API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 9th, 2017
137
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.09 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. {
  3. #v14 enviormental variables added
  4. #HM 10/4/2017
  5. l=$(grep "^UID_MIN" /etc/login.defs)
  6. l1=$(grep "^UID_MAX" /etc/login.defs)
  7. UUID=$(blkid | grep ext4 | grep -o '".*"' | sed 's/\ .*/ /')
  8. hacking_tools=(logkeys keylogger freeviv-server keysniffer uber vlogger vuze deluge torrent tixati frostwire ophcrack medusa RainbowCrack wfuzz brutus LOphtCrack fgdump hydra john aircrack abel ksimet inssider kismac netstumbler weplab airjack nmap superscan hping scapy nemesis socat splunk nagios pof ngrep wireshark ettercap dsniff etherape paros fiddler ratproxy slsstrip aide netfilter skipfish wapiti w3af helix sleuth maltego encase gdb tor OpenVPN snort netcop metasploit sqlmap sqlninja netsparker beef nessus openvas nipper retina qualysguard nexpose burp steam webscarab websecurify nikto w3af )
  9. pack=(samba chromium apache2 nfs-util postgresql telnet postfix openvpn php5 perl wine mysql-server xinetd vsftp exim4 nginx rpcbind openssh-server mongodb MariaDB samba-server bind9 dovecot vnc4server tightvncserver gcc cc )
  10. root=$(awk -F: '($3 == "0") {print}' /etc/passwd)
  11. awk -F':' -v "min=${l##UID_MIN}" -v "max=${l1##UID_MAX}" '{ if ( $3 >= min && $3 <= max ) print $0}' /etc/passwd | awk -F':' '{print $1}' > /tmp/users
  12. grep '^sudo:.*$' /etc/group | cut -d: -f4 > /tmp/admns
  13. tr , '\n' < /tmp/admns > /tmp/admins
  14. if [ "$(uname -a| grep Ubuntu)" ]; then
  15. os="Ubuntu"
  16. else
  17. os="Debian"
  18. fi
  19.  
  20. echo "$os operating system detected..."
  21. sleep 1;
  22.  
  23. echo "Enter all valid STANDARD users:"
  24. sleep 1;
  25. nano /tmp/authorized_users
  26. echo "Enter all valid ADMINS:"
  27. sleep 1;
  28. nano /tmp/authorized_admins
  29. cat /tmp/authorized_users /tmp/authorized_admins > /tmp/allusers
  30. userz=$(grep -Fxvf /tmp/allusers /tmp/users)
  31. adminz=$(grep -Fxvf /tmp/authorized_admins /tmp/admins)
  32.  
  33. rm /tmp/admns
  34.  
  35. echo "Badboy users: " >> ~/report
  36. grep -Fxvf /tmp/allusers /tmp/users >> ~/report
  37.  
  38.  
  39. for i in ${userz[@]}; do
  40. deluser $i
  41. done
  42.  
  43. echo "Badboy admins:" >> ~/report
  44. grep -Fxvf /tmp/authorized_admins /tmp/admins >> ~/report
  45.  
  46. for i in ${adminz[@]}; do
  47. deluser $i sudo
  48. done
  49.  
  50.  
  51. mkdir /backups
  52. mkdir /prison
  53. killall -9 dpkg
  54. update-manager
  55. apt-get update
  56. ########################### DEFINING FUNCTIONS #####################################
  57. declare -a options=( change_passwords configure_ufw secure_crontab secure_sysctl secure_ssh secure_sudoers secure_logdefs secure_fstab )
  58. change_passwords() {
  59. echo "Changing all passwords to thebomb.com1234!"
  60. sed 's/$/:thebomb.com1234!/' /tmp/allusers > /tmp/passwords
  61. cat /tmp/passwords | /usr/sbin/chpasswd
  62. echo "Changing root password"
  63. passwd -u root
  64. echo "root:thebomb.com1234!" | chpasswd
  65. }
  66. configure_ufw() {
  67. echo "Configuring ufw"
  68. apt-get install ufw
  69. ufw enable
  70. echo "Ufw rules... " >> ~/report
  71. ufw status >> ~/report
  72. echo "" >> ~/report
  73. }
  74. secure_grub() {
  75. echo "Securing Grub, enter boot password:"
  76. grub-mkpasswd-pbkdf2 | tee /tmp/hash
  77. grubhash="$(cat /tmp/hash | sed 's/^[^:]*is //'| tail -n+3)"
  78. echo "set superusers=root" >> /etc/grub.d/40_custom
  79. echo "password_pbkdf2 root $grubhash" >> /etc/grub.d/40_custom
  80. grub-update
  81. }
  82. secure_crontab() {
  83.  
  84. crontabs="$(ls /etc/cron.d/* /var/spool/cron/* /etc/crontab)"
  85. for crontab in ${crontabs[@]}
  86. do
  87. echo "" > $crontab
  88. done
  89. }
  90. secure_sysctl() {
  91. cp /etc/sysctl.conf /backups
  92. cat > /etc/sysctl.conf <<'EOF'
  93. # Controls IP packet forwarding
  94. net.ipv4.ip_forward = 0
  95.  
  96. # Controls source route verification
  97. net.ipv4.conf.default.rp_filter = 1
  98.  
  99. # Do not accept source routing
  100. net.ipv4.conf.default.accept_source_route = 0
  101.  
  102. # Controls the System Request debugging functionality of the kernel
  103. kernel.sysrq = 0
  104.  
  105. # Controls the use of TCP syncookies
  106. #net.ipv4.tcp_syncookies = 1
  107. net.ipv4.tcp_synack_retries = 2
  108.  
  109. ########## IPv4 networking start ##############
  110. # Send redirects, if router, but this is just server
  111. net.ipv4.conf.all.send_redirects = 0
  112. net.ipv4.conf.default.send_redirects = 0
  113.  
  114. # Accept packets with SRR option? No
  115. net.ipv4.conf.all.accept_source_route = 0
  116.  
  117. # Accept Redirects? No, this is not router
  118. net.ipv4.conf.all.accept_redirects = 0
  119. net.ipv4.conf.all.secure_redirects = 0
  120.  
  121. # Log packets with impossible addresses to kernel log? yes
  122. net.ipv4.conf.all.log_martians = 1
  123. net.ipv4.conf.default.accept_source_route = 0
  124. net.ipv4.conf.default.accept_redirects = 0
  125. net.ipv4.conf.default.secure_redirects = 0
  126.  
  127. # Ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
  128. net.ipv4.icmp_echo_ignore_broadcasts = 1
  129.  
  130. net.ipv4.tcp_syncookies = 1
  131.  
  132. # Enable source validation by reversed path, as specified in RFC1812
  133. net.ipv4.conf.all.rp_filter = 1
  134. net.ipv4.conf.default.rp_filter = 1
  135.  
  136.  
  137. net.ipv6.conf.default.router_solicitations = 0
  138.  
  139. # Accept Router Preference in RA?
  140. net.ipv6.conf.default.accept_ra_rtr_pref = 0
  141.  
  142. # Learn Prefix Information in Router Advertisement
  143. net.ipv6.conf.default.accept_ra_pinfo = 0
  144.  
  145. # Setting controls whether the system will accept Hop Limit settings from a router advertisement
  146. net.ipv6.conf.default.accept_ra_defrtr = 0
  147.  
  148. #router advertisements can cause the system to assign a global unicast address to an interface
  149. net.ipv6.conf.default.autoconf = 0
  150.  
  151. #how many neighbor solicitations to send out per address?
  152. net.ipv6.conf.default.dad_transmits = 0
  153.  
  154. # How many global unicast IPv6 addresses can be assigned to each interface?
  155. net.ipv6.conf.default.max_addresses = 1
  156.  
  157. ########## IPv6 networking ends ##############
  158.  
  159. #Enable ExecShield protection
  160. kernel.exec-shield = 1
  161. kernel.randomize_va_space = 1
  162.  
  163.  
  164. #net.ipv4.tcp_window_scaling = 1
  165.  
  166. # increase system file descriptor limit
  167. fs.file-max = 65535
  168.  
  169. #Allow for more PIDs
  170. kernel.pid_max = 65536
  171.  
  172. #Increase system IP port limits
  173. net.ipv4.ip_local_port_range = 2000 65000
  174. EOF
  175. sysctl -p
  176. }
  177. secure_ssh() {
  178. echo "Editing ssh..."
  179. cp /etc/ssh/sshd_config /backups
  180. cat > /etc/ssh/sshd_config <<EOF
  181. # Package generated configuration file
  182. # See the sshd_config(5) manpage for details
  183.  
  184. # What ports, IPs and protocols we listen for
  185. Port 22
  186. # Use these options to restrict which interfaces/protocols sshd will bind to
  187. #ListenAddress ::
  188. #ListenAddress 0.0.0.0
  189. Protocol 2
  190. # HostKeys for protocol version 2
  191. HostKey /etc/ssh/ssh_host_rsa_key
  192. HostKey /etc/ssh/ssh_host_dsa_key
  193. HostKey /etc/ssh/ssh_host_ecdsa_key
  194. HostKey /etc/ssh/ssh_host_ed25519_key
  195. #Privilege Separation is turned on for security
  196. UsePrivilegeSeparation yes
  197.  
  198. # Lifetime and size of ephemeral version 1 server key
  199. KeyRegenerationInterval 3600
  200. ServerKeyBits 1024
  201.  
  202. # Logging
  203. SyslogFacility AUTH
  204. LogLevel INFO
  205.  
  206. # Authentication:
  207. LoginGraceTime 120
  208. PermitRootLogin no
  209. StrictModes yes
  210.  
  211. RSAAuthentication yes
  212. PubkeyAuthentication yes
  213. #AuthorizedKeysFile %h/.ssh/authorized_keys
  214.  
  215. # Don't read the users ~/.rhosts and ~/.shosts files
  216. IgnoreRhosts yes
  217. # For this to work you will also need host keys in /etc/ssh_known_hosts
  218. RhostsRSAAuthentication no
  219. # similar for protocol version 2
  220. HostbasedAuthentication no
  221. # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
  222. #IgnoreUserKnownHosts yes
  223.  
  224. # To enable empty passwords, change to yes (NOT RECOMMENDED)
  225. PermitEmptyPasswords no
  226.  
  227. # Change to yes to enable challenge-response passwords (beware issues with
  228. # some PAM modules and threads)
  229. ChallengeResponseAuthentication no
  230.  
  231.  
  232. #GSSAPICleanupCredentials yes
  233.  
  234. X11Forwarding no
  235. X11DisplayOffset 10
  236. PrintMotd no
  237. PrintLastLog yes
  238. TCPKeepAlive yes
  239. #UseLogin no
  240.  
  241. #MaxStartups 10:30:60
  242. #Banner /etc/issue.net
  243.  
  244. # Allow client to pass locale environment variables
  245. AcceptEnv LANG LC_*
  246.  
  247. Subsystem sftp /usr/lib/openssh/sftp-server
  248.  
  249. UsePAM yes
  250. EOF
  251. }
  252. secure_sudoers() {
  253. echo "Editing sudoers file..."
  254. cp /etc/sudoers /backups
  255. cat > /etc/sudoers <<EOF
  256. #
  257. # This file MUST be edited with the 'visudo' command as root.
  258. #
  259. # Please consider adding local content in /etc/sudoers.d/ instead of
  260. # directly modifying this file.
  261. #
  262. # See the man page for details on how to write a sudoers file.
  263. #
  264. Defaults env_reset
  265. Defaults mail_badpass
  266. Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  267.  
  268. # Host alias specification
  269.  
  270. # User alias specification
  271.  
  272. # Cmnd alias specification
  273.  
  274. # User privilege specification
  275. root ALL=(ALL:ALL) ALL
  276.  
  277. # Allow members of group sudo to execute any command
  278. %sudo ALL=(ALL:ALL) ALL
  279. EOF
  280. }
  281. secure_logdefs() {
  282. echo "Editing login.defs..."
  283. cp /etc/login.defs /backups
  284. cat > /etc/login.defs <<EOF
  285.  
  286. MAIL_DIR /var/mail
  287. FAILLOG_ENAB yes
  288. LOG_UNKFAIL_ENAB yes
  289. LOG_OK_LOGINS yes
  290. SYSLOG_SU_ENAB yes
  291. SYSLOG_SG_ENAB yes
  292. FTMP_FILE /var/log/btmp
  293. SU_NAME su
  294. HUSHLOGIN_FILE .hushlogin
  295. ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  296. ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
  297. TTYGROUP tty
  298. TTYPERM 0600
  299. ERASECHAR 0177
  300. KILLCHAR 025
  301. UMASK 022
  302. PASS_MAX_DAYS 90
  303. PASS_MIN_DAYS 10
  304. PASS_WARN_AGE 7
  305. UID_MIN 1000
  306. UID_MAX 60000
  307. SYS_UID_MIN 100
  308. SYS_UID_MAX 999
  309. GID_MIN 1000
  310. GID_MAX 60000
  311. SYS_GID_MIN 100
  312. SYS_GID_MAX 999
  313. LOGIN_RETRIES 3
  314. LOGIN_TIMEOUT 60
  315. CHFN_RESTRICT rwh
  316. DEFAULT_HOME yes
  317. USERGROUPS_ENAB yes
  318. ENCRYPT_METHOD SHA512
  319. EOF
  320. }
  321. secure_fstab() {
  322. cp /etc/fstab/ /backups
  323. echo UUID="$UUID / ext4 errors=remount-ro 0 1" > /etc/fstab
  324. echo "tmpfs /run/shm tmpfs ro,noexec,nosuid,nodev 0 0" >> /etc/fstab
  325. }
  326.  
  327. echo "Creating ~/megalist"
  328. find /etc /var /root /bin /home /pub /media /opt -xdev >> ~/megalist
  329. dpkg --list >> ~/megalist
  330. dpkg --list >> ~/pack
  331.  
  332.  
  333. echo "Identifying Services"
  334. echo "Services: " >> ~/report
  335.  
  336. for i in ${pack[@]}; do
  337. if ! [ "$( grep -w $i ~/pack)" == "" ];then
  338. echo "$i" possibly "installed" >> ~/report
  339. fi
  340. done
  341.  
  342. echo "Identifying Hacking Tools"
  343. echo "Hacking tools & Other Things : " >> ~/report
  344. for i in ${hacking_tools[@]}; do
  345. if ! [ "$(grep -w $i ~/megalist)" == "" ]; then
  346. echo $i maybe installed >> ~/report ; apt-get remove $i
  347.  
  348. fi
  349. done
  350.  
  351. if [ -e /etc/prelink.conf ]; then
  352. prelink -ua
  353. apt-get remove prelink
  354. echo prelink installed >> ~/report
  355. fi
  356.  
  357. echo "Possibly Bad Files: " >> ~/report
  358.  
  359. if [ -e /etc/vsftpd.conf ] ; then
  360. echo "vsftpd found"
  361. grep -rnw -e "password" -e "card" -e "boss" -e "hey" -e "hack" -e "personal" -e ".*\.mp3$" ".*\.m4b$" -e -e ".*\.mp4$" -e ".*\.mov$" -e ".*\.tar.gz$" -e ".*\.avi$" /srv
  362. fi
  363.  
  364. echo "Possibly Bad Files: "
  365. grep -rlin --exclude-dir={.mozilla,.cache,.config} -e "passsword" -e "card" -e "boss" -e "hey" -e "personal" -e "hack" /var/www /home >> ~/report
  366.  
  367.  
  368. apt-get remove netcat-openbsd tcpdump
  369. if [ -e /bin/nc ]; then
  370. echo "Hashing netcat..."
  371. export nchash=$(md5sum /bin/nc | cut -f1 -d" ")
  372. fi
  373.  
