Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- ##
- # update and upgrade server
- ##
- apt-get update
- apt-get upgrade -y
- apt-get dist-upgrade -y
- apt-get autoremove -y
- ##
- # create new user to admin server via ssh
- ##
- USER="YourName"
- PASSWORD="GiveMeYourPassBaby"
- HOME="/home/$USER"
- HOSTNAME="www.example.com"
- SSH_KEY="PasteYourSSHKeyHere"
- ###############################################################################
- # HOW TO GENERATE SSH_KEY === >
- # on your local machine open terminal and type:
- # ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
- # Now appears the text: generating public/private rsa key pair.
- # Enter a file in which to save the key (/Users/you/.ssh/id_rsa): [Press enter]
- # Enter passphrase (empty for no passphrase): [Type a passphrase]
- # Enter same passphrase again: [Type passphrase again]
- # cat ~/.ssh/id_rsa.pub copy and paste in SSH_KEY !!!
- ###############################################################################
- # quietly add a user without password
- adduser --system --quiet --shell=/bin/bash --home=$HOME --gecos '$USER' --group $USER
- usermod -aG sudo $USER
- # set password
- echo "$USER:$PASSWORD" | chpasswd
- ##
- # create authorized_keys access on the server
- ##
- # create authorized_keys access on the server
- mkdir -p $HOME/.ssh
- chmod 700 $HOME/.ssh
- echo "$SSH_KEY" >> $HOME/.ssh/authorized_keys
- chown $USER:$USER $HOME/.ssh*
- chown $USER:$USER $HOME/.ssh/authorized_keys
- chmod 600 $HOME/.ssh/authorized_keys
- rm /etc/ssh/sshd_config
- cat <<EOF > /etc/ssh/sshd_config
- # Package generated configuration file
- # See the sshd_config(5) manpage for details
- # What ports, IPs and protocols we listen for
- Port 22
- # Use these options to restrict which interfaces/protocols sshd will bind to
- #ListenAddress ::
- #ListenAddress 0.0.0.0
- Protocol 2
- # HostKeys for protocol version 2
- HostKey /etc/ssh/ssh_host_rsa_key
- HostKey /etc/ssh/ssh_host_dsa_key
- HostKey /etc/ssh/ssh_host_ecdsa_key
- HostKey /etc/ssh/ssh_host_ed25519_key
- #Privilege Separation is turned on for security
- UsePrivilegeSeparation yes
- # Lifetime and size of ephemeral version 1 server key
- KeyRegenerationInterval 3600
- ServerKeyBits 1024
- # Logging
- SyslogFacility AUTH
- LogLevel INFO
- # Authentication:
- LoginGraceTime 120
- PermitRootLogin no
- StrictModes yes
- RSAAuthentication yes
- PubkeyAuthentication yes
- AuthorizedKeysFile %h/.ssh/authorized_keys
- # Don't read the user's ~/.rhosts and ~/.shosts files
- IgnoreRhosts yes
- # For this to work you will also need host keys in /etc/ssh_known_hosts
- RhostsRSAAuthentication no
- # similar for protocol version 2
- HostbasedAuthentication no
- # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
- #IgnoreUserKnownHosts yes
- # To enable empty passwords, change to yes (NOT RECOMMENDED)
- PermitEmptyPasswords no
- # Change to yes to enable challenge-response passwords (beware issues with
- # some PAM modules and threads)
- ChallengeResponseAuthentication no
- # Change to no to disable tunnelled clear text passwords
- PasswordAuthentication no
- # Kerberos options
- #KerberosAuthentication no
- #KerberosGetAFSToken no
- #KerberosOrLocalPasswd yes
- #KerberosTicketCleanup yes
- # GSSAPI options
- #GSSAPIAuthentication no
- #GSSAPICleanupCredentials yes
- X11Forwarding yes
- X11DisplayOffset 10
- PrintMotd no
- PrintLastLog yes
- TCPKeepAlive yes
- #UseLogin no
- #MaxStartups 10:30:60
- #Banner /etc/issue.net
- # Allow client to pass locale environment variables
- AcceptEnv LANG LC_*
- Subsystem sftp /usr/lib/openssh/sftp-server
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
- # be allowed through the ChallengeResponseAuthentication and
- # PasswordAuthentication. Depending on your PAM configuration,
- # PAM authentication via ChallengeResponseAuthentication may bypass
- # the setting of "PermitRootLogin without-password".
- # If you just want the PAM account and session checks to run without
- # PAM authentication, then enable this but set PasswordAuthentication
- # and ChallengeResponseAuthentication to 'no'.
- UsePAM yes
- EOF
- systemctl reload sshd
- hostname $HOSTNAME
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement