Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
46 lines
1.4 KiB
Bash
Executable File
46 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
|
|
# Runs the individual scripts in order. Idempotent - safe to re-run.
|
|
#
|
|
# Does NOT create the named admin user (needs a username decision) - run
|
|
# create-admin-user.sh separately afterwards. Run audit.sh at the end to
|
|
# verify.
|
|
#
|
|
# Usage: MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if [ -z "${MGMT_CIDR:-}" ]; then
|
|
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== 1/5: remove enterprise repos, switch to no-subscription ==="
|
|
"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"
|
|
|
|
echo
|
|
echo "=== 2/5: SSH hardening (key-only root login + fail2ban) ==="
|
|
"${SCRIPT_DIR}/harden-ssh.sh"
|
|
|
|
echo
|
|
echo "=== 3/5: unattended security upgrades ==="
|
|
"${SCRIPT_DIR}/setup-unattended-upgrades.sh"
|
|
|
|
echo
|
|
echo "=== 4/5: PVE firewall (mgmt-only SSH/8006) ==="
|
|
MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"
|
|
|
|
echo
|
|
echo "=== 5/5: disable subscription nag (cosmetic) ==="
|
|
"${SCRIPT_DIR}/disable-subscription-nag.sh"
|
|
|
|
echo
|
|
echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
|
|
echo " - ${SCRIPT_DIR}/create-admin-user.sh <username>"
|
|
echo " - Enable 2FA/TOTP for that user and root@pam via the web UI"
|
|
echo " - ${SCRIPT_DIR}/audit.sh (verify everything above)"
|