First sync
This commit is contained in:
66
01-ssh/00-basic
Normal file
66
01-ssh/00-basic
Normal file
@ -0,0 +1,66 @@
|
||||
#!/bin/bash
|
||||
|
||||
# get load averages
|
||||
IFS=" " read LOAD1 LOAD5 LOAD15 <<<$(awk '{ print $1,$2,$3 }' /proc/loadavg)
|
||||
# get free memory
|
||||
IFS=" " read USED AVAIL TOTAL <<<$(free -htm | awk '/Mem/ { print $3,$7,$2 }')
|
||||
# get processes
|
||||
PROCESS=$(ps -eo user=|sort|uniq -c | awk '{ print $2 " " $1 }')
|
||||
PROCESS_ALL=$(echo "$PROCESS"| awk {'print $2'} | awk '{ SUM += $1} END { print SUM }')
|
||||
PROCESS_ROOT=$(echo "$PROCESS" | awk '/root/ { print $2}')
|
||||
PROCESS_USER=$(echo "$PROCESS" | awk '!/root/ { SUM += $2} END { print SUM }')
|
||||
# get processors
|
||||
PROCESSOR_NAME=$(awk -F": " '/model name/ { print $2 }' /proc/cpuinfo | head -1)
|
||||
PROCESSOR_COUNT=$(grep -ioPc 'processor\t:' /proc/cpuinfo)
|
||||
|
||||
# colors
|
||||
W="\e[0;39m"
|
||||
G="\e[1;32m"
|
||||
R="\e[1;31m"
|
||||
dim="\e[2m"
|
||||
undim="\e[0m"
|
||||
|
||||
echo -e "${W}System info:
|
||||
$W Hostname$dim····$undim: $W${HOSTNAME}
|
||||
$W Distro$dim······$undim: $W$(grep "PRETTY_NAME" /etc/*release | cut -d "=" -f 2- | sed 's/"//g')
|
||||
$W Kernel$dim······$undim: $W$(uname -sr)
|
||||
$W Uptime$dim······$undim: $W$(uptime -p)
|
||||
$W Load$dim········$undim: $G$LOAD1$W (1m), $G$LOAD5$W (5m), $G$LOAD15$W (15m)
|
||||
$W Processes$dim···$undim: $G$PROCESS_ROOT$W (root), $G$PROCESS_USER$W (user), $G$PROCESS_ALL$W (total)
|
||||
$W CPU$dim·········$undim: $W$PROCESSOR_NAME ($G$PROCESSOR_COUNT$W vCPU)
|
||||
$W Memory$dim······$undim: $G$USED$W used, $G$AVAIL$W avail, $G$TOTAL$W total"
|
||||
|
||||
# config
|
||||
max_usage=90
|
||||
bar_width=50
|
||||
|
||||
# disk usage: ignore zfs, squashfs & tmpfs
|
||||
printf "\nDisk usage:\n"
|
||||
|
||||
while read line; do
|
||||
# get disk usage
|
||||
usage=$(echo "$line" | awk '{print $2}' | sed 's/%//')
|
||||
used_width=$((($usage*$bar_width)/100))
|
||||
# color is green if usage < max_usage, else red
|
||||
if [ "${usage}" -ge "${max_usage}" ]; then
|
||||
color=$R
|
||||
else
|
||||
color=$G
|
||||
fi
|
||||
# print green/red bar until used_width
|
||||
bar="[${color}"
|
||||
for ((i=0; i<$used_width; i++)); do
|
||||
bar+="="
|
||||
done
|
||||
# print dimmmed bar until end
|
||||
bar+="${W}${dim}"
|
||||
for ((i=$used_width; i<$bar_width; i++)); do
|
||||
bar+="·"
|
||||
done
|
||||
bar+="${undim}]"
|
||||
# print usage line & bar
|
||||
echo "${line}" | awk '{ printf("%-31s%+3s used out of %+4s\n", $1, $2, $3); }' | sed -e 's/^/ /'
|
||||
echo -e "${bar}" | sed -e 's/^/ /'
|
||||
done < <(df -H -x zfs -x squashfs -x tmpfs -x devtmpfs -x overlay -x nfs -x nfs4 -x cifs --output=target,pcent,size | tail -n+2)
|
||||
|
||||
printf "\n"
|
||||
1
01-ssh/authorized_keys
Normal file
1
01-ssh/authorized_keys
Normal file
@ -0,0 +1 @@
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQA
|
||||
25
01-ssh/banner
Normal file
25
01-ssh/banner
Normal file
@ -0,0 +1,25 @@
|
||||
|
||||
_______ _
|
||||
|__ __| (_)
|
||||
| | __ _ _ __ _ ___
|
||||
| |/ _` | '_ \| / __|
|
||||
| | (_| | |_) | \__ \
|
||||
|_|\__,_| .__/|_|___/
|
||||
_____ | |_ _ __ __ _
|
||||
/ ____| |_(_) | | | \/ | | |
|
||||
| (___ __ _ _ _ __ | |_ __ | \ / | __ _ ___| | ___ _ _
|
||||
\___ \ / _` | | '_ \| __||__|| |\/| |/ _` |/ __| |/ _ \| | | |
|
||||
____) | (_| | | | | | |_ | | | | (_| | (__| | (_) | |_| |
|
||||
|_____/ \__,_|_|_| |_|\__| |_| |_|\__,_|\___|_|\___/ \__,_|
|
||||
|
||||
AVERTISSEMENT : L'accès à ce système est réservé aux utilisateurs
|
||||
dûment autorisés.
|
||||
|
||||
Toute tentative d'accès, d'accès à ce système sans autorisation ou
|
||||
de maintien frauduleux dans ce système fera l'objet de poursuites
|
||||
conformément à la politique de Tapis-Saint-Maclou.
|
||||
|
||||
Tout utilisateur autorisé est informé et reconnaît que ses actions
|
||||
peuvent être enregistrées, conservées et auditées conformément aux
|
||||
chartes/politiques internes de aux chartes/politiques internes de
|
||||
Tapis-Saint-Maclou.
|
||||
66
01-ssh/script.sh
Normal file
66
01-ssh/script.sh
Normal file
@ -0,0 +1,66 @@
|
||||
#!/bin/sh
|
||||
# Pour la configuration du ssh
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NOCOLOR='\033[0m'
|
||||
|
||||
echo "${YELLOW} ** ${NOCOLOR} Début du script : 01-ssh"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie du fichier : authorized_keys"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
cp 01-ssh/authorized_keys /root/.ssh/authorized_keys >> /dev/null
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie du fichier : authorized_keys : ${GREEN} OK"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie des fichiers : ssh"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
cp 01-ssh/ssh_config /etc/ssh/ssh_config >> /dev/null
|
||||
cp 01-ssh/sshd_config /etc/ssh/sshd_config >> /dev/null
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie des fichiers : ssh : ${GREEN} OK"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie du fichier : banner"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
cp 01-ssh/banner /etc/banner >> /dev/null
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie du fichier : banner : ${GREEN} OK"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie du fichier : 00-basic"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
cp 01-ssh/00-basic /etc/update-motd.d/00-basic >> /dev/null
|
||||
chmod +x /etc/update-motd.d/00-basic >> /dev/null
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Copie du fichier : 00-basic : ${GREEN} OK"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Création du lien synbolique"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
mkdir -p /etc/ssh/authorized_keys/ >> /dev/null
|
||||
|
||||
cd /etc/ssh/authorized_keys/ >> /dev/null
|
||||
|
||||
ln -s /root/.ssh/authorized_keys root >> /dev/null
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Création du lien synbolique : ${GREEN} OK"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Relance du service sshd"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
systemctl restart sshd >> /dev/null
|
||||
|
||||
echo "${YELLOW} * ${NOCOLOR} Relance du service sshd : ${GREEN} OK"
|
||||
echo "${NOCOLOR}"
|
||||
|
||||
echo "${YELLOW} ** ${NOCOLOR} Fin du script : 01-ssh"
|
||||
echo "${NOCOLOR}"
|
||||
53
01-ssh/ssh_config
Normal file
53
01-ssh/ssh_config
Normal file
@ -0,0 +1,53 @@
|
||||
|
||||
# This is the ssh client system-wide configuration file. See
|
||||
# ssh_config(5) for more information. This file provides defaults for
|
||||
# users, and the values can be changed in per-user configuration files
|
||||
# or on the command line.
|
||||
|
||||
# Configuration data is parsed as follows:
|
||||
# 1. command line options
|
||||
# 2. user-specific file
|
||||
# 3. system-wide file
|
||||
# Any configuration value is only changed the first time it is set.
|
||||
# Thus, host-specific definitions should be at the beginning of the
|
||||
# configuration file, and defaults at the end.
|
||||
|
||||
# Site-wide defaults for some commonly used options. For a comprehensive
|
||||
# list of available options, their meanings and defaults, please see the
|
||||
# ssh_config(5) man page.
|
||||
|
||||
Include /etc/ssh/ssh_config.d/*.conf
|
||||
|
||||
Host *
|
||||
# ForwardAgent no
|
||||
# ForwardX11 no
|
||||
# ForwardX11Trusted yes
|
||||
# PasswordAuthentication yes
|
||||
# HostbasedAuthentication no
|
||||
# GSSAPIAuthentication no
|
||||
# GSSAPIDelegateCredentials no
|
||||
# GSSAPIKeyExchange no
|
||||
# GSSAPITrustDNS no
|
||||
# BatchMode no
|
||||
# CheckHostIP yes
|
||||
# AddressFamily any
|
||||
# ConnectTimeout 0
|
||||
# StrictHostKeyChecking ask
|
||||
# IdentityFile ~/.ssh/id_rsa
|
||||
# IdentityFile ~/.ssh/id_dsa
|
||||
# IdentityFile ~/.ssh/id_ecdsa
|
||||
# IdentityFile ~/.ssh/id_ed25519
|
||||
# Port 22
|
||||
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
|
||||
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com
|
||||
# EscapeChar ~
|
||||
# Tunnel no
|
||||
# TunnelDevice any:any
|
||||
# PermitLocalCommand no
|
||||
# VisualHostKey no
|
||||
# ProxyCommand ssh -q -W %h:%p gateway.example.com
|
||||
# RekeyLimit 1G 1h
|
||||
# UserKnownHostsFile ~/.ssh/known_hosts.d/%k
|
||||
SendEnv LANG LC_*
|
||||
HashKnownHosts yes
|
||||
GSSAPIAuthentication yes
|
||||
124
01-ssh/sshd_config
Normal file
124
01-ssh/sshd_config
Normal file
@ -0,0 +1,124 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
Include /etc/ssh/sshd_config.d/*.conf
|
||||
|
||||
Port 2222
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
MaxAuthTries 3
|
||||
MaxSessions 5
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
|
||||
AuthorizedKeysFile /etc/ssh/authorized_keys/%u
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding yes
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
PrintMotd no
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
Banner /etc/banner
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
Reference in New Issue
Block a user