diff --git a/README.md b/README.md index 5d5ad2e..eebb447 100644 --- a/README.md +++ b/README.md @@ -3,78 +3,145 @@ Depuis un terminal, faire un copié/collé du code ci-dessous ```shell -apt update - -apt install -y git - +sudo apt update +sudo apt install -y git git clone https://gitea.tips-of-mine.com/hcornet/Hardening-Linux-Debian-Ubuntu.git ``` # 2. Installation Depuis un terminal, faire un copié/collé du code ci-dessous + ```shell cd Hardening-Linux-Debian-Ubuntu/ - chmod +x * -R - sudo ./main.sh ``` ## package_management.sh -Configuration du SSH sur la VM -Et rajout de l'interface motd +Mise en place de la configuration **proxy**, puis lancement de l'update. +Ainsi que l'installation des quelque package supplémentaire. + +S'il y a un paramétrage pour le proxy, il faut être saisie dans le fichier : **custom_proxy** + +``` +# variables + +HTTP_PROXY="serveur-proxy.tips-of-mine.local" +HTTPS_PROXY="serveur-proxy.tips-of-mine.local" +FTP_PROXY="serveur-proxy.tips-of-mine.local" +``` ## ssh_hardening.sh -Mise en place de la configuration proxy, puis lancement de l'update +Mise en place de la **ssh**. -## firewall.s +S'il y a un paramétrage pour rajouter des clé ssh, il faut être saisie dans le fichier : **custom_key** -Installation de l'agent Cortex +``` +# Variable +ssh-rsa AAAAB3NzaC1yc2EAAAADAQA +``` + +## firewall.sh + +Mise en place de la configuration **firewall** local. ## fail2ban.sh -Installation de l'agent GLPI +Mise en place de la configuration pour le **fail2ban**. ## auditing.sh -Installation de l'agent ManageEngine +Mise en place de la configuration pour l'**audit**. ## dns_config.sh -Installation du service SNMP avec la configuration +Mise en place de la configuration pour le **dns**. + +S'il y a un paramétrage pour rajouter des serveurs DNS, il faut être saisie dans le fichier : **custom_dns** + +``` +# Variable +``` ## ntp.sh -Installation du paramétrage DNS +Mise en place de la configuration pour le **NTP**. ## auto_updates.sh -Installation du paramétrage nrpe +Mise en place de la configuration pour l'**auto update**. ## antivirus.sh -Installation du Firewall + paramétrage +Mise en place de la configuration pour l'**antivirus**. ## custom_prompt.sh -Installation du Faild2Ban + paramétrage +Mise en place de la configuration pour le **prompt de connexion**. ## glpi_agent.sh +Mise en place de la configuration pour l'**agent GLPI**. + +Il y a un paramétrage à modifier, il faut être saisie dans le fichier : **custom_glpi** + +``` +# variables + +GLPI_SERVER="glpi.tips-of-mine.fr" +GLPI_TAG="SecuredServer" +``` + ## wazuh_agent.sh +Mise en place de la configuration pour l'**agent Wazuh**. + +Il y a un paramétrage à modifier, il faut être saisie dans le fichier : **custom_wazuh** + +``` +# variables + +WAZUH_MANAGER="10.0.4.100" +``` + ## monitoring.sh +Mise en place de la configuration pour le **SNMP** et **NRPE**. + +Il y a un paramétrage à modifier, il faut être saisie dans le fichier : **custom_snmp** + +``` +# variables + +SNMP_SYSLOCATION="Server Room" +SNMP_SYSCONTACT="admin@tips-of-mine.fr" +SNMP_SYSNAME="$(hostname)" +SNMP_SYSDESCR="Linux $(uname -r) on $(uname -m)" +SNMP_AGENTADDRESS="10.0.4.190,10.0.4.191" + +``` + +Il y a un paramétrage à modifier, il faut être saisie dans le fichier : **custom_monitoring** + +``` +# variables + +NAGIOS_SERVER_IP="10.0.4.190,10.0.4.191" +``` + ## additional_hardening.sh -# 3. Update +Mise en place de la configuration . + +# 3. Update des sources Depuis un terminal, Aller dans le dossier. + ```shell -cd ./prerequis-install-deb/ +cd Hardening-Linux-Debian-Ubuntu/ ``` Faire un copié/collé du code ci-dessous diff --git a/custom/custom_dns b/custom/custom_dns index 4287ca8..bb79b11 100644 --- a/custom/custom_dns +++ b/custom/custom_dns @@ -1 +1 @@ -# \ No newline at end of file +# Variables \ No newline at end of file diff --git a/custom/custom_key b/custom/custom_key index 1f0a135..200d6bc 100644 --- a/custom/custom_key +++ b/custom/custom_key @@ -1,2 +1,2 @@ -# +# Variable ssh-rsa AAAAB3NzaC1yc2EAAAADAQA \ No newline at end of file diff --git a/custom/custom_monitoring b/custom/custom_monitoring index 4287ca8..94b7348 100644 --- a/custom/custom_monitoring +++ b/custom/custom_monitoring @@ -1 +1,3 @@ -# \ No newline at end of file +# variables + +NAGIOS_SERVER_IP="10.0.4.190,10.0.4.191" \ No newline at end of file diff --git a/custom/custom_proxy b/custom/custom_proxy new file mode 100644 index 0000000..8bcf49e --- /dev/null +++ b/custom/custom_proxy @@ -0,0 +1,5 @@ +# variables + +HTTP_PROXY="serveur-proxy.tips-of-mine.local" +HTTPS_PROXY="serveur-proxy.tips-of-mine.local" +FTP_PROXY="serveur-proxy.tips-of-mine.local" \ No newline at end of file diff --git a/custom/custom_snmp b/custom/custom_snmp index 8301b31..0577e66 100644 --- a/custom/custom_snmp +++ b/custom/custom_snmp @@ -4,4 +4,4 @@ SNMP_SYSLOCATION="Server Room" SNMP_SYSCONTACT="admin@tips-of-mine.fr" SNMP_SYSNAME="$(hostname)" SNMP_SYSDESCR="Linux $(uname -r) on $(uname -m)" -$SNMP_AGENTADDRESS="10.0.4.190,10.0.4.191" +SNMP_AGENTADDRESS="10.0.4.190,10.0.4.191" diff --git a/custom/custom_wazuh b/custom/custom_wazuh index 9c3af80..a986fb0 100644 --- a/custom/custom_wazuh +++ b/custom/custom_wazuh @@ -1,3 +1,3 @@ # variables -WAZUH_MANAGER="YOUR_WAZUH_MANAGER_IP" \ No newline at end of file +WAZUH_MANAGER="10.0.4.100" \ No newline at end of file diff --git a/modules/monitoring.sh b/modules/monitoring.sh index 5ed2250..17b06f7 100644 --- a/modules/monitoring.sh +++ b/modules/monitoring.sh @@ -9,6 +9,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Source common functions and variables source "./common.sh" source "./custom/custom_snmp" +source "./custom/custom_monitoring" # Function to configure SNMP configure_snmp() { @@ -173,7 +174,7 @@ server_port=5666 server_address=0.0.0.0 # Allow connections from these monitoring servers (replace with your Nagios server IP) -allowed_hosts=127.0.0.1,NAGIOS_SERVER_IP +allowed_hosts=127.0.0.1,$NAGIOS_SERVER_IP # Connection restrictions dont_blame_nrpe=0 diff --git a/modules/package_management.sh b/modules/package_management.sh index 415184e..6ca3c11 100644 --- a/modules/package_management.sh +++ b/modules/package_management.sh @@ -8,15 +8,16 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Source common functions and variables source "./common.sh" +source "./custom/custom_proxy" # Function to configure APT with proxy settings if needed configure_apt_proxy() { - local proxy_file="/etc/apt/apt.conf.d/90proxy" - local proxy_doc="/root/apt-proxy-documentation.txt" + local PROXY_FILE="/etc/apt/apt.conf.d/90proxy" + local PROXY_DOC="/root/apt-proxy-documentation.txt" - log_message "INFO" "Creating APT proxy documentation at $proxy_doc" + log_message "INFO" "Creating APT proxy documentation at $PROXY_DOC" - cat > "$proxy_doc" << EOF + cat > "$PROXY_DOC" << EOF # APT Proxy Configuration # To configure APT to use a proxy, edit the file /etc/apt/apt.conf.d/90proxy # and add one of the following configurations: @@ -28,14 +29,15 @@ Acquire::http::Proxy "http://username:password@proxy.example.com:8080/"; Acquire::https::Proxy "http://username:password@proxy.example.com:8080/"; # For APT to use the system's proxy settings -Acquire::http::Proxy "http://${http_proxy}"; -Acquire::https::Proxy "http://${https_proxy}"; +Acquire::http::Proxy "http://$HTTP_PROXY"; +Acquire::https::Proxy "http://$HTTPS_PROXY"; +Acquire::ftp::proxy "http://$FTP_PROXY"; # To disable proxy for specific hosts Acquire::http::Proxy::hostname.example.com "DIRECT"; EOF - log_message "SUCCESS" "APT proxy documentation created. Edit $proxy_file to configure proxies if needed" + log_message "SUCCESS" "APT proxy documentation created. Edit $PROXY_FILE to configure proxies if needed" } # Function to update package lists and upgrade installed packages @@ -63,7 +65,7 @@ update_upgrade_packages() { # Function to install essential security packages install_essential_packages() { - local packages=( + local PACKAGES=( "apt-transport-https" "ca-certificates" "gnupg" @@ -77,18 +79,18 @@ install_essential_packages() { log_message "INFO" "Installing essential security packages" - for package in "${packages[@]}"; do - if ! is_package_installed "$package"; then - log_message "INFO" "Installing $package" - apt-get install -y "$package" + for PACKAGE in "${PACKAGES[@]}"; do + if ! is_package_installed "$PACKAGE"; then + log_message "INFO" "Installing $PACKAGE" + apt-get install -y "$PACKAGE" if [ $? -eq 0 ]; then - log_message "SUCCESS" "Installed $package successfully" + log_message "SUCCESS" "Installed $PACKAGE successfully" else - log_message "ERROR" "Failed to install $package" + log_message "ERROR" "Failed to install $PACKAGE" fi else - log_message "INFO" "$package is already installed" + log_message "INFO" "$PACKAGE is already installed" fi done } diff --git a/modules/wazuh_agent.sh b/modules/wazuh_agent.sh index 7d54ba4..91d56e4 100644 --- a/modules/wazuh_agent.sh +++ b/modules/wazuh_agent.sh @@ -71,10 +71,10 @@ To update the Wazuh manager IP address, edit the following file: $wazuh_conf And change the
tag to point to your Wazuh manager: -
YOUR_WAZUH_MANAGER_IP
+
$YOUR_WAZUH_MANAGER_IP
Then, register the agent with your Wazuh manager: -/var/ossec/bin/agent-auth -m YOUR_WAZUH_MANAGER_IP +/var/ossec/bin/agent-auth -m $YOUR_WAZUH_MANAGER_IP Finally, restart the Wazuh agent: systemctl restart wazuh-agent