Skip to content

Commit 657c4bd

Browse files
NoahLENoahLE
committed
Added some more notes and working on setup script
1 parent c3faaf0 commit 657c4bd

File tree

3 files changed

+270
-2
lines changed

3 files changed

+270
-2
lines changed

‎content/raspberry-pi/raspian-lite.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,7 @@ Download the newest copy of Raspbian Lite from the [Raspberry Pi website](https:
2424
After downloading, the file needs to be trasferred to a microSD card for installation.
2525
I used [Etcher](https://www.balena.io/etcher/) to write the `.zip` file to the card.
2626

27-
**IMPORTANT** Create a file in the root directory of the `boot` folder with the name `ssh`.
28-
This will allow you to log into the Pi for the rest of the installation steps.
27+
**Create a file in the root directory of the `boot` folder with the name `ssh`. This will allow you to log into the Pi for the rest of the installation steps.**
2928

3029
## Logging into the Raspberry Pi
3130

‎content/raspberry-pi/security-notes.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Security Notes
2+
3+
- It helps to have separate partitions for usr, tmp, etc
4+
5+
6+
## Services
7+
8+
`service --status-all` - Show all services (`/etc/init.d` file location)
9+
`systemctl disable <service>` - Disable service (can also start/stop)
10+
`systemctl list-unit-files`

‎content/raspberry-pi/setup-script.sh

+259
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
# WORK IN PROGRESS
2+
3+
# Variables
4+
USERNAME = ""
5+
RASPBERRY_
6+
SSH_PORT = ""
7+
SSH_KEY = ""
8+
WARNING_MESSAGE = "WARNING: Unauthorized access to this system is forbidden and will be prosecuted by law. By accessing this system, you agree that your actions may be monitored if unauthorized usage is suspected."
9+
10+
# Helpers
11+
function add_variable () {
12+
stringToAdd = $1
13+
inputFile = $2
14+
15+
echo "$stringToAdd" >> $inputFile
16+
}
17+
18+
function add_or_change_variable () {
19+
searchString = $1
20+
replacementString = $2
21+
inputFile = $3
22+
23+
if grep -q $searchString $inputFile; then
24+
sed -i "/$searchString/s/.*/$replacementString/" $inputFile
25+
else
26+
add_variable $replacementString $inputFile
27+
fi
28+
}
29+
30+
function replace_file_contents () {
31+
content = $1
32+
inputFileName = $2
33+
inputFile = $3
34+
35+
echo $content | sudo tee $inputFileName > $inputFile
36+
}
37+
38+
# -- On host system --
39+
# Login pi@ip
40+
# tip: Add ssh folder to boot drive to enable ssh
41+
42+
# Add ip of your raspberry-pi
43+
# vi /etc/resolvconf/resolv.conf.d/head
44+
# 192.168.0.2
45+
# Log out and back in
46+
# In the router, set the DNS server to your raspberry pi
47+
48+
function update_system () {
49+
add_variable "alias update-all='sudo apt-get update && sudo apt-get --with-new-pkgs upgrade -y && sudo apt-get autoremove -y && sudo apt-get autoclean -y'" ~/.bashrc
50+
source ~/.bashrc
51+
update-all
52+
}
53+
54+
function create_new_account () {
55+
useradd $USERNAME
56+
# enter password
57+
58+
# Add to sudo group
59+
usermod -aG sudo $USERNAME
60+
61+
# Switch users and delete olc account
62+
su - $USERNAME
63+
deluser -remove-home -f pi
64+
}
65+
66+
function add_ssh_key () {
67+
mkdir ~/.ssh/
68+
touch ~/.ssh/authorized_keys
69+
chmod 644 ~/.ssh/authorized_keys
70+
echo "$SSH_KEY" >> ~/.ssh/authorized_keys
71+
}
72+
73+
function harden_logins () {
74+
add_or_change_variable \
75+
"PASS_MIN_DAYS" \
76+
"PASS_MIN_DAYS 3" \
77+
/etc/login.defs
78+
79+
add_or_change_variable \
80+
"PASS_MAX_DAYS" \
81+
"PASS_MAX_DAYS 60" \
82+
/etc/login.defs
83+
84+
# add_or_change_variable \
85+
# "SHA_CRYPT_MIN_ROUNDS" \
86+
# "SHA_CRYPT_MIN_ROUNDS 640000" \
87+
# /etc/login.defs
88+
89+
# add_or_change_variable \
90+
# "SHA_CRYPT_MAX_ROUNDS" \
91+
# "SHA_CRYPT_MAX_ROUNDS 640000" \
92+
# /etc/login.defs
93+
94+
umask 027 /etc/login.defs
95+
96+
apt-get install
97+
}
98+
99+
function harden_sshd_config () {
100+
add_or_change_variable \
101+
"ChallengeResponseAuthentication" \
102+
"ChallengeResponseAuthentication no" \
103+
/etc/sshd_config
104+
105+
add_or_change_variable \
106+
"PasswordAuthentication" \
107+
"PasswordAuthentication no" \
108+
/etc/sshd_config
109+
110+
add_or_change_variable \
111+
"UsePAM" \
112+
"UsePAM no" \
113+
/etc/sshd_config
114+
115+
add_or_change_variable \
116+
"PermitRootLogin" \
117+
"PermitRootLogin no" \
118+
/etc/sshd_config
119+
120+
add_or_change_variable \
121+
"AllowUsers" \
122+
"AllowUsers $USERNAME" \
123+
/etc/sshd_config
124+
125+
add_or_change_variable \
126+
"AllowTcpForwarding" \
127+
"AllowTcpForwarding no" \
128+
/etc/sshd_config
129+
130+
add_or_change_variable \
131+
"ClientAliveCountMax" \
132+
"ClientAliveCountMax 2" \
133+
/etc/sshd_config
134+
135+
add_or_change_variable \
136+
"Compression" \
137+
"Compression no" \
138+
/etc/sshd_config
139+
140+
add_or_change_variable \
141+
"LogLevel" \
142+
"LogLevel verbose" \
143+
/etc/sshd_config
144+
145+
add_or_change_variable \
146+
"MaxAuthTries" \
147+
"MaxAuthTries 3" \
148+
/etc/sshd_config
149+
150+
add_or_change_variable \
151+
"MaxSessions" \
152+
"MaxSessions 2" \
153+
/etc/sshd_config
154+
155+
add_or_change_variable \
156+
"Port" \
157+
"Port $SSH_PORT" \
158+
/etc/sshd_config
159+
160+
add_or_change_variable \
161+
"TCPKeepAlive" \
162+
"TCPKeepAlive no" \
163+
/etc/sshd_config
164+
165+
add_or_change_variable \
166+
"X11Forwarding" \
167+
"X11Forwarding no" \
168+
/etc/sshd_config
169+
170+
add_or_change_variable \
171+
"AllowAgentForwarding" \
172+
"AllowAgentForwarding no" \
173+
/etc/sshd_config
174+
175+
service ssh reload
176+
systemctl restart ssh
177+
}
178+
179+
function add_firewall () {
180+
apt install ufw
181+
ufw allow ssh http https 53
182+
ufw enable
183+
184+
apt install fail2ban
185+
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
186+
echo "
187+
[ssh]
188+
enabled = true
189+
port = ssh
190+
filter = sshd
191+
logpath = /var/log/auth.log
192+
maxretry = 3
193+
" >> /etc/fail2ban/jail.local
194+
}
195+
196+
# Security
197+
function misc_hardening () {
198+
# Add AV
199+
apt-get install clamav clamav-daemon
200+
201+
# Secure file
202+
chmod 750 /etc/sudoers.d
203+
204+
# stops core dump
205+
add_variable "* hard core 0" /etc/security/limits.conf
206+
207+
# Add warning message to ssh
208+
replace_file_contents $WARNING_MESSAGE "issue" /etc/issue
209+
replace_file_contents $WARNING_MESSAGE "issue.net" /etc/issue.net
210+
211+
# Harden PHP
212+
add_or_change_variable \
213+
"allow_url_fopen" \
214+
"allow_url_fopen = Off" \
215+
/etc/php/7.3/cli/php.ini
216+
217+
add_or_change_variable \
218+
"allow_url_include" \
219+
"allow_url_include = Off" \
220+
/etc/php/7.3/cli/php.ini
221+
222+
add_or_change_variable \
223+
"allow_url_fopen" \
224+
"allow_url_fopen = Off" \
225+
/etc/php/7.3/cgi/php.ini
226+
227+
add_or_change_variable \
228+
"allow_url_include" \
229+
"allow_url_include = Off" \
230+
/etc/php/7.3/cgi/php.ini
231+
232+
# Add unattended upgrades
233+
apt-get install unattended-upgrades apt-listchanges
234+
echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true | debconf-set-selections
235+
dpkg-reconfigure -f noninteractive unattended-upgrades
236+
}
237+
238+
# Audit
239+
function lynis_audit_system () {
240+
apt-get install git apt-show-versions debsums
241+
git clone https://github.com/CISOfy/lynis
242+
cd lynis; ./lynis audit system
243+
}
244+
245+
main () {
246+
echo "=== Running setup script ==="
247+
# update_system
248+
# create_new_account
249+
# add_ssh_key
250+
# harden_sshd_config
251+
# add_firewall
252+
# misc_hardening
253+
254+
# Restart
255+
# shutdown now -r
256+
echo "=== Done running ==="
257+
}
258+
259+
main ()

0 commit comments

Comments
 (0)