROOT_DIR@/dev/log' | sudo tee /etc/systemd/system/unbound.service.d/override.conf
sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
sudo systemctl daemon-reload sudo systemctl daemon-reload

View File

@ -0,0 +1,34 @@
[Service]
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility.
ProtectKernelTunables=false
ProtectProc=invisible
#ProtectSystem=strict
#RuntimeDirectory=unbound
#ConfigurationDirectory=unbound
#StateDirectory=unbound
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes
ReadWritePaths=@UNBOUND_RUN_DIR@ @UNBOUND_CHROOT_DIR@
# Below rules are needed when chroot is enabled (usually it's enabled by default).
# If chroot is disabled like chroot: "" then they may be safely removed.
TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/dev:ro
TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/run:ro
BindReadOnlyPaths=-/run/systemd/notify:@UNBOUND_CHROOT_DIR@/run/systemd/notify
BindReadOnlyPaths=-/dev/urandom:@UNBOUND_CHROOT_DIR@/dev/urandom
BindPaths=-/dev/log:@UNBOUND_CHROOT_DIR@/dev/log

View File

@ -0,0 +1,25 @@
[Service]
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_DAC_OVERRIDE
MemoryDenyWriteExecute=true
#NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'.
ProtectKernelTunables=true
ProtectProc=invisible
#ProtectSystem=strict
#RuntimeDirectory=unbound
#ConfigurationDirectory=unbound
#StateDirectory=unbound
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes

View File

@ -1,4 +1,4 @@
#!/bin/bash #!/bin/sh
# Copyright (C) 2024 Thien Tran # Copyright (C) 2024 Thien Tran
# #
@ -17,7 +17,7 @@
# Assumes that it is run AFTER https://github.com/TommyTran732/Linux-Setup-Scripts/blob/main/Ubuntu-24.04-Server.sh # Assumes that it is run AFTER https://github.com/TommyTran732/Linux-Setup-Scripts/blob/main/Ubuntu-24.04-Server.sh
output(){ output(){
echo -e '\e[36m'"$1"'\e[0m'; printf '\e[1;34m%-6s\e[m\n' "${@}"
} }
unpriv(){ unpriv(){