Initial own-git docs, configs, scripts, and hardening pack

2026-04-21 21:37:43 +10:00
commit f5899ebc56
25 changed files with 1843 additions and 0 deletions
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Безопасное применение SSH hardening-конфига.
+# Делает backup текущих конфигов, ставит include-конфиг, валидирует `sshd -t`
+# и перезагружает ssh только если конфиг валиден.
+#
+# ВАЖНО:
+# - запускать из уже открытой SSH-сессии не страшно, но не закрывайте текущую
+#   сессию, пока не проверите вход новой.
+
+SOURCE_CONF="${SOURCE_CONF:-ssh/sshd_config.d/90-owngit-hardening.conf}"
+TARGET_DIR="${TARGET_DIR:-/etc/ssh/sshd_config.d}"
+TARGET_CONF="${TARGET_DIR}/90-owngit-hardening.conf"
+BACKUP_DIR="${BACKUP_DIR:-/root/ssh-hardening-backups}"
+DATE_TAG="$(date +%Y%m%d-%H%M%S)"
+MGMT_SSH_PORT="${MGMT_SSH_PORT:-22}"
+
+if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
+  echo "[ERR] Run as root (sudo)."
+  exit 1
+fi
+
+if [[ ! -f "$SOURCE_CONF" ]]; then
+  echo "[ERR] Source file not found: $SOURCE_CONF"
+  exit 1
+fi
+
+if ! command -v sshd >/dev/null 2>&1; then
+  echo "[ERR] sshd not found."
+  exit 1
+fi
+
+mkdir -p "$TARGET_DIR" "$BACKUP_DIR"
+
+echo "[INFO] Backing up current ssh config..."
+if [[ -f /etc/ssh/sshd_config ]]; then
+  cp -a /etc/ssh/sshd_config "${BACKUP_DIR}/sshd_config.${DATE_TAG}.bak"
+fi
+if [[ -d /etc/ssh/sshd_config.d ]]; then
+  tar -C /etc/ssh -czf "${BACKUP_DIR}/sshd_config.d.${DATE_TAG}.tar.gz" sshd_config.d
+fi
+
+echo "[INFO] Installing hardening config to ${TARGET_CONF}"
+cp -a "$SOURCE_CONF" "$TARGET_CONF"
+chmod 0644 "$TARGET_CONF"
+
+echo "[INFO] Ensuring management SSH port ${MGMT_SSH_PORT} remains allowed in effective config"
+if ! sshd -T | grep -q "^port ${MGMT_SSH_PORT}$"; then
+  echo "[WARN] Effective sshd port is not ${MGMT_SSH_PORT}. Check your base sshd_config."
+fi
+
+echo "[INFO] Validating sshd config..."
+if sshd -t; then
+  echo "[OK] sshd config is valid"
+else
+  echo "[ERR] sshd config test failed, restoring previous state"
+  rm -f "$TARGET_CONF"
+  if [[ -f "${BACKUP_DIR}/sshd_config.${DATE_TAG}.bak" ]]; then
+    cp -a "${BACKUP_DIR}/sshd_config.${DATE_TAG}.bak" /etc/ssh/sshd_config
+  fi
+  exit 1
+fi
+
+echo "[INFO] Reloading ssh service..."
+if systemctl reload ssh; then
+  echo "[OK] ssh reloaded"
+elif systemctl reload sshd; then
+  echo "[OK] sshd reloaded"
+else
+  echo "[ERR] failed to reload ssh service"
+  exit 1
+fi
+
+echo
+echo "[NEXT] Verify from a new terminal before closing current session:"
+echo "  ssh -p ${MGMT_SSH_PORT} <your-user>@<your-server>"
+echo "If login fails, restore backups from ${BACKUP_DIR}."