PTah
79 lines
2.3 KiB
Bash
79 lines
2.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Безопасное применение SSH lockdown-профиля (AllowUsers/Match Address).
|
|
#
|
|
# По умолчанию использует шаблон:
|
|
# ssh/sshd_config.d/95-owngit-lockdown.conf.example
|
|
# и устанавливает как:
|
|
# /etc/ssh/sshd_config.d/95-owngit-lockdown.conf
|
|
#
|
|
# Перед запуском обязательно отредактируйте пользователей в шаблоне.
|
|
|
|
SOURCE_CONF="${SOURCE_CONF:-ssh/sshd_config.d/95-owngit-lockdown.conf.example}"
|
|
TARGET_DIR="${TARGET_DIR:-/etc/ssh/sshd_config.d}"
|
|
TARGET_CONF="${TARGET_DIR}/95-owngit-lockdown.conf"
|
|
BACKUP_DIR="${BACKUP_DIR:-/root/ssh-hardening-backups}"
|
|
DATE_TAG="$(date +%Y%m%d-%H%M%S)"
|
|
REQUIRE_ALLOWUSERS="${REQUIRE_ALLOWUSERS:-true}"
|
|
|
|
if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
|
|
echo "[ERR] Run as root (sudo)."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "$SOURCE_CONF" ]]; then
|
|
echo "[ERR] Source file not found: $SOURCE_CONF"
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v sshd >/dev/null 2>&1; then
|
|
echo "[ERR] sshd not found."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$REQUIRE_ALLOWUSERS" == "true" ]]; then
|
|
if ! grep -Eq '^[[:space:]]*AllowUsers[[:space:]]+[a-zA-Z0-9._-]+' "$SOURCE_CONF"; then
|
|
echo "[ERR] SOURCE_CONF must contain non-empty AllowUsers line before apply."
|
|
echo " Edit: $SOURCE_CONF"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
mkdir -p "$TARGET_DIR" "$BACKUP_DIR"
|
|
|
|
echo "[INFO] Backing up current sshd include config..."
|
|
if [[ -f "$TARGET_CONF" ]]; then
|
|
cp -a "$TARGET_CONF" "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak"
|
|
fi
|
|
|
|
echo "[INFO] Installing lockdown config -> $TARGET_CONF"
|
|
cp -a "$SOURCE_CONF" "$TARGET_CONF"
|
|
chmod 0644 "$TARGET_CONF"
|
|
|
|
echo "[INFO] Validating sshd config..."
|
|
if ! sshd -t; then
|
|
echo "[ERR] sshd -t failed, rolling back"
|
|
if [[ -f "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak" ]]; then
|
|
cp -a "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak" "$TARGET_CONF"
|
|
else
|
|
rm -f "$TARGET_CONF"
|
|
fi
|
|
exit 1
|
|
fi
|
|
|
|
echo "[INFO] Reloading ssh service..."
|
|
if systemctl reload ssh; then
|
|
echo "[OK] ssh reloaded"
|
|
elif systemctl reload sshd; then
|
|
echo "[OK] sshd reloaded"
|
|
else
|
|
echo "[ERR] failed to reload ssh service"
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
echo "[NEXT] Open a NEW terminal and verify access first:"
|
|
echo " ssh <allowed-user>@<your-server>"
|
|
echo "If access fails, restore file from $BACKUP_DIR."
|