Archived
beatzaplentyandClaude Sonnet 4.6
7a038b534f
New script setup-linux-admin-user.sh creates the Linux system user, installs an SSH authorized key, and adds the user to the sudo group. Integrated into bootstrap.sh before harden-ssh.sh so key-based access is in place before password authentication is disabled. bootstrap.sh now accepts ADMIN_USER and ADMIN_SSH_KEY env vars to run user setup and setup-admin-sudo.sh automatically at the right point. audit.sh checks that at least one non-root user has an authorized key. docs/04-security-hardening.md updated with the new steps and ordering. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
68 lines
2.7 KiB
Bash
Executable File
68 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
|
|
# Runs the individual scripts in order. Idempotent - safe to re-run.
|
|
#
|
|
# If ADMIN_USER and ADMIN_SSH_KEY are set, a Linux system user is created
|
|
# with SSH key access and sudo before SSH hardening runs - so key-based
|
|
# login is in place before password auth is disabled. If they are not set,
|
|
# a reminder is printed at the end to run setup-linux-admin-user.sh manually
|
|
# (but do this BEFORE disconnecting, since password auth will be disabled).
|
|
#
|
|
# Usage:
|
|
# MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
|
|
# MGMT_CIDR=192.168.2.0/24 ADMIN_USER=wayne ADMIN_SSH_KEY="ssh-ed25519 ..." ./bootstrap.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if [ -z "${MGMT_CIDR:-}" ]; then
|
|
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
STEP=0
|
|
next_step() { STEP=$((STEP + 1)); echo; echo "=== ${STEP}: $* ==="; }
|
|
|
|
next_step "remove enterprise repos, switch to no-subscription"
|
|
"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"
|
|
|
|
# Create the Linux admin user before SSH hardening so that authorized_keys
|
|
# is in place before password auth is disabled.
|
|
if [ -n "${ADMIN_USER:-}" ] && [ -n "${ADMIN_SSH_KEY:-}" ]; then
|
|
next_step "Linux admin user '${ADMIN_USER}' + SSH key + sudo group"
|
|
"${SCRIPT_DIR}/setup-linux-admin-user.sh" "$ADMIN_USER" "$ADMIN_SSH_KEY"
|
|
|
|
next_step "passwordless sudo for pvesh/qm/pct (${ADMIN_USER})"
|
|
"${SCRIPT_DIR}/setup-admin-sudo.sh" "$ADMIN_USER"
|
|
else
|
|
echo
|
|
echo "WARNING: ADMIN_USER / ADMIN_SSH_KEY not set -- skipping Linux user setup."
|
|
echo " Run setup-linux-admin-user.sh and setup-admin-sudo.sh BEFORE disconnecting"
|
|
echo " from this session, since the next step disables password authentication."
|
|
fi
|
|
|
|
next_step "SSH hardening (key-only root login + fail2ban)"
|
|
"${SCRIPT_DIR}/harden-ssh.sh"
|
|
|
|
next_step "unattended security upgrades"
|
|
"${SCRIPT_DIR}/setup-unattended-upgrades.sh"
|
|
|
|
next_step "PVE firewall (mgmt-only SSH/8006)"
|
|
MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"
|
|
|
|
next_step "disable subscription nag (cosmetic)"
|
|
"${SCRIPT_DIR}/disable-subscription-nag.sh"
|
|
|
|
echo
|
|
echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
|
|
if [ -z "${ADMIN_USER:-}" ]; then
|
|
echo " - ${SCRIPT_DIR}/setup-linux-admin-user.sh <username> <ssh-pubkey>"
|
|
echo " - ${SCRIPT_DIR}/setup-admin-sudo.sh <username> (NOPASSWD for pvesh/qm/pct)"
|
|
fi
|
|
echo " - ${SCRIPT_DIR}/create-admin-user.sh <username> (PVE web UI account)"
|
|
echo " - Enable 2FA/TOTP for that user and root@pam via the web UI"
|
|
echo " - ${SCRIPT_DIR}/audit.sh (verify everything above)"
|