debian_hardening.sh

#!/bin/bash


#----------------------------------------------------------------------------------------------#
# User Configuration Settings & Variables
#----------------------------------------------------------------------------------------------#
PASSWORD_LENGTH=12		# The minimum password length
PASSWORD_RETRY=3		# The amount of password retries
PASSWORD_LCASE=3		# The minimum number of required lowercase characters 
PASSWORD_UCASE=3		# The minimum number of required uppercase characters
PASSWORD_SCHAR=2		# The minimum number of required special characters
PASSWORD_DIGIT=1		# The minimum number of required digits


#----------------------------------------------------------------------------------------------#
# System Configuration Settings & Variables
#----------------------------------------------------------------------------------------------#
COL_RED="\033[0;31m"
COL_GRN="\e[92m"
COL_WHI="\e[97m"
COL_NON="\033[0m"

GITHUB_REPO="https://raw.githubusercontent.com/ITNerdbox/OS-Hardening/master"
PATH_OS_RELEASE="/etc/os-release"
PATH_BACKUP="/root/osh-backups"
FWL_CONF="firehol.conf"

PKG_TEMP=( "curl" )
PKG_REQUIRED=( "apt-transport-https" "debsums" "ca-certificates" "libpam-cracklib" "acl" \ 
			   "unattended-upgrades" "apt-listchanges" "sudo" )


#----------------------------------------------------------------------------------------------#
# Script Functions
#----------------------------------------------------------------------------------------------#
function net_fwifaces () {
	IFACES=()
	IFACES=(${IFACES[@]} `ip addr | awk '/state UP/ {print $2}' | cut -d ":" -f 1`)
	COUNTER=1
	COUNT="${#IFACES[@]}"

	echo -e " ${COL_GRN} FIREWALL CONFIGURATIONS: ${COL_WHI}"
	echo ""

	if [[ $COUNT -gt 1 ]];
	then
		echo "    Multiple active network interfaces were found. It is recommended to give them a"
		echo "    descriptive name such as 'www' or 'mail'."
		echo ""
	else
		echo "    Only one active network interface was found. It is recommended to give this a"
		echo "    descriptive name such as 'www' or 'mail'."
	fi

	IF_DESCRIPTION=()

        for IFACE in "${IFACES[@]}"
        do
		IP=`ip addr show $IFACE | grep "inet " | cut -d " " -f 6 | cut -d "/" -f 1`
		read -p "    Enter description for $IFACE [$IP]: " INPUT
		IF_DESCRIPTION+=("$IFACE:$INPUT")
		((COUNTER+=1))
	done

	## Generate the firewall configuration file
	rm -rf $FWL_CONF
	echo "#----------------------------------------------------------#" >> $FWL_CONF
	echo "# Firehol Configuration Generated by OS-Hardening          #" >> $FWL_CONF
	echo "#                              (c) 2018 - 2021 by J.Diel   #" >> $FWL_CONF
	echo "#----------------------------------------------------------#" >> $FWL_CONF
	echo >> $FWL_CONF
	echo version 6 >> $FWL_CONF
	echo >> $FWL_CONF

	COUNT=1
	for ITEM in "${IF_DESCRIPTION[@]}"
	do
		IFACE=`echo $ITEM | cut -d ":" -f 1`
		IF_DESC=`echo $ITEM | cut -d ":" -f 2`
		echo "interface $IFACE osh_$IF_DESC" >> $FWL_CONF
		if [[ $COUNT -eq 1 ]];
		then
			echo -e "\tserver ssh accept" >> $FWL_CONF
			((COUNT+=1))
		fi
		echo -e "\tclient all accept" >> $FWL_CONF
		echo >> $FWL_CONF
	done

	## Install Firehole
	apt-get install firehol --assume-yes > /dev/null

	## Backup current Firehole configuration
	mv /etc/firehol/firehol.conf $PATH_BACKUP > /dev/null
	
	## Copy generated Firehole configuration
	cp -R $FWL_CONF /etc/firehol/ > /dev/null
	
	## Reload Firehol
	/etc/init.d/firehol restart > /dev/null
}


function pkg_upgrade () {
	apt-get autoremove --assume-yes > /dev/null
	apt-get update --assume-yes > /dev/null
	apt-get upgrade --assume-yes > /dev/null
}


function pkg_install () {
	if [ "$1" ]
	then
		apt-get install $1 --assume-yes > /dev/null
	fi
}


function pkg_purge () {
	if [ "$1" ]
	then
		apt-get purge $1 --assume-yes > /dev/null
	fi
}


function osh_banner() {
	echo -e "${COL_WHI}"
	echo -n '
┌────────────────────────────────────────────────────────────────────────────────────────┐
│      _____  _____     __ __  _____  _____  _____  _____  _____  ___  _____  _____      │
│     /  _  \/  ___>   /  |  \/  _  \/  _  \|  _  \/   __\/  _  \/___\/  _  \/   __\     │
│     |  |  ||___  |   |  _  ||  _  ||  _  <|  |  ||   __||  |  ||   ||  |  ||  |_ |     │
│     \_____/<_____/   \__|__/\__|__/\__|\_/|_____/\_____/\__|__/\___/\__|__/\_____/     │
│                                                                                        │
├────────────────────────────────────────────────────────────────────────────────────────┤
│     Debian 10                                      v1.4 (c) 2018 - 2021 by J. Diel     │
└────────────────────────────────────────────────────────────────────────────────────────┘'
	echo -e "${COL_NON}"
}


function osh_warning() {

        echo -e "${COL_RED}   ┌──────────────────────────────────────────────────────────────────────────────────┐
   │      :: W A R N I N G :: W A R N I N G :: W A R N I N G :: W A R N I N G ::      │
   └──────────────────────────────────────────────────────────────────────────────────┘${COL_WHI}"
}


function osh_init() {
	if [ $EUID -ne 0 ]; then
   		echo "  [Error]: The script must be executed as root!"
		exit 1
	fi

	## Create a backup directory and set permissions
	mkdir -p $PATH_BACKUP
	chmod 640 $PATH_BACKUP

	## Update the system
	echo -ne " ${COL_GRN} UPDATING SYSTEM                  : ${COL_WHI}"
	pkg_upgrade
	echo " Done"


	## Install required package(s)
	echo -ne " ${COL_GRN} INSTALL REQUIREMENTS             : ${COL_WHI}"
	for PKG in "${PKG_REQUIRED[@]}"
	do
		pkg_install $PKG
	done	
	echo " Done"


	## Install temporary package(s)
	echo -ne " ${COL_GRN} INSTALLING TEMPORARY PACKAGES    : ${COL_WHI}"
	for PKG in "${PKG_TEMP[@]}"
	do
		pkg_install $PKG
	done	
	echo " Done "
}


function osh_adduser() {
	echo -e " ${COL_GRN} CREATING NEW USER: ${COL_NON}"
	echo -e "${COL_WHI}"
	read -p "   Enter your username : " user
	read -sp "   Enter your password : " pass
	echo ""
	/usr/sbin/groupadd sshlogin > /dev/null
	egrep "^$user" /etc/passwd >/dev/null

	if [ $? -eq 0 ]; then
		echo ""
		/usr/sbin/usermod -aG sudo $user
		/usr/sbin/usermod -aG sshlogin $user
		echo -e "   [${COL_RED}SKIPPED${COL_NON}${COL_WHI}]: The username $user already exists!"
	else
		/usr/sbin/useradd -s /bin/bash -m $user
		echo "$user:$pass" | /usr/sbin/chpasswd
		/usr/sbin/usermod -aG sudo $user
		/usr/sbin/usermod -aG sshlogin $user
	fi
}


function osh_sshkey() {
	echo ""
    echo -e " ${COL_GRN} CREATING SSH Keys: ${COL_WHI}"
	echo ""
	osh_warning
	echo "   NOTE: If an SSH key is already present, step one can be skipped"
	echo "   Please execute the following commands on your client:"
	echo ""
	echo "    [1] ssh-keygen -t ed25519"
	echo "    [2] ssh-copy-id -i ~/.ssh/id_ed25519.pub $user@`curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'`"
	echo ""
	read -sp "   Enter your password again to continue: " check_pass
	echo -e "${COL_NON}"

	if [ "$pass" = "$check_pass" ]; then
		echo ""
		if [ -f /home/$user/.ssh/authorized_keys ]; then
	   		check=`cat /home/$user/.ssh/authorized_keys | grep ed25519 | wc -l`
		   	if [ $check -gt "0" ]; then
				echo ""
				echo -ne " ${COL_GRN} HARDENING SSH DAEMON             : ${COL_WHI}"
				mv /etc/ssh/sshd_config $PATH_BACKUP
				wget -q -O /etc/ssh/sshd_config $GITHUB_REPO/sshd_config
				chmod 640 /etc/ssh/sshd_config
				chmod 640 /etc/ssh
				/etc/init.d/ssh restart > /dev/null
				echo " Done "
			else
				echo ""
				echo -ne " ${COL_GRN} HARDENING SSH DAEMON             : ${COL_$RED}Failed${COL_WHI}"
				echo ""
				echo " [!] No public key was found! File is empty."
				osh_sshkey
		   	fi
		else
			echo ""
			echo -ne " ${COL_GRN} HARDENING SSH DAEMON             : ${COL_$RED}Failed${COL_WHI}"
			echo ""
			echo " [!] No public key was found! File does not exist."
			osh_sshkey
		fi
	else
		echo ""
		echo -e "   ${COL_RED}[Error] ${COL_WHI} Passwords do not match!"
		osh_sshkey
	fi
}


function osh_distro() {
	if test -f $PATH_OS_RELEASE; then
		distro=`cat $PATH_OS_RELEASE | grep "PRETTY_NAME" | cut -d "\"" -f 2 | cut -d " " -f 1`
   		version=`cat $PATH_OS_RELEASE | grep "VERSION_ID" | cut -d "\"" -f 2`
	fi

	if [ $distro ]; then
		echo ""
		echo -e " ${COL_GRN} DISTRIBUTION: ${COL_NON} ${COL_WHI} "
		echo ""
		echo -e "   Name     : ${distro^}"
		echo -e "   Version  : ${version^}"
		echo ""
	else
		warning
		echo "    It appears this is not a Debian like distribution. Continuing might not give the"
		echo -n "    expected and wanted result. "
		read -p "Do you want to continue? [y|N]: " cont

		if [ "$cont" != "${cont#[Yy]}" ] ;then
			continue
		else
			echo ""
			echo "    Smart choice, unexpected behaviour could possibily result in security risks."
			exit
		fi
	fi
}


function osh_harden() {
	## Updating PAM setting for UMASK
	echo -ne " ${COL_GRN} UPDATING GLOBAL UMASK            : ${COL_WHI}"
	echo "session optional pam_umask.so" >> /etc/pam.d/common-session
	wget -q -O /etc/login.defs $GITHUB_REPO/login.defs
	echo " Done "


	## Disable core dumps
	echo -ne " ${COL_GRN} DISABLE CORE DUMPS               : ${COL_WHI}"
	echo "* soft core 0" >> /etc/security/limits.conf
	echo "* hard core 0" >> /etc/security/limits.conf
	echo " Done "


	## Disable root login through console
	echo -ne " ${COL_GRN} DISABLE ROOT CONSOLE LOGIN       : ${COL_WHI}"
	cat /dev/null > /etc/securetty
	echo " Done "


	## Update sysctl.conf
	echo -ne " ${COL_GRN} UPDATING SYSCTL                  : ${COL_WHI}"
	mv /etc/sysctl.conf $PATH_BACKUP
	wget -q -O /etc/sysctl.conf $GITHUB_REPO/sysctl.conf
	chmod 644 /etc/sysctl.conf
	/usr/sbin/sysctl -p > /dev/null
	echo " Done "