  374. if [ -e /bin/nc.traditional ]; then
  375. echo "Hashing netcat..."
  376. export tradhash=$(md5sum /bin/nc | cut -f1 -d" ")
  377. fi
  378.  
  379.  
  380.  
  381. echo "Setting permissions..."
  382. chmod 0700 /etc/rc*
  383. chmod 0700 /etc/init.d*
  384. chmod 0700 /etc/sysctl.conf
  385. chmod 644 /etc/passwd
  386. chown root:root /boot/grub/grub.cfg
  387. chmod og-rwx /boot/grub/grub.cfg
  388. chown root:root /etc/passwd
  389. chown root:root /etc/sudoers
  390. chown root:shadow /etc/shadow
  391. chown root:root /etc/group
  392. chmod 644 /etc/group
  393. chmod -R 0444 /var/www/html/
  394. chmod 644 /etc/fstab
  395. chmod 400 /etc/shadow
  396. chmod 02750 /bin/su
  397. sudo dpkg-statoverride --update --add root sudo 4750 /bin/su
  398.  
  399. clear
  400.  
  401.  
  402. rm '/etc/security/limits.d/*'
  403. cp /etc/security/limits.conf /backups
  404. echo "* hard core 0" >> /etc/security/limits.conf
  405. cat /etc/shadow | awk -F: '($2 == "" ) { print $1 " does not have a password "}' >> ~/report
  406.  
  407. echo "" >> ~/report
  408. echo "Checking for UID of 0..."
  409. echo "Following line should only be root" >> ~/report
  410. [ "$root" != "root:x:0:0:root:/root:/bin/bash" ] && (echo "POSSIBLE UID OF 0!" >> ~/report | echo $"root" >> ~/report )
  411.  
  412.  
  413. echo "Finding world writable files.."
  414. echo "All world writeable files" >> ~/report
  415. find /etc /var /root /home -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print >> ~/report
  416. echo "Finding no user files...."
  417. echo "No user files" >> ~/report
  418. echo $(find /home /etc /var /dev -xdev \( -nouser -o -nogroup \) -print) >> ~/report
  419. echo "Removing netcat and installing auidit"
  420. apt-get remove netcat*
  421. apt-get install libpam-cracklib
  422. apt-get install auiditd
  423. auditctl –e 1
  424. reset
  425. apt-get autoremove
  426. echo "" >> ~/report
  427.  
  428.  
  429. echo "Looking for netcat copies"
  430. location="$(find ${PATH//:/ } -maxdepth 1 -executable)"
  431. for binary in ${location[@]}
  432. do
  433. if ! [ -d "$binary" ]; then
  434. if [ "$(md5sum $binary | cut -f1 -d" " )" == "$nchash" ] || [ "$(md5sum $binary | cut -f1 -d" " )" == "$tradhash" ] ;then
  435. mv "$binary" /prison
  436. echo "$binary is netcat, imprsioned" >> ~/report
  437. killall -9 "$binary"
  438. fi
  439. fi
  440. done
  441.  
  442.  
  443.  
  444.  
  445.  
  446. if [ -e /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf ] ;then
  447. echo "Disabling guest..."
  448. echo "allow-guest=false" >> /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
  449. echo "Guest Disabled" >> ~/report
  450. fi
  451.  
  452.  
  453.  
  454. apt-get install clamav
  455. apt-get install rkhunter
  456. freshclam
  457. rkhunter --check
  458.  
  459. echo "Finding Media Files..."
  460. echo "Media files:" >> ~/report
  461. grep -e ".*\.mp3$" -e ".*\.mp4$" -e ".*\.mov$" -e ".*\.tar.gz$" -e ".*\.avi$" -e ".*\.torrent$" -e ".*\.exe$" ~/megalist >> ~/report
  462.  
  463.  
  464. echo "order bind,hosts" >> /etc/host.conf
  465. echo "nospoof on" >> /etc/host.conf
  466. sudo dmesg -n 1
  467.  
  468.  
  469. cat > /etc/modprobe.d/CIS.conf <<EhOF
  470. install cramfs /bin/true
  471. install freevxfs /bin/true
  472. install jffs2 /bin/true
  473. install hfs /bin/true
  474. install hfsplus /bin/true
  475. install squashfs /bin/true
  476. install udf /bin/true
  477. install vfat /bin/true
  478. EhOF
  479.  
  480.  
  481.  
  482. if [ "$(dpkg --list | grep -i php)" != "" ]; then
  483. echo "PHP found"
  484. echo "PHP security report: >> ~/report"
  485. phpconf=$(php -i | grep -i '/php.ini' | awk -F'> ' '{ print $NF }')
  486.  
  487. if [ -e /etc/php.d/sqlite3.ini ];then
  488. mv /etc/php.d/sqlite3.ini /etc/php.d/sqlite3.disable
  489. fi
  490.  
  491. function secure_php() {
  492. read -r -p "Run secure_php in active mode? y/n" php_response
  493. case "$php_response" in
  494. [yY][eE][sS]|[yY])
  495. php_status = true
  496. echo "running in active mode"
  497. ;;
  498. *)
  499. php_status = false
  500. echo "running in passive mode"
  501. ;;
  502. esac
  503.  
  504.  
  505. cp $phpconf /backups
  506. i=i
  507. export line=$(awk '/disable_funct/{print NR; exit $1}' $1 )
  508. if [ $line != "" ]; then
  509. export linewi="$line$i"
  510. sed -i '/disable_func/d' $1
  511. sed -i "$linewi\disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source" $1
  512. fi
  513.  
  514.  
  515. declare -A arr=( ["upload_max_filesize"]="1m" ["post_max_size"]="1k" ["max_execution_time"]="30" ["max_input_time"]="30" ["memory_limit"]="40m" ["expose_php"]="off" ["display_errors"]="off" ["log_errors"]="on" ["cgi.force_redirect"]="on" ["magic_quotes_gpc"]="on" ["sql.safe_mode"]="on" ["allow_url_include"]="off" ["file_uploads"]="off" ["allow_url_include"]="off" )
  516.  
  517. for key in "${!arr[@]}"; do
  518. if [ "$(grep "$key" $1)" != "" ] && [ "$(grep "$key" $1 | grep -i ${arr[${key}]})" == "" ] || [ "$( grep "$key" $1 | grep "#" )" != "" ];then
  519.  
  520. echo "${key} not set correctly in $1" | tee -a ~/report
  521. if [ "$php_status" = true ]; then
  522. badline=$(grep -n "$key" $phpconf | grep "="| awk -F ":" '{print $1}')
  523. sed -i '$badline d' $phpconf
  524. ex -sc '3i|${key}=${arr[${key}]}' -cx $phpconf
  525. fi
  526.  
  527. fi
  528. done
  529. }
  530.  
  531. secure_php $phpconf
  532.  
  533. if [ -e /etc/php.d/security.ini ]; then
  534. cp /etc/php.d/security.ini /backups
  535. secure_php /etc/php.d/security.ini
  536. fi
  537. fi
  538.  
  539.  
  540. if [ -e /etc/vsftpd.conf ]; then
  541. echo "VSFTP found..."
  542. cp /etc/vsftpd.conf /backups
  543. echo "vsftp report: " >> ~/report
  544. echo "ssl cert generated for you at /etc/vsftpd.pem " >> ~/report
  545. openssl req -x509 -days 365 -newkey rsa:2048 -nodes -keyout /etc/vsftpd.pem -out /etc/vsftpd.pem
  546. declare -A ftp=( ["anonymous_enable="]="=no" ["local_enable="]="=yes" ["chroot_local_user="]="=yes" ["xferlog_enable="]="=yes" ["anon_max_rate="]="=30000" ["local_max_rate="]="=30000" ["idle_session_timeout="]="=300" ["max_per_ip="]="=50" )
  547. for key in "${!ftp[@]}:"; do
  548. if [ "$(grep "$key" /etc/vsftpd.conf)" == "" ] || [ "$(grep "$key" /etc/vsftpd.conf | grep -i "${ftp[${key}]}")" == "" ] || [ "$(grep "$key" /etc/vsftpd.conf| grep "#" )" != "" ];then
  549. echo "${key} not set correctly in /etc/vsftpd.conf" | tee -a ~/report
  550. fi
  551. done
  552. fi
  553.  
