Tomster/QubesOS-Scripts
1
0
Fork 0
mirror of https://github.com/tommytran732/QubesOS-Scripts synced 2024-11-12 13:31:32 -05:00
Code

Compare commits

base: Tomster:a396385df18243ca1a2a65105318deea76c4f750
Branches Tags
Tomster:main
..
compare: Tomster:1bb5faff81ddceaa508963e26d811e0e98d94c8a
Branches Tags
Tomster:main

No commits in common. "a396385df18243ca1a2a65105318deea76c4f750" and "1bb5faff81ddceaa508963e26d811e0e98d94c8a" have entirely different histories.
a396385df1 ... 1bb5faff81

5 changed files with 7 additions and 42 deletions
Show Stats Expand all files Collapse all files

10
debian-gnome/debian-gnome.sh
View File

@ -22,15 +22,9 @@ unpriv(){
sudo systemctl mask debug-shell.service sudo systemctl mask debug-shell.service
# Setting umask to 077 # Setting umask to 077
# Does not actually work for some reason - need to check
umask 077 umask 077
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs #This line is broken on the Debian templates for some reason - further debugging needed.
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs echo 'umask 077' | sudo tee -a /etc/bash.bashrc
sudo sed -i 's/^USERGROUPS_ENAB.*/USERGROUPS_ENAB no/g' /etc/login.defs
sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
# Make home directory private
sudo chmod 700 /home/*
# Harden SSH # Harden SSH
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf

8
fedora-gnome/fedora-gnome.sh
View File

@ -15,7 +15,7 @@
# the License. # the License.
unpriv(){ unpriv(){
sudo -u nobody "$@" sudo -u nobody "$@"
} }
# Compliance # Compliance
@ -24,10 +24,8 @@ sudo systemctl mask kdump.service
# Setting umask to 077 # Setting umask to 077
umask 077 umask 077
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs
sudo sed -i 's/^USERGROUPS_ENAB.*/USERGROUPS_ENAB no/g' /etc/login.defs
sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
echo 'umask 077' | sudo tee -a /etc/bashrc
# Make home directory private # Make home directory private
sudo chmod 700 /home/* sudo chmod 700 /home/*
@ -119,7 +117,7 @@ sudo dnf remove -y baobab chrome-gnome-shell eog gnome-boxes gnome-calculator gn
gnome-themes-extra gnome-tour gnome-user* gnome-weather loupe snapshot totem gnome-themes-extra gnome-tour gnome-user* gnome-weather loupe snapshot totem
# Remove apps # Remove apps
sudo dnf remove -y abrt cheese evince file-roller* libreoffice* mediawriter rhythmbox yelp sudo dnf remove -y cheese evince file-roller* libreoffice* mediawriter rhythmbox yelp
# Remove other packages # Remove other packages
# We deviate from the script in TommyTran732/Linux-Setup-Scripts here, as removing yajl will break qubes integration. # We deviate from the script in TommyTran732/Linux-Setup-Scripts here, as removing yajl will break qubes integration.

9
fedora-minimal/fedora-minimal.sh
View File

@ -24,13 +24,8 @@ systemctl mask kdump.service
# Setting umask to 077 # Setting umask to 077
umask 077 umask 077
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs sed -i 's/umask 022/umask 077/g' /etc/bashrc
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs echo 'umask 077' | tee -a /etc/bashrc
sudo sed -i 's/^USERGROUPS_ENAB.*/USERGROUPS_ENAB no/g' /etc/login.defs
sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
# Make home directory private
sudo chmod 700 /home/*
# Disable timesyncd # Disable timesyncd
systemctl disable --now systemd-timesyncd systemctl disable --now systemd-timesyncd

11
whonix/whonix-gw.sh
View File

@ -18,17 +18,6 @@ unpriv(){
sudo -u nobody "$@" sudo -u nobody "$@"
} }
# Setting umask to 077
# Does not actually work for some reason - need to check
umask 077
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs
sudo sed -i 's/^USERGROUPS_ENAB.*/USERGROUPS_ENAB no/g' /etc/login.defs
sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
# Make home directory private
sudo chmod 700 /home/*
# Avoid phased updates # Avoid phased updates
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades
sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades

11
whonix/whonix-ws.sh
View File

@ -18,17 +18,6 @@ unpriv(){
sudo -u nobody "$@" sudo -u nobody "$@"
} }
# Setting umask to 077
# Does not actually work for some reason - need to check
umask 077
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs
sudo sed -i 's/^USERGROUPS_ENAB.*/USERGROUPS_ENAB no/g' /etc/login.defs
sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
# Make home directory private
sudo chmod 700 /home/*
# Avoid phased updates # Avoid phased updates
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades
sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades