mirror of
https://github.com/tommytran732/Linux-Setup-Scripts
synced 2024-11-22 09:31:34 -05:00
Compare commits
2 Commits
d0819bbcb1
...
6cdbe919f9
Author | SHA1 | Date | |
---|---|---|---|
6cdbe919f9 | |||
0d7dc2817f |
@ -39,8 +39,7 @@ sudo chmod 700 /home/*
|
||||
# Setup NTS
|
||||
sudo rm -rf /etc/chrony/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||
echo '# Command-line options for chronyd
|
||||
OPTIONS="-F 1"' | sudo tee /etc/sysconfig/chronyd
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
||||
|
||||
sudo systemctl restart chronyd
|
||||
|
||||
@ -56,8 +55,7 @@ sudo firewall-cmd --reload
|
||||
sudo firewall-cmd --lockdown-on
|
||||
|
||||
# Harden SSH
|
||||
echo 'GSSAPIAuthentication no' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
echo 'VerifyHostKeyDNS yes' | sudo tee -a /etc/ssh/ssh_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
|
||||
# Security kernel settings
|
||||
|
@ -50,11 +50,10 @@ sudo ufw enable
|
||||
sudo ufw allow OpenSSH
|
||||
|
||||
# Harden SSH
|
||||
echo 'GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo mkdir -p /etc/systemd/system/ssh.service.d
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/ssh.service.d/override.conf
|
||||
sudo systemctl daemon-reload
|
||||
|
@ -33,13 +33,10 @@ curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.con
|
||||
systemctl restart chronyd
|
||||
|
||||
# Harden SSH
|
||||
echo 'GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes' | tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
echo 'PasswordAuthentication no
|
||||
KerberosAuthentication no
|
||||
GSSAPIAuthentication no' | tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
|
||||
curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
mkdir -p /etc/systemd/system/ssh.service.d
|
||||
curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | tee /etc/systemd/system/ssh.service.d/override.conf
|
||||
systemctl daemon-reload
|
||||
|
@ -27,10 +27,8 @@ sudo systemctl mask debug-shell.service
|
||||
sudo systemctl mask kdump.service
|
||||
|
||||
# Setup NTS
|
||||
sudo curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf -o /etc/chrony.conf
|
||||
|
||||
echo '# Command-line options for chronyd
|
||||
OPTIONS="-F 1"' | sudo tee /etc/sysconfig/chronyd
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
||||
|
||||
sudo systemctl restart chronyd
|
||||
|
||||
@ -44,12 +42,10 @@ sudo firewall-cmd --reload
|
||||
sudo firewall-cmd --lockdown-on
|
||||
|
||||
# Harden SSH
|
||||
mkdir -p /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
|
||||
echo 'GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/sshd.service.d/override.conf
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl restart sshd
|
||||
|
@ -59,11 +59,10 @@ sudo ufw enable
|
||||
sudo ufw allow SSH
|
||||
|
||||
# Harden SSH
|
||||
echo 'GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes' | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo mkdir -p /etc/systemd/system/ssh.service.d
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/ssh.service.d/override.conf
|
||||
sudo systemctl daemon-reload
|
||||
|
@ -66,8 +66,7 @@ sudo snap install ufw
|
||||
sudo ufw enable
|
||||
|
||||
# Harden SSH
|
||||
echo 'GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes' | sudo tee -a /etc/ssh/ssh_config.d/10-custom.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||
|
||||
# Kernel hardening
|
||||
|
2
etc/ssh/ssh_config.d/10-custom.conf
Normal file
2
etc/ssh/ssh_config.d/10-custom.conf
Normal file
@ -0,0 +1,2 @@
|
||||
GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes
|
2
etc/sysconfig/chronyd
Normal file
2
etc/sysconfig/chronyd
Normal file
@ -0,0 +1,2 @@
|
||||
# Command-line options for chronyd
|
||||
OPTIONS="-F 1"
|
Loading…
Reference in New Issue
Block a user