Hardening_nw

Publicado: Jun 5, 2019

##  Instala claves RSA para acceso remoto SSH
###  clave-temporal3
cd ;mkdir .ssh; echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAs6FGOsygl9a3kl1Zbz22CZxD5YibQxcf9zZdtVZyXTr+MGvIyUGez6xuJxc/nPcKHVddFd2O7EhKr1o8is0aD3JPHOB0XOdZCuA/8KP4UPLpu2nGzFSgOO6/hCCE2d0FWF/AYEiFnoDMP7JRKP9fKPn6s4tl3ZWXERwsqVuz6dKLtpfQNS2mhbBK8B8d8QPJtZdbplOBA1Zxbx+hxVCqQYgD0woCdGelMzCkwYarohltUgHL88DyUT3SkLbqGO7fU619lYlXtUeB7RH+Tkb+dYvhp1JgyNXlTikiKw86nZmiOrnUR425QAuEEGvYxqkBHbH5cIFCkTPUsPxAOB1tZw== clave-temporal3" >>   ~/.ssh/authorized_keys

# Actualizar
apt-get update
apt-get -y upgrade
apt-get -y dist-upgrade
echo;echo;echo;
#instalar utilidades Varias. (a veces falla justo despues de actualizar(repetir comando))
sleep 20;apt-get -y install mc htop curl wget socat iftop iotop p7zip nano screen ncurses-term net-tools

# Aviso l iniciar la maquina
echo "(sleep 5;ip=\$(curl whatismyip.akamai.com);curl -v -k 'https://api.telegram.org/bot373675443:AAHsoXtq8WRhpoKga-TUuo8x-PouqUspnUI/sendMessage?chat_id=249163929&text=nw_IniciadaOK+ip:'\$ip)"\& >> /etc/rc.local

# Informacion y avisos al inicio sesion
echo echo /etc/profile >> /etc/profile
echo uname -a >> /etc/profile
echo lsb_release -a >> /etc/profile
echo curl ipinfo.io  >> /etc/profile
echo "(curl -s -k 'https://api.telegram.org/bot373675443:AAHsoXtq8WRhpoKga-TUuo8x-PouqUspnUI/sendMessage?chat_id=249163929&text=nw+etc+profile+Aviso+Conexion+Usuario:+'\$USER+IP:+\$SSH_CLIENT > /dev/null)&" >> /etc/profile

## Seguridad SSH Añadidas
### Desabilitar autentificacion por contraseÃ±a Fuerza el uso de Keys
cat /etc/ssh/sshd_config |grep Password
sed -i 's/^#PasswordAuthentication yes.*/#PasswordAuthentication yes\nPasswordAuthentication no/g' /etc/ssh/sshd_config
sed -i 's/^PasswordAuthentication yes.*/PasswordAuthentication no/g' /etc/ssh/sshd_config
cat /etc/ssh/sshd_config |grep Password

### Desabilitar autentificacion usuario root (ojo antes prueba ssh con otro usuario )
cat /etc/ssh/sshd_config |grep PermitRootLogin
sed -i 's/^PermitRootLogin yes.*/PermitRootLogin no/g' /etc/ssh/sshd_config
cat /etc/ssh/sshd_config |grep PermitRootLogin

## LoginGraceTime a 5 segudos superbestia
cat /etc/ssh/sshd_config |grep LoginGraceTime
sed -i 's/^LoginGraceTime.*/LoginGraceTime 2/g' /etc/ssh/sshd_config
cat /etc/ssh/sshd_config |grep LoginGraceTime

## Limito a2 conexiones activas :despues tiro50% y despues tiro100%
cat /etc/ssh/sshd_config |grep MaxStartups
sed -i 's/^MaxStartups.*/MaxStartups 2:50:90/g' /etc/ssh/sshd_config
sed -i 's/^#MaxStartups.*/MaxStartups 2:50:90/g' /etc/ssh/sshd_config
cat /etc/ssh/sshd_config |grep MaxStartups

## comprobacion Seguridades SSH
echo;echo;
cat /etc/ssh/sshd_config |grep Password
cat /etc/ssh/sshd_config |grep Protocol
cat /etc/ssh/sshd_config |grep Login
cat /etc/ssh/sshd_config |grep MaxStartups

## Cambiar timezone: dpkg-reconfigure tzdata
cat /etc/timezone
echo Europe/Madrid > /etc/timezone
sleep 1
dpkg-reconfigure -f noninteractive tzdata
echo;echo;#comprobacion
cat /etc/timezone
#COMPRUEBO LA HORA
date