Initial commit.

02-system-setup

@@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Re-generate root's password for longer hash.
+passwd root
+
+# Make Tadgy's account.
+adduser tadgy
+
+# Move the 'console' group.  I dislike it above 100.
+grep "^console:x:101:" /etc/group >/dev/null && groupmod -g 97 console
+grpconv
+
+# Add group 'admin', and make root and Tadgy a member.
+grep "^admin:" /etc/group >/dev/null || groupadd -g 101 admin
+usermod -aG admin root
+usermod -aG admin tadgy
+
+# Restrict access to 'logger', since it can be used to spam the logs.
+chown root:admin /usr/bin/logger
+chmod 750 /usr/bin/logger
+
+# Copy ssh keys into place for root and tadgy.
+mkdir -p -m 0700 /root/.ssh
+cp authorized_keys /root/.ssh
+mkdir -p -m 0700 /home/tadgy/.ssh
+cp authorized_keys /home/tadgy/.ssh
+chown -R tadgy:users /home/tadgy/.ssh
+
+# Encrypt the databases so they can be checked into git.
+echo "Encrypting /etc/shadow..."
+gpg -c -o /etc/shadow.gpg /etc/shadow
+echo "Encrypting /etc/gshadow..."
+gpg -c -o /etc/gshadow.gpg /etc/gshadow
+
+# Create /opt directories.
+mkdir -p -m 755 {/opt,/opt/{bin,include,info,lib64,man,man/man{0..8},sbin,share}}
+
+# Create log archive directories and move old log files.
+[ ! -d /var/log/Archived/pre-sysconfig ] && {
+  mkdir -p -m 750 /var/log/Archived
+  mkdir -p -m 750 /var/log/Archived/pre-sysconfig
+  mv /var/log/{btmp.*,{cron,debug,maillog,messages,secure,spooler,syslog}{,.*}} /var/log/Archived/pre-sysconfig/ 2>/dev/null
+}
+
+# Stop syslog from producing a "MARK" every 20 minutes.
+# -current 20200626 uses /etc/default now, this is not required.
+# sed -i /etc/rc.d/rc.syslog -r -e '/^#SYSLOGD_OPTIONS/ s/#//' -e '/^SYSLOGD_OPTIONS/ s/"-c "$/"-c -m 0"/'
+
+# Restart syslogd.
+/etc/rc.d/rc.syslog restart
+
+# Restart ntpd.
+[ -x /etc/rc.d/rc.ntpd ] && /etc/rc.d/rc.ntpd restart
+
+# Restart sshd.
+/etc/rc.d/rc.sshd restart
+
+# Keep an su'ers log.
+touch /var/log/sulog
+
+# Keep fail2ban logs.
+touch /var/log/fail2ban
+
+# Add an rc.local_shutdown script if it doesn't exist already.
+[ ! -e /etc/rc.d/rc.local_shutdown ] && {
+  echo "#!/bin/sh" >/etc/rc.d/rc.local_shutdown
+  echo "# /etc/rc.d/rc.local_shutdown - Local system shutdown script." >>/etc/rc.d/rc.local_shutdown
+  echo "# This script will be run when the system is shutdown or rebooted." >>/etc/rc.d/rc.local_shutdown
+  chmod 755 /etc/rc.d/rc.local_shutdown
+}
+
+# To clear all ACLs:
+#  setfacl -Rk /path
+#  setfacl -Rd group:admin: /path
+#  setfacl -Rx mask:: /path
+
+# Secure /var/log
+#  Set standard access perms for directories
+setfacl -m user::rwx,group::rx,other::x /var/log/
+setfacl -m user::rwx,group::rx,other::- /var/log/*/ /var/log/*/*/
+#  Set standard access perms for files
+find /var/log -type f -exec setfacl -Rm user::rw,group::r,other::- {} \;
+#  Allow group 'admin' read access to all directories/files
+setfacl -m group:admin:rX /var/log/ /var/log/*/ /var/log/*/*/
+find /var/log -type f -exec setfacl -m group:admin:r {} \;
+#  Set default access for new files in directories.
+setfacl -dm user::rwX,group::rX,other::- /var/log/ /var/log/*/ /var/log/*/*/
+setfacl -dm group:admin:rX /var/log/  /var/log/*/ /var/log/*/*/
+# /var/log/wtmp needs to be readable by everyone
+setfacl -m user::rw,group::r,other::r /var/log/wtmp
+
+# Secure /root
+#  Set standard access perms for directories
+find /root -type d -exec setfacl -m user::rwx,group::rx,other::- {} \;
+#  Set standard access perms for files
+find /root -type f -exec setfacl -m user::rwX,group::rX,other::- {} \;
+#  Allow group 'admin' read access to all files/dirs
+find /root -type d -exec setfacl -m group:admin:rX {} \;
+find /root -type f -exec setfacl -m group:admin:rX {} \;
+#  Set default access for new files/dirs
+find /root -type d -exec setfacl -dm user::rwX,group::rX,other::- {} \;
+find /root -type d -exec setfacl -dm group:admin:rX {} \;
+
+# Clean up some cruft.
+rm -rf /etc/nntpserver /etc/lilo.conf_example
+rm -rf /usr/{local/games,local/man/cat*,man/cat*} /var/man
+
+# Finally, check for FIXMEs.
+echo "There may be some FIXMEs to attend to:"
+grep -R FIXME /etc | egrep -v "^/etc/(\.git|file|magic|misc)"