Ubuntu Setup/ Security Script

#!/bin/bash

# Define applications to install
APPS=(
    "ufw"
    "curl"
    "wget"
    "git"
    "mc"
    "unattended-upgrades"
    "apt-transport-https"
    "ca-certificates"
    "software-properties-common"
    "mailutils"  # For sending email notifications
    "logwatch"  # For log monitoring and email notifications
    "auditd"
    "audispd-plugins"
    "openssh-server"  # Ensure SSH server is installed
)

# Define email notification settings for unattended upgrades
UNATTENDED_UPGRADES_EMAIL="your-email@example.com"  # Replace with your email address

# Define email notification settings for Logwatch
LOGWATCH_EMAIL="your-email@example.com"  # Replace with your email address

# Define new SSH user settings
NEW_USER="youruser"  # Replace with the desired username
NEW_USER_PASSWORD="yourpassword"  # Replace with the desired password

# Define Ubuntu Pro credentials
UBUNTU_PRO_TOKEN="your_ubuntu_pro_token"  # Replace with your Ubuntu Pro token

# Define the SSH port
SSH_PORT=2222  # Replace with your desired SSH port

# Define your SSH keys in an array
SSH_KEYS=(
    "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArX1... user1@domain.com"
    "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsd2... user2@domain.com"
    "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwq3... user3@domain.com"
)


# Define the second static IP and VLAN configuration for internal use
VLAN_INTERFACE="eth0.100"  # Replace with the desired interface name
VLAN_IP="192.168.100.10/24"  # Replace with the desired static IP and subnet

# Define auditd monitoring script settings
AUDITD_MONITOR_SCRIPT="/usr/local/bin/auditd_monitor.sh"
AUDITD_EMAIL_RECIPIENT="your-email@example.com"  # Replace with your email address
AUDITD_LAST_LINE_FILE="/tmp/auditd_last_line"

# Function to install applications
install_apps() {
    echo "Installing applications..."
    apt update -y
    apt install -y "${APPS[@]}"
}

# Function to configure email notifications for SSH logins
configure_ssh_notifications() {
    echo "Configuring SSH login notifications..."

    # Install mailutils if not already installed
    apt install -y postfix mailutils

    # Create or update the SSH login script
    SSH_LOGIN_SCRIPT="/etc/profile.d/ssh_login_notify.sh"
    cat <<EOF > $SSH_LOGIN_SCRIPT
#!/bin/bash
if [ "\$USER" != "root" ]; then
    SUBJECT="SSH Login Alert"
    MESSAGE="User \${USER} has logged in from \${SSH_CLIENT} on \$(date)"
    echo "\$MESSAGE" | mail -s "\$SUBJECT" "$UNATTENDED_UPGRADES_EMAIL"
fi
EOF
    chmod +x $SSH_LOGIN_SCRIPT
}

# Function to create a new user and disable root access
setup_user_and_disable_root() {
    echo "Creating new user and disabling root access..."

    # Create the new user
    useradd -m -s /bin/bash "$NEW_USER"
    echo "$NEW_USER:$NEW_USER_PASSWORD" | chpasswd

    # Add the new user to the sudo group
    usermod -aG sudo "$NEW_USER"

    # Lock the root account
    passwd -l root

   # Set up the .ssh directory and authorized_keys file
mkdir -p /home/$NEW_USER/.ssh
chmod 700 /home/$NEW_USER/.ssh
touch /home/$NEW_USER/.ssh/authorized_keys
chmod 600 /home/$NEW_USER/.ssh/authorized_keys

# Add each SSH key to the authorized_keys file
for KEY in "${SSH_KEYS[@]}"; do
    echo "$KEY" >> /home/$NEW_USER/.ssh/authorized_keys
done

# Ensure the correct ownership of the .ssh directory and its contents
chown -R $NEW_USER:$NEW_USER /home/$NEW_USER/.ssh
}

# Function to configure SSH with a custom port
configure_ssh_port() {
    echo "Configuring SSH with a custom port..."

    # Use the SSH_PORT variable defined earlier in the script
    # If not defined, it defaults to 2222
    SSH_PORT="${SSH_PORT:-2222}"

    # Create a systemd override directory for SSH
    mkdir -p /etc/systemd/system/ssh.service.d

    # Create a drop-in configuration file to change the SSH port
    cat <<EOF > /etc/systemd/system/ssh.service.d/override.conf
[Service]
ExecStart=
ExecStart=/usr/sbin/sshd -D -p $SSH_PORT
EOF

    # Reload the systemd daemon and restart SSH to apply changes
    systemctl daemon-reload
    systemctl restart ssh

    echo "SSH is now configured to use port $SSH_PORT."
}

# Function to enable Ubuntu Pro updates
enable_ubuntu_pro() {
    echo "Enabling Ubuntu Pro updates..."

    # Install the Ubuntu Pro client
    apt update -y
    apt install -y ubuntu-advantage-tools

    # Attach the Ubuntu Pro token
    ua attach "$UBUNTU_PRO_TOKEN"

    # Enable the relevant Ubuntu Pro services
    ua enable livepatch
    ua enable esm-infra
    ua enable esm-apps

    # Update package lists and upgrade to apply Ubuntu Pro updates
    apt update -y
    apt upgrade -y
}

# Function to apply custom SSHD configuration settings
customize_sshd_config() {
    echo "Applying custom SSHD configuration..."

   # Backup current sshd_config
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# Update or append the SSHD configuration settings
sed -i "s/^#*Port.*/Port $SSH_PORT/" /etc/ssh/sshd_config
sed -i "s/^#*PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config
sed -i "s/^#*PasswordAuthentication.*/PasswordAuthentication no/" /etc/ssh/sshd_config
sed -i "s/^#*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/" /etc/ssh/sshd_config
sed -i "s/^#*UsePAM.*/UsePAM yes/" /etc/ssh/sshd_config

# Allow the new user to connect via SSH
if grep -q "^AllowUsers" /etc/ssh/sshd_config; then
    sed -i "s/^AllowUsers.*/AllowUsers $NEW_USER/" /etc/ssh/sshd_config
else
    echo "AllowUsers $NEW_USER" >> /etc/ssh/sshd_config
fi

# Restart SSH service to apply changes
systemctl restart ssh

}

# Function to configure UFW with rate limiting
configure_firewall() {
    echo "Configuring UFW with rate limiting..."

    # Basic UFW setup
    ufw default deny incoming
    ufw default allow outgoing

    # Allow SSH on the defined port
    ufw allow $SSH_PORT/tcp

    # Enable rate limiting for SSH
    ufw limit $SSH_PORT/tcp

    # Enable the firewall
    ufw enable
}

# Function to configure timesyncd with custom NTP servers
configure_timesyncd() {
    echo "Configuring systemd-timesyncd with custom NTP servers..."

    # Set NTP servers
    sed -i 's/^#NTP=.*/NTP=ntp1.dismail.de ntp2.dismail.de/' /etc/systemd/timesyncd.conf

    # Restart the timesyncd service
    systemctl restart systemd-timesyncd
}

# Function to configure unattended upgrades with email notifications
configure_unattended_upgrades() {
    echo "Configuring unattended upgrades with email notifications..."

    # Configure email notifications for unattended upgrades
    dpkg-reconfigure -plow unattended-upgrades

    # Set email for notifications
    sed -i "s|^//Unattended-Upgrade::Mail.*|Unattended-Upgrade::Mail \"$UNATTENDED_UPGRADES_EMAIL\";|" /etc/apt/apt.conf.d/50unattended-upgrades

    # Enable automatic upgrades
    echo 'APT::Periodic::Update-Package-Lists "1";' >> /etc/apt/apt.conf.d/10periodic
    echo 'APT::Periodic::Unattended-Upgrade "1";' >> /etc/apt/apt.conf.d/10periodic

    systemctl restart unattended-upgrades
}

# Function to configure Logwatch with email notifications
configure_logwatch() {
    echo "Configuring Logwatch with email notifications..."

    # Set email recipient for Logwatch
    sed -i "s/^MailTo =.*/MailTo = $LOGWATCH_EMAIL/" /usr/share/logwatch/default.conf/logwatch.conf
    sed -i "s/Detail =.*/Detail = Med/" /usr/share/logwatch/default.conf/logwatch.conf

    # Run Logwatch daily and send email
    echo "0 0 * * * /usr/sbin/logwatch --output mail --format html --mailto $LOGWATCH_EMAIL --detail high" > /etc/cron.d/logwatch
}

# Function to configure a second static IP for VLAN (internal use)
configure_vlan_ip() {
    echo "Configuring a second static IP for VLAN (internal use)..."

    # Create Netplan configuration for the VLAN
    VLAN_CONFIG_FILE="/etc/netplan/02-vlan-config.yaml"
    cat <<EOF > $VLAN_CONFIG_FILE
network:
  version: 2
  ethernets:
    $VLAN_INTERFACE:
      dhcp4: no
      addresses:
        - $VLAN_IP
EOF

    # Apply the Netplan configuration
    netplan apply
}

# Function to install and configure auditd
configure_auditd() {
    echo "Installing and configuring auditd..."

    # Install auditd
    apt install -y auditd audispd-plugins

    # Enable and start auditd service
    systemctl start auditd
    systemctl enable auditd

    # Configure auditd rules for monitoring important files
    cat <<EOF > /etc/audit/rules.d/audit.rules
# Monitor /etc/passwd
-w /etc/passwd -p wa -k passwd_changes

# Monitor /etc/shadow
-w /etc/shadow -p wa -k shadow_changes

# Monitor /etc/ssh/sshd_config
-w /etc/ssh/sshd_config -p wa -k sshd_config_changes

# Monitor /etc/sudoers
-w /etc/sudoers -p wa -k sudoers_changes
EOF

    # Restart auditd to apply the rules
    systemctl restart auditd

    # Create the auditd monitoring script
    create_auditd_monitor_script
}

# Function to create the auditd monitoring script
create_auditd_monitor_script() {
    echo "Creating auditd monitoring script..."

    cat <<EOF > $AUDITD_MONITOR_SCRIPT
#!/bin/bash

# Define the log file and keywords to monitor
LOG_FILE="/var/log/audit/audit.log"
KEYWORDS=("passwd_changes" "shadow_changes" "sshd_config_changes" "sudoers_changes")

# Define the email recipient
EMAIL_RECIPIENT="$AUDITD_EMAIL_RECIPIENT"

# Define the file to store the last processed line number
LAST_LINE_FILE="$AUDITD_LAST_LINE_FILE"

# Initialize the last line file if it doesn't exist
if [ ! -f \$LAST_LINE_FILE ]; then
    echo "0" > \$LAST_LINE_FILE
fi

# Get the last processed line number
LAST_PROCESSED_LINE=\$(cat \$LAST_LINE_FILE)
CURRENT_LINE=\$(wc -l < \$LOG_FILE)

# Process new lines
if [ "\$CURRENT_LINE" -gt "\$LAST_PROCESSED_LINE" ]; then
    tail -n +\$(expr \$LAST_PROCESSED_LINE + 1) \$LOG_FILE | while read -r line; do
        for keyword in "\${KEYWORDS[@]}"; do
            if echo "\$line" | grep -q "\$keyword"; then
                echo "\$line" | mail -s "Auditd Notification" "\$EMAIL_RECIPIENT"
                echo "Auditd detected: \$keyword" # Optional: log it to the console
            fi
        done
    done
fi

# Update the last processed line number
echo "\$CURRENT_LINE" > \$LAST_LINE_FILE
EOF

    chmod +x $AUDITD_MONITOR_SCRIPT

    # Set up the cron job to run the monitoring script every minute
    (crontab -l 2>/dev/null; echo "* * * * * $AUDITD_MONITOR_SCRIPT") | crontab -
}