  554.  
  555.  
  556.  
  557. echo "Configuring Pam..."
  558. cp /etc/pam.d/common-password /backups
  559. cat > /etc/pam.d/common-password <<EOF
  560.  
  561. password requisite pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
  562. password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 minlen=8 remember=5
  563.  
  564. password requisite pam_deny.so
  565.  
  566. password required pam_permit.so
  567. # and here are more per-package modules (the "Additional" block)
  568. password optional pam_gnome_keyring.so
  569. # end of pam-auth-update config
  570. EOF
  571.  
  572.  
  573. cp /etc/pam.d/common-auth /backups
  574. cat > /etc/pam.d/common-auth <<EOF
  575. #
  576. # /etc/pam.d/common-auth - authentication settings common to all services
  577. #
  578.  
  579. # here are the per-package modules (the "Primary" block)
  580. auth [success=1 default=ignore] pam_unix.so nullok_secure
  581. # here's the fallback if no module succeeds
  582. auth requisite pam_deny.so
  583.  
  584. auth required pam_permit.so
  585. # and here are more per-package modules (the "Additional" block)
  586. auth optional pam_cap.so
  587. # end of pam-auth-update config
  588. auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800
  589. EOF
  590.  
  591.  
  592.  
  593.  
  594. ###start prouse###
  595. prousemain () {
  596. for i in ${allusers[@]}; do
  597. echo "typeset -r TMOUT=900(15 minutes = 900 seconds)" >> $(getent passwd $i | cut -d: -f6)/.bashrc
  598. chattr +a $(getent passwd $i | cut -d: -f6)/.bash_history
  599. chattr +i $(getent passwd $i | cut -d: -f6)/.bash_history
  600. done
  601. chmod 0700 /etc/profile
  602. chmod 0700 /etc/hosts.allow
  603. chmod 0700 /etc/mtab
  604. chmod 0700 /etc/utmp
  605. chmod 0700 /var/adm/wtmp
  606. if [ $? > 0 ]; then
  607. chmod 0700 /var/log/wtmp
  608. fi
  609. chmod 0700 /etc/syslog.pid
  610. if [ $? > 0 ]; then
  611. chmod 0700 /var/run/syslog.pid
  612. fi
  613. chmod 0700 /etc/sysctl.conf
  614. chmod 0700 /etc/inittab
  615.  
  616. apache2ports() {
  617. if [ -d /etc/apache2 ]; then
  618. echo "###Start Apache2 Report###" >> ~/apache2report
  619. if [ -e /etc/apache2/ports.conf ]; then
  620. if [ "$(cat /etc/apache2/ports.conf | grep -i "Listen")" == "" ]; then
  621. echo "Apache2 isn't listening at all!" >> ~/apache2apache2report
  622. fi
  623. if [ "$(cat /etc/apache2/ports.conf | grep -i "Listen" | grep -i "Listen 80")" == "" ]; then
  624. echo "Apache2 isn't listening on port 443 (This may be okay)" >> ~/apache2report
  625. fi
  626. badports="$(cat /etc/apache2/ports.conf | grep -i "Listen" | grep -i "Listen" | sed -e 's/Listen 443//g;s/Listen 80//g' | sed -e 's/Listen//g')"
  627. echo "Apache2 is running on these unauthorized ports: $badports" >> ~/apache2report
  628. fi
  629. if [ -e /etc/apache2/envvars ]; then
  630. cp /etc/apache2/envvars /backups/envvars.bak
  631. cat > /etc/apache2/envvars <<EOF
  632. unset HOME
  633. if [ "${APACHE_CONFDIR##/etc/apache2-}" != "${APACHE_CONFDIR}" ] ; then
  634. SUFFIX="-${APACHE_CONFDIR##/etc/apache2-}"
  635. else
  636. SUFFIX=
  637. fi
  638. export APACHE_RUN_USER=www-data
  639. export APACHE_RUN_GROUP=www-data
  640. export APACHE_PID_FILE=/var/run/apache2$SUFFIX/apache2.pid
  641. export APACHE_RUN_DIR=/var/run/apache2$SUFFIX
  642. export APACHE_LOCK_DIR=/var/lock/apache2$SUFFIX
  643. export APACHE_LOG_DIR=/var/log/apache2$SUFFIX
  644. export LANG=C
  645. export LANG
  646. EOF
  647. # sed -i 's/.*export APACHE_RUN_USER.*/export APACHE_RUN_USER=www-data/g' && echo "Apache2 runuser set to www-data" >> ~/apache2report
  648. # sed -i 's/.*export APACHE_RUN_GROUP.*/export APACHE_RUN_GROUP=www-data/g' && echo "Apache2 rungroup set to www-data" >> ~/apache2report
  649. fi
  650. if [ -e /etc/apache2/apache2.conf ]; then
  651. cp /etc/apache2/apache2.conf /backups/apache2.conf.bak
  652. sed -i 's/KeepAlive On/ KeepAlive Off/g' /etc/apache2/apache2.conf && echo "KeepAlive Off" >> /etc/apache2/apache2.conf && echo "KeepAlive changed to Off" >> ~/apache2report
  653. sed -i 's/.*Timeout.*/Timeout 300/g' /etc/apache2/apache2.conf && echo "Timeout changed to 300" >> ~/apache2report
  654. sed -i 's/.*MaxKeepAliveRequests.*/MaxKeepAliveRequests 100/g' /etc/apache2/apache2.conf && echo "MaxKeepAliveRequests changed to 100" >> ~/apache2report
  655. sed -i 's/.*KeepAliveTimeout.*/KeepAliveTimeout 5/g' /etc/apache2/apache2.conf && echo "KeepAliveTimeout set to 5" >> ~/apache2report
  656. sed -i 's/.*HostnameLookups.*/HostnameLookups Off/g' /etc/apache2/apache2.conf && echo "HostnameLookups set to Off" >> ~/apache2report
  657. sed -i 's/.*LogLevel.*/LogLevel warn/g' /etc/apache2/apache2.conf && echo "LogLevel set to warn" >> ~/apache2report
  658. ##thislinedoesntwork## sed -i 's/.*Options FollowSymlinks.*/Options -FollowSymLinks/' /etc/apache2/apache2.conf && sed -i 's/.*Options Indexes FollowSymLinks.*/Options Indexes -FollowSymLinks/g' /etc/apache2/apache2.con$
  659. echo "Include ports.conf" >> /etc/apache2/apache2.conf && echo "Apache2 reads ports.conf" >> ~/apache2report
  660. fi
  661. fi
  662. }
  663. apache2ports
  664. }
  665. prousemain
  666. ###end prouse###
  667.  
  668.  
  669. if [ "$(echo $PATH)" != "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" ]; then
  670. echo "PATH variable mishap" >> ~/report
  671. echo "$PATH">> ~/report
  672. if [ "$(cat /etc/environment)" != "PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"" ]; then
  673. cp /etc/environment /backups
  674. echo "PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"" > /etc/environment
  675. source /etc/environment && export PATH
  676.  
  677. fi
  678. fi
  679.  
  680. netstat -tulpn | grep LISTEN >> ~/report
  681.  
  682.  
  683. for i in ${options[@]}; do
  684. read -r -p "Do want to $i? [y/N] " response
  685. case "$response" in
  686. [yY][eE][sS]|[yY])
  687. $i
  688. ;;
  689. *)
  690. echo "Cancelling $i"
  691. ;;
  692. esac
  693. done
  694.  
  695. echo "|||| Done: created file '~/report' and file backups in '/backups' ||||"
  696. }2>|tee ~/comp_errors.log
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!