Initial own-git docs, configs, scripts, and hardening pack

2026-04-21 21:37:43 +10:00
commit f5899ebc56
25 changed files with 1843 additions and 0 deletions
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Безопасное применение SSH lockdown-профиля (AllowUsers/Match Address).
+#
+# По умолчанию использует шаблон:
+#   ssh/sshd_config.d/95-owngit-lockdown.conf.example
+# и устанавливает как:
+#   /etc/ssh/sshd_config.d/95-owngit-lockdown.conf
+#
+# Перед запуском обязательно отредактируйте пользователей в шаблоне.
+
+SOURCE_CONF="${SOURCE_CONF:-ssh/sshd_config.d/95-owngit-lockdown.conf.example}"
+TARGET_DIR="${TARGET_DIR:-/etc/ssh/sshd_config.d}"
+TARGET_CONF="${TARGET_DIR}/95-owngit-lockdown.conf"
+BACKUP_DIR="${BACKUP_DIR:-/root/ssh-hardening-backups}"
+DATE_TAG="$(date +%Y%m%d-%H%M%S)"
+REQUIRE_ALLOWUSERS="${REQUIRE_ALLOWUSERS:-true}"
+
+if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
+  echo "[ERR] Run as root (sudo)."
+  exit 1
+fi
+
+if [[ ! -f "$SOURCE_CONF" ]]; then
+  echo "[ERR] Source file not found: $SOURCE_CONF"
+  exit 1
+fi
+
+if ! command -v sshd >/dev/null 2>&1; then
+  echo "[ERR] sshd not found."
+  exit 1
+fi
+
+if [[ "$REQUIRE_ALLOWUSERS" == "true" ]]; then
+  if ! grep -Eq '^[[:space:]]*AllowUsers[[:space:]]+[a-zA-Z0-9._-]+' "$SOURCE_CONF"; then
+    echo "[ERR] SOURCE_CONF must contain non-empty AllowUsers line before apply."
+    echo "      Edit: $SOURCE_CONF"
+    exit 1
+  fi
+fi
+
+mkdir -p "$TARGET_DIR" "$BACKUP_DIR"
+
+echo "[INFO] Backing up current sshd include config..."
+if [[ -f "$TARGET_CONF" ]]; then
+  cp -a "$TARGET_CONF" "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak"
+fi
+
+echo "[INFO] Installing lockdown config -> $TARGET_CONF"
+cp -a "$SOURCE_CONF" "$TARGET_CONF"
+chmod 0644 "$TARGET_CONF"
+
+echo "[INFO] Validating sshd config..."
+if ! sshd -t; then
+  echo "[ERR] sshd -t failed, rolling back"
+  if [[ -f "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak" ]]; then
+    cp -a "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak" "$TARGET_CONF"
+  else
+    rm -f "$TARGET_CONF"
+  fi
+  exit 1
+fi
+
+echo "[INFO] Reloading ssh service..."
+if systemctl reload ssh; then
+  echo "[OK] ssh reloaded"
+elif systemctl reload sshd; then
+  echo "[OK] sshd reloaded"
+else
+  echo "[ERR] failed to reload ssh service"
+  exit 1
+fi
+
+echo
+echo "[NEXT] Open a NEW terminal and verify access first:"
+echo "  ssh <allowed-user>@<your-server>"
+echo "If access fails, restore file from $BACKUP_DIR."