# Function to install and configure AppArmor
configure_apparmor() {
    echo "Installing and configuring AppArmor..."

    # Install AppArmor and its utilities
    apt install -y apparmor apparmor-utils

    # Enable and start AppArmor service
    systemctl enable apparmor
    systemctl start apparmor

    # Load default profiles
    apparmor_parser -r /etc/apparmor.d/*

    # Optionally, you can enforce or set profiles to complain mode
    # Example: Enforce AppArmor profiles
    aa-enforce /etc/apparmor.d/*

    # Example: Set AppArmor profiles to complain mode
    # aa-complain /etc/apparmor.d/*

    # Example: Add a custom AppArmor profile (Uncomment and modify as needed)
    # cat <<EOF > /etc/apparmor.d/usr.sbin.yourservice
    # #include <tunables/global>
    # /usr/sbin/yourservice {
    #     # Profile contents
    # }
    # EOF
    # apparmor_parser -r /etc/apparmor.d/usr.sbin.yourservice
}

# Function to install Docker and configure it securely
install_docker() {
    echo "Installing Docker..."

    # Remove any old versions
    apt remove -y docker docker-engine docker.io containerd runc

    # Install packages to allow apt to use a repository over HTTPS
    apt update -y
    apt install -y \
        ca-certificates \
        curl \
        gnupg \
        lsb-release

    # Add Docker's official GPG key
    mkdir -p /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg

    # Set up the Docker repository
    echo \
      "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
      $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null

    # Install Docker Engine, Docker CLI, and Containerd
    apt update -y
    apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

    # Add the new user to the docker group
    usermod -aG docker $NEW_USER

    # Enable and start Docker
    systemctl enable docker
    systemctl start docker

    echo "Docker installation and configuration completed successfully."
}

# Function to harden Docker
harden_docker() {
    echo "Hardening Docker configuration..."

    # Create a Docker daemon configuration file to apply security best practices
    DOCKER_CONFIG_FILE="/etc/docker/daemon.json"
    cat <<EOF > $DOCKER_CONFIG_FILE
{
  "no-new-privileges": true,
  "userns-remap": "default",
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}
EOF

    # Restart Docker to apply the configuration
    systemctl restart docker

    echo "Docker has been hardened with security best practices."
}

# Function to install and configure apticron
install_and_configure_apticron() {
    echo "Installing apticron for update notifications..."

    # Install apticron
    apt install -y apticron

    # Configure apticron email notifications
    APTICRON_EMAIL="your-email@example.com"  # Replace with your email address
    sed -i "s/^EMAIL=.*/EMAIL=\"$APTICRON_EMAIL\"/" /etc/apticron/apticron.conf

    echo "Apticron has been installed and configured to send update notifications to $APTICRON_EMAIL."
}

# Function to configure kernel hardening
configure_kernel_hardening() {
    echo "Configuring kernel hardening settings..."

    cat <<EOF >> /etc/sysctl.conf
# IP Spoofing protection (IPv4)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests (IPv4)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing (IPv4)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Disable source packet routing (IPv6)
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects (IPv4)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Ignore send redirects (IPv6)
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Block SYN attacks (IPv4)
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log martians (IPv4)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Log martians (IPv6)
net.ipv6.conf.all.log_martians = 1
net.ipv6.conf.default.log_martians = 1

# Disable IPv6 router advertisements
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0

# Enable IPv6 privacy extensions
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
EOF

# Apply the changes
sysctl -p
}

# Function to mask sleep, suspend, hibernate, and hybrid-sleep targets
mask_sleep_targets() {
    echo "Masking sleep, suspend, hibernate, and hybrid-sleep targets..."
    systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
}

# Execute the functions to configure the server
install_apps
configure_firewall
configure_timesyncd
customize_sshd_config
configure_unattended_upgrades
configure_logwatch
configure_vlan_ip
configure_auditd
configure_ssh_notifications
setup_user_and_disable_root
enable_ubuntu_pro
configure_apparmor 
install_docker
harden_docker
install_and_configure_apticron
configure_ssh_port
configure_kernel_hardening
mask_sleep_targets

echo "Setup complete! Your server is configured with enhanced security settings."