Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
44 lines
1.3 KiB
Bash
Executable File
44 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Apply baseline SSH hardening to a Proxmox VE node: key-only root login
|
|
# + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
|
|
authorized_keys_present=""
|
|
fi
|
|
if [ -z "$authorized_keys_present" ]; then
|
|
echo "WARNING: no authorized_keys found for any user yet." >&2
|
|
echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
|
|
fi
|
|
|
|
mkdir -p /etc/ssh/sshd_config.d
|
|
write_if_changed "/etc/ssh/sshd_config.d/99-hardening.conf" "PermitRootLogin prohibit-password
|
|
PasswordAuthentication no"
|
|
|
|
sshd -t
|
|
systemctl reload sshd
|
|
echo "sshd reloaded with key-only root login."
|
|
|
|
if ! dpkg -s fail2ban >/dev/null 2>&1; then
|
|
apt-get update
|
|
apt-get install -y fail2ban
|
|
fi
|
|
|
|
mkdir -p /etc/fail2ban/jail.d
|
|
write_if_changed "/etc/fail2ban/jail.d/sshd.local" "[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
backend = systemd
|
|
maxretry = 5
|
|
bantime = 1h
|
|
findtime = 10m"
|
|
|
|
systemctl enable --now fail2ban
|
|
systemctl restart fail2ban
|
|
echo "fail2ban enabled for sshd."
|