87 lines
2.7 KiB
Bash
87 lines
2.7 KiB
Bash
#!/bin/bash
|
|
# Basic VM/LXC Setup Script for root environments
|
|
# Creates 'beer' user if missing, sets up SSH, installs basic tools.
|
|
|
|
# === CONFIGURE PUBLIC KEY ===
|
|
SSH_PUBLIC_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDxZomUDtOt7Kh1mfZleJrv/IZrdFZ6j80RIpyTWd5R+ beer@bwsttv.com" # Paste your SSH public key here
|
|
USERNAME="beer"
|
|
|
|
# Ensure script runs as root
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "Please run as root."
|
|
exit 1
|
|
fi
|
|
|
|
# === UPDATE SYSTEM ===
|
|
echo "Updating system..."
|
|
apt update && apt upgrade -y
|
|
|
|
# === CREATE USER IF NOT EXISTS ===
|
|
if id "$USERNAME" &>/dev/null; then
|
|
echo "User '$USERNAME' already exists."
|
|
else
|
|
echo "Creating user '$USERNAME'..."
|
|
adduser --disabled-password --gecos "" "$USERNAME"
|
|
usermod -aG sudo "$USERNAME"
|
|
fi
|
|
|
|
# === SET UP SSH FOR USER ===
|
|
echo "Configuring SSH for '$USERNAME'..."
|
|
mkdir -p /home/$USERNAME/.ssh
|
|
echo "$SSH_PUBLIC_KEY" > /home/$USERNAME/.ssh/authorized_keys
|
|
chmod 700 /home/$USERNAME/.ssh
|
|
chmod 600 /home/$USERNAME/.ssh/authorized_keys
|
|
chown -R $USERNAME:$USERNAME /home/$USERNAME/.ssh
|
|
|
|
# === HARDEN SSH ===
|
|
echo "Updating SSH security settings..."
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
|
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
systemctl restart ssh || service ssh restart
|
|
|
|
# === INSTALL BASIC UTILITIES ===
|
|
echo "Installing base packages..."
|
|
apt install -y curl wget vim git ufw wamerican
|
|
|
|
# === FIREWALL CONFIGURATION ===
|
|
echo "Configuring firewall..."
|
|
ufw allow OpenSSH
|
|
ufw --force enable
|
|
|
|
# === HARDEN SSH: Disable root login via SSH ===
|
|
echo "Disabling root SSH login..."
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
systemctl restart ssh || service ssh restart
|
|
|
|
# === ENSURE beer CAN USE SUDO ===
|
|
usermod -aG sudo beer
|
|
|
|
# Make sure /usr/share/dict/words exists, or replace with your own file path or word array
|
|
WORDLIST="/usr/share/dict/words"
|
|
|
|
# Pick 5 random words, capitalize first letter
|
|
PASSWORD_WORDS=$(shuf -n 5 "$WORDLIST" | sed 's/.*/\L&/' | sed 's/^./\u&/' | tr '\n' ' ')
|
|
|
|
# Generate 4 random digits
|
|
PASSWORD_NUMBERS=$(shuf -i 1000-9999 -n 1)
|
|
|
|
# Combine words and numbers
|
|
GENERATED_PASS="${PASSWORD_WORDS}${PASSWORD_NUMBERS}"
|
|
|
|
# Remove trailing spaces if any
|
|
GENERATED_PASS=$(echo "$GENERATED_PASS" | xargs)
|
|
|
|
# Set password for user beer
|
|
echo "beer:$GENERATED_PASS" | chpasswd
|
|
|
|
# Show the generated password
|
|
echo "--------------------------------------------------"
|
|
echo "Generated password for user 'beer':"
|
|
echo "$GENERATED_PASS"
|
|
echo "Please save this password securely!"
|
|
echo "--------------------------------------------------"
|
|
|
|
|
|
echo "Setup complete! You can now SSH into the container/VM as '$USERNAME'."
|