97 lines
2.5 KiB
Bash
Executable file
97 lines
2.5 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
if [ ${EUID} -ne 0 ]; then
|
|
echo "this script must be run as root" 1>&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "warning: this script will disable ssh password authentication"
|
|
echo -n "contine? [y/N] "
|
|
read answer
|
|
|
|
if [ "${answer}" != "y" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
echo "generating safe moduli"
|
|
if [ -f /etc/ssh/moduli ]; then
|
|
awk '$5 > 2000' /etc/ssh/moduli > /tmp/moduli
|
|
mv /tmp/moduli /etc/ssh/moduli
|
|
else
|
|
ssh-keygen -G /etc/ssh/moduli.all -b 4096
|
|
ssh-keygen -T /etc/ssh/moduli.safe -f /etc/ssh/moduli.all
|
|
mv /etc/ssh/moduli.safe /etc/ssh/moduli
|
|
rm /etc/ssh/moduli.all
|
|
fi
|
|
|
|
echo "cleaning ssh host keys"
|
|
rm /etc/ssh/ssh_host_*key*
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key < /dev/null
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key < /dev/null
|
|
|
|
echo "writing ssh config"
|
|
if [ -f /etc/ssh/sshd_config ]; then
|
|
mv /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
|
fi
|
|
|
|
cat <<EOF > /etc/ssh/sshd_config
|
|
Port 22
|
|
Protocol 2
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
|
|
UsePrivilegeSeparation yes
|
|
SyslogFacility AUTH
|
|
LogLevel INFO
|
|
LoginGraceTime 120
|
|
PermitRootLogin no
|
|
StrictModes yes
|
|
RSAAuthentication no
|
|
PubkeyAuthentication yes
|
|
AuthorizedKeysFile %h/.ssh/authorized_keys
|
|
IgnoreRhosts yes
|
|
RhostsRSAAuthentication no
|
|
HostbasedAuthentication no
|
|
PermitEmptyPasswords no
|
|
ChallengeResponseAuthentication no
|
|
PasswordAuthentication no
|
|
X11Forwarding no
|
|
PrintMotd no
|
|
PrintLastLog yes
|
|
TCPKeepAlive yes
|
|
AcceptEnv LANG LC_*
|
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
UsePAM yes
|
|
EOF
|
|
|
|
echo "enter your username"
|
|
read user
|
|
|
|
if [ -z ${user} ]; then
|
|
echo "error: no user submitted" 1>&2
|
|
mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -d /home/${user}/.ssh ]; then
|
|
mkdir /home/${user}/.ssh
|
|
fi
|
|
chmod 700 /home/${user}/.ssh
|
|
chown ${user}: /home/${user}/.ssh
|
|
|
|
echo "paste your ssh public key"
|
|
read sshkey
|
|
|
|
if [ -z ${sshkey} ]; then
|
|
echo "error: no ssh key submitted" 1>&2
|
|
mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
|
|
exit 1
|
|
fi
|
|
|
|
echo "${sshkey}" > /home/${user}/.ssh/authorized_keys
|
|
chmod 600 /home/${user}/.ssh/authorized_keys
|
|
chown ${user}:root /home/${user}/.ssh/authorized_keys
|
|
|
|
service ssh restart
|