From: Christian Heller Date: Sun, 27 Aug 2023 01:40:11 +0000 (+0200) Subject: Add first steps to Bookworm server setup. X-Git-Url: https://plomlompom.com/repos/%7B%7Bdb.prefix%7D%7D/%7B%7B%20web_path%20%7D%7D/%7B%7Bprefix%7D%7D/new_day?a=commitdiff_plain;h=84a4ad59ae43f71230485fe43be35df39f147890;p=config Add first steps to Bookworm server setup. --- diff --git a/bookworm/etc_files/server/etc/ssh/sshd_config b/bookworm/etc_files/server/etc/ssh/sshd_config new file mode 100644 index 0000000..94363eb --- /dev/null +++ b/bookworm/etc_files/server/etc/ssh/sshd_config @@ -0,0 +1,122 @@ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin no +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +ClientAliveInterval 15 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/bookworm/setup_scripts/init_user_login.sh b/bookworm/setup_scripts/init_user_login.sh new file mode 100755 index 0000000..78a891b --- /dev/null +++ b/bookworm/setup_scripts/init_user_login.sh @@ -0,0 +1,39 @@ +#!/bin/sh +# This script assumes a server with key-based root access into one of +# key-based access only to a new non-root account plom. +# +# CAUTION: This is optimized for a *fresh* setup. It will overwrite any +# old /etc/ssh/sshd_config. +# +# Dependencies: ssh, scp, properly configured sshd_config file in reach. +set -e +set -x +. ./misc.sh + +# Location of an sshd_config with "PermitRootLogin no" and +# "PasswordAuthentication no". +linkable_files_dir="${config_tree_prefix}/etc_files/server" +system_path_sshd_config='/etc/ssh/sshd_config' +local_path_sshd_config="${linkable_files_dir}${system_path_sshd_config}" + +expect_n_args 1 "(server)" "$@" +server="$1" + +# So we're only asked once … +eval $(ssh-agent) +ssh-add + +# # This will be used to log-in as root from plom account. +# echo 'Asking for new root password.' +# ssh root@"${server}" "passwd" +# +# # Set up plom's ~/.ssh/authorized_keys from root's. +# ssh root@"${server}" 'useradd -m plom' +# ssh root@"${server}" 'mkdir /home/plom/.ssh' +# ssh root@"${server}" 'chown plom:plom /home/plom/.ssh' +# ssh root@"${server}" 'cp /root/.ssh/authorized_keys /home/plom/.ssh/' +# ssh root@"${server}" 'chown plom:plom /home/plom/.ssh/authorized_keys' + +# Set up SSH config and remove direct SSH login to root. +scp "${local_path_sshd_config}" root@"${server}":"${system_path_sshd_config}" +ssh root@"${server}" 'rm -rf /root/.ssh && service ssh restart' diff --git a/bookworm/setup_scripts/misc.sh b/bookworm/setup_scripts/misc.sh index e1d417f..cc93c32 100644 --- a/bookworm/setup_scripts/misc.sh +++ b/bookworm/setup_scripts/misc.sh @@ -2,7 +2,10 @@ set -e debian_version="bookworm" legal_system_names="x220 w530" -config_tree_prefix="${HOME}/config/${debian_version}" +config_tree_prefix="${HOME}/public_repos/config/${debian_version}" +if [ ! -d "${config_tree_prefix}" ]; then + config_tree_prefix="${HOME}/config/${debian_version}" +fi setup_scripts_dir="${config_tree_prefix}/setup_scripts" aptmark_dir="${config_tree_prefix}/apt-mark"