#!
/bin/bash
if [ -r Ubuntu.conf ]; then
#Load Config Values
source Ubuntu.conf
#Get updates
if [ "$UPDATES" = true ]; then
echo "getting updates"
apt-get update -y
fi #UPDATES
#Install and enable auditing
if [ "$AUDITING" = true ]; then
echo "Installing auditing daemon"
apt-get install auditd -y
echo "enabling auditing"
auditctl -e 1 > /var/local/audit.log
fi #AUDITING
#Install Uncomplicated Firewall (UFW)
if [ "$FIREWALL" = true ]; then
echo "installing Uncomplicated firewall"
apt-get install ufw -y
fi #FIREWALL
#Install openssh-server
if [ "$INSTALL_SSH_SERVER" = true ]; then
apt-get install openssh-server -y
fi #INSTALL_SSH_SERVER
#Upgrade all installed packages
if [ "$UPGRADES" = true ]; then
echo "installing updates"
apt-get dist-upgrade -y
fi #UPGRADES
#Clean up unnecessary junk
if [ "$CLEAN" = true ]; then
echo "running autoclean and autoremove"
apt-get autoclean -y
apt-get autoremove -y
fi #CLEAN
#enable UFW
if [ "$FIREWALL" = true ]; then
echo "enabling UFW"
ufw enable
fi #FIREWALL
#make log dir
echo "creating /var/local"
mkdir /var/local/
#Create/clear log files
echo "creating log files in /var/local"
echo -n "" > /var/local/netstat.log
echo -n "" > /var/local/ASAO.log
echo -n "" > /var/local/mediafiles.log
echo -n "" > /var/local/cronjoblist.log
echo -n "" > /var/local/pslist.log
#Add additional instructions to log file
echo "adding instructions to log file"
echo "getent group <groupname> |||| Users in group" >> /var/local/ASAO.log
echo "edit /etc/audit/auditd.conf" >> /var/local/ASAO.log
echo "Don't Forget to Restart" >> /var/local/ASAO.log
echo "more password stuff @ https://www.cyberciti.biz/tips/linux-check-passwords-
against-a-dictionary-attack.html" >> /var/local/ASAO.log
#Install libpam-cracklib which is used to check passwords
if [ "$LPAMCLIB" = true ]; then
echo "installing libpam-cracklib for passwords"
apt-get install libpam-cracklib -y
fi #LPAMCLIB
#Pam config
if [ "$PAMCONF" = true ]; then
echo "changing PAM config"
#grep for 'pam_unix.so' and get line number
PAMUNIX="$(grep -n 'pam_unix.so' /etc/pam.d/common-password | grep -v '#' | cut
-f1 -d:)"
sed -e "${PAMUNIX}s/.*/password [success=1 default=ignore] pam_unix.so
obscure use_authtok try_first_pass sha512 remember=5/" /etc/pam.d/common-password >
/var/local/temp.txt
#grep for 'pam_cracklib.so' and get line number
PAMCRACKLIB="$(grep -n 'pam_cracklib.so' /etc/pam.d/common-password | grep -v
'#' | cut -f1 -d:)"
sed -e "${PAMCRACKLIB}s/.*/password requisite pam_cracklib.so retry=3
minlen=8 difok=3 ucredit=-1 1credit=-2 ocredit=-1/" /var/local/temp.txt >
/var/local/temp2.txt
rm /var/local/temp.txt
mv /etc/pam.d/common-password /etc/pam.d/common-password.old
mv /var/local/temp2.txt /etc/pam.d/common-password
fi #PAMCONF
#Password aging policy
if [ "$PSAGE" = true ]; then
echo "setting passwords to reset after 30 days"
PASSMAX="$(grep -n 'PASS_MAX_DAYS' /etc/login.defs | grep -v '#' | cut -f1 -
d:)"
sed -e "${PASSMAX}s/.*/PASS_MAX_DAYS 90/" /etc/login.defs >
/var/local/temp1.txt
PASSMIN="$(grep -n 'PASS_MIN_DAYS' /etc/login.defs | grep -v '#' | cut -f1 -
d:)"