	## Update home directory permissions
	echo -ne " ${COL_GRN} UPDATING PERMISSIONS             : ${COL_WHI}"
	chmod 750 /home/$user
	echo " Done "

	## Configure CrackLib
	echo -ne " ${COL_GRN} CONFIGURING CRACKLIB             : ${COL_WHI}"
	cp /etc/pam.d/common-password $PATH_BACKUP
	sed -i "/pam_cracklib.so/c\password        requisite                       pam_cracklib.so retry=$PASSWORD_RETRY minlen=$PASSWORD_LENGTH difok=3 ucredit=$PASSWORD_UCASE lcredit=$PASSWORD_LCASE dcredit=$PASSWORD_DIGIT ocredit=$PASSWORD_SCHAR" /etc/pam.d/common-password
	echo " Done "


	## Harden the /tmp partition
	echo -ne " ${COL_GRN} HARDENING /tmp                   : ${COL_WHI}"
	current_partition=`mount | grep "/tmp" | cut -d " " -f 1`
	
	if [ -z "$current_partition" ]; then
		echo " Failed: No seperate /tmp directory configured during installation. "
	else
		chmod 1777 /tmp
		sed -i '/tmp/d' /etc/fstab
		echo "$current_partition 	/tmp 	ext4 	loop,nosuid,noexec,rw 	0 	0" >> /etc/fstab
		mount -a
		echo " Done "
	fi

	## Disable specific hardware and protocols
	echo install firewire /bin/true >> /etc/modprobe.conf
	echo install usb_storage /bin/true >> /etc/modprobe.conf
	echo install dccp /bin/true >> /etc/modprobe.conf
	echo install sctp /bin/true >> /etc/modprobe.conf
	echo install rds /bin/true >> /etc/modprobe.conf
	echo install tipc /bin/true >> /etc/modprobe.conf

	## Do a cleanup of the system and uninstall specific packages
	echo -ne " ${COL_GRN} REMOVING TEMPORARY PACKAGES      : ${COL_WHI}"
	for PKG in "${PKG_TEMP[@]}"
	do
		pkg_purge $PKG
	done

	## For some reason netcat is installed by default
	## and should be removed
	pkg_purge netcat
	echo " Done "	
}


#----------------------------------------------------------------------------------------------#
# Start of Script
#----------------------------------------------------------------------------------------------#
clear;
osh_banner

echo ""
echo -e " ${COL_GRN} AGREEMENT: ${COL_NON}"
echo ""
echo "   The software is provided 'as is', without warranty of any kind. In no event shall the" 
echo "   author be liable for any claims, damages or other liabilities."
echo ""
osh_warning
read -p "   Do you accept this agreement? [y|N]: " agreement
echo -ne "${COL_NON}"

if [ "$agreement" != "${agreement#[Yy]}" ]; then
	echo ""
	echo -e " ${COL_GRN} INTRODUCTION: ${COL_NON}"
	echo -e "${COL_WHI}"
	echo "   This is a post installation operating system hardening script for Debian 10 servers. "
	echo ""
	echo "   Before continuing the hardening of the operating system it's required to create a"
	echo "   new user to the the system that will be added to the sudoers group.                                     "
	echo ""
	echo "   It is important to understand that the SSH configuration will disable password based"
	echo "   authentication and that a public/private key should be created on your client before"
	echo "   proceeding."
	echo ""
	osh_init
	osh_distro
	osh_adduser
	osh_sshkey
	osh_harden
	net_fwifaces
	
	echo -ne " ${COL_GRN} REMOVING TEMPORARY PACKAGES      : ${COL_WHI}"	
	for PKG in "${PKG_TEMP[@]}"
	do
		pkg_purge $PKG
	done
	echo " Done "
else
   	echo ""
	echo "   Bye!"
fi