sed -e "${PASSMIN}s/.*/PASS_MIN_DAYS 10/" /var/local/temp1.txt >
/var/local/temp2.txt
PASSWARN="$(grep -n 'PASS_WARN_AGE' /etc/login.defs | grep -v '#' | cut -f1 -
d:)"
sed -e "${PASSWARN}s/.*/PASS_WARN_AGE 7/" /var/local/temp2.txt >
/var/local/temp3.txt
mv /etc/login.defs /etc/login.defs.old
mv /var/local/temp3.txt /etc/login.defs
rm /var/local/temp1.txt /var/local/temp2.txt
fi #PSAGE
#Password Lockout
if [ "$PSLOCKOUT" = true ]; then
echo "Enabling account lockout"
cp /etc/pam.d/common-auth /etc/pam.d/common-auth.old
echo "auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800" >>
/etc/pam.d/common-auth
fi #PSLOCKOUT
#SSH daemon config
if [ "$DISABLE_ROOT_SSH" = true ]; then
echo "disabling root login"
#get the line number of the PermitRootLogin line
PRL="$(grep -n 'PermitRootLogin' /etc/ssh/sshd_config | grep -v '#' | cut -f1 -
d:)"
sed -e "${PRL}s/.*/PermitRootLogin no/" /etc/ssh/sshd_config >
/var/local/temp1.txt
mv /etc/ssh/sshd_config /etc/ssh/sshd_config.old
mv /var/local/temp1.txt /etc/ssh/sshd_config
fi #DISABLE_ROOT_SSH
#Disable the guest account
if [ "$DISABLE_GUEST" = true ]; then
echo "disabling guest account"
cp /etc/lightdm/lightdm.conf /etc/lightdm/lightdm.conf.old
echo "allow-guest=false" >> /etc/lightdm/lightdm.conf
fi #DISABLE_GUEST
#Find all video files
if [ "$MEDIA_LOCATIONS" = true ]; then
echo "Finding Media Files"
echo "||||Video Files||||" >> /var/local/mediafiles.log
locate *.mkv *.webm *.flv *.vob *.ogv *.drc *.gifv *.mng *.avi$ *.mov *.qt
*.wmv *.yuv *.rm *.rmvb *.asf *.amv *.mp4$ *.m4v *.mp *.m?v *.svi *.3gp *.flv *.f4v
>> /var/local/mediafiles.log
echo "||||Audo Files||||" >> /var/local/mediafiles.log
locate *.3ga *.aac *.aiff *.amr *.ape *.arf *.asf *.asx *.cda *.dvf *.flac
*.gp4 *.gp5 *.gpx *.logic *.m4a *.m4b *.m4p *.midi *.mp3 *.pcm *.rec *.snd *.sng
*.uax *.wav *.wma *.wpl *.zab >> /var/local/mediafiles.log
fi #MEDIA_LOCATIONS
#Lists all cronjobs & output to /var/local/cronjoblist.log
if [ "$LOG_CRON" = true ]; then
echo "Outputting cronjobs to /var/local/cronjoblist.log"
crontab -l >> /var/local/cronjoblist.log
fi #LOG_CRON
#List all processes & output to /var/local/pslist.log
if [ "$PS_LOG" = true ]; then
echo "Outputting processes to /var/local/pslist.log"
ps axk start_time -o start_time,pid,user,cmd >> /var/local/pslist.log
fi #PS_LOG
#List all connections, open or listening
if [ "$LOG_NETSTAT" = true ]; then
echo "finding open connections and outputting to /var/local/netstat.log"
ss -an4 > /var/local/netstat.log
fi #LOG_NETSTAT
#Install clam antivirus
if [ "$INSTALL_CLAM" = true ]; then
echo "installing clam antivirus"
apt-get install clamav -y
fi #INSTALL_CLAM
#Run clamav
if [ "$CLAM_HOME" = true ]; then
#Update clam signatures
echo "updating clam signatures"
freshclam
#Run a full scan of the "/home" directory
echo "running full scan of /home directory"
clamscan -r /home
fi #CLAM_HOME
elif [ -f Ubuntu.conf ]; then
echo "The file 'Ubuntu.conf' exists but is not readable to the script"
else
echo "The file 'Ubuntu.conf' is missing. Please download it before running the
script"
fi #Ubuntu.conf
