Update DebianTweaks.sh

DebianTweaks.sh

@@ -1,110 +1,185 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-#deze packages zijn nodig
+set -euo pipefail
-apt install snmpd postfix curl figlet wget gnupg2 -y
+
+if [[ $EUID -ne 0 ]]; then
+    echo "Dit script moet als root worden uitgevoerd."
+    exit 1
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+
+echo "===================="
+echo "Installing packages"
+
+apt update
+apt install fortune cowsay snmpd postfix curl figlet wget gnupg2 -y
+
+
+echo "===================="
+echo "Configuring mail"
 
-echo "--------------------"
-echo Set the correct mailer fqdn
 hostname -f > /etc/mailname
 
-echo "--------------------"
+if ! grep -q "root: thomas@de-roo.org" /etc/aliases; then
-echo Forward mail to root
+    echo "root: thomas@de-roo.org" >> /etc/aliases
-echo root: thomas@de-roo.org >> /etc/aliases
+fi
-/usr/bin/newaliases
 
-echo "--------------------"
+newaliases
-echo Add mailto address in crontab
-awk '/PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin/ { print; print "MAILTO=thomas@de-roo.org"; next }1' /etc/crontab > /tmp/crontab.temp
-cat /tmp/crontab.temp > /etc/crontab
-rm /tmp/crontab.temp
 
-echo "--------------------"
-echo Better logon-message
-figlet "$(hostname)">/etc/motd
 
-echo "--------------------"
+echo "===================="
-echo Apt Updates
+echo "Configuring cron mail"
-curl -s https://git.de-roo.org/DEROO/apt-update/raw/branch/main/apt-update.sh -o /usr/local/bin/apt-update.sh
+
-chmod a+x /usr/local/bin/apt-update.sh
+if ! grep -q "MAILTO=thomas@de-roo.org" /etc/crontab; then
-echo 0 0 * * * root /usr/local/bin/apt-update.sh >> /etc/crontab
+    sed -i '/^PATH=.*\/usr\/bin/a MAILTO=thomas@de-roo.org' /etc/crontab
+fi
+
+
+echo "===================="
+echo "Installing MOTD"
+
+cat > /usr/local/bin/update-motd.sh << 'EOF'
+#!/usr/bin/env bash
+
+{
+    figlet "$(hostname)"
+    fortune | cowsay -k tux
+} > /etc/motd
+EOF
+
+chmod +x /usr/local/bin/update-motd.sh
+
+if ! grep -q "update-motd.sh" /etc/crontab; then
+    echo "0 0 * * * root /usr/local/bin/update-motd.sh" >> /etc/crontab
+fi
+
+/usr/local/bin/update-motd.sh
+
+
+echo "===================="
+echo "Installing apt updater"
+
+curl -fsSL \
+https://git.de-roo.org/DEROO/apt-update/raw/branch/main/apt-update.sh \
+-o /usr/local/bin/apt-update.sh
+
+chmod +x /usr/local/bin/apt-update.sh
+
+if ! grep -q "apt-update.sh" /etc/crontab; then
+    echo "5 0 * * * root /usr/local/bin/apt-update.sh" >> /etc/crontab
+fi
+
+
+echo "===================="
+echo "Configuring SNMP"
 
-echo "--------------------"
-echo SNMP things. N.B.: replace VULHIERDELOCATIEIN later
 cat > /etc/snmp/snmpd.conf << 'EOF'
-sysLocation  VULHIERDELOCATIEIN
+sysLocation VULHIERDELOCATIEIN
-sysContact   Thomas de Roo <thomas@de-roo.org>
+sysContact Thomas de Roo <thomas@de-roo.org>
-rocommunity  cacti
+
-rocommunity  librenms
+rocommunity cacti
+rocommunity librenms
+
 includeAllDisks 10%
 
-#OS Distribution Detection
 extend distro /usr/bin/distro
 
-#Hardware Detection
-# (uncomment for x86 platforms)
 extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor'
 extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name'
 extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial'
-
-# (uncomment for ARM platforms)
-#extend hardware '/bin/cat /sys/firmware/devicetree/base/model'
-#extend serial '/bin/cat /sys/firmware/devicetree/base/serial-number'
 EOF
 
-curl -s -o /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
-chmod a+x /usr/bin/distro
-echo @reboot root chmod 444 /sys/devices/virtual/dmi/id/product_serial >> /etc/crontab
-chmod 444 /sys/devices/virtual/dmi/id/product_serial
-systemctl restart snmpd
 
-echo "--------------------"
+curl -fsSL \
-echo  Debian Trixie apt sources
+-o /usr/bin/distro \
+https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
+
+chmod +x /usr/bin/distro
+
+systemctl restart snmpd
+systemctl enable snmpd
+
+
+echo "===================="
+echo "Configuring Debian repositories"
+
 cat > /etc/apt/sources.list << "EOF"
 deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
 deb-src http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
-deb http://deb.debian.org/debian-security/ trixie-security main contrib non-free non-free-firmware
+
-deb-src http://deb.debian.org/debian-security/ trixie-security main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware
+deb-src http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware
+
 deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
 deb-src http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
 EOF
-cd $HOME
+
-wget https://www.deb-multimedia.org/pool/main/d/deb-multimedia-keyring/deb-multimedia-keyring_2024.9.1_all.deb
+
-apt install ./deb-multimedia-keyring_2024.9.1_all.deb
+echo "===================="
-cat >> /etc/apt/sources.list.d/multimedia.list << "EOF"
+echo "Adding multimedia repository"
+
+cd /tmp
+
+wget -q \
+https://www.deb-multimedia.org/pool/main/d/deb-multimedia-keyring/deb-multimedia-keyring_2024.9.1_all.deb
+
+apt install ./deb-multimedia-keyring_2024.9.1_all.deb -y
+
+cat > /etc/apt/sources.list.d/multimedia.list << "EOF"
 deb [arch=amd64 signed-by=/usr/share/keyrings/deb-multimedia-keyring.pgp] https://www.deb-multimedia.org trixie main non-free
 EOF
-#curl -s https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo sh -c 'gpg --dearmor > /usr/share/keyrings/google-chrome-keyring.gpg'
+
-#cat >> /etc/apt/sources.list.d/chrome.list << "EOF"
+
-#deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main
+echo "===================="
-#EOF
+echo "Adding Microsoft repository"
-curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /usr/share/keyrings/packages.microsoft.gpg
+
-cat >> /etc/apt/sources.list.d/microsoft.list << "EOF"
+curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
+| gpg --dearmor \
+> /usr/share/keyrings/packages.microsoft.gpg
+
+cat > /etc/apt/sources.list.d/microsoft.list << "EOF"
 deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/debian/12/prod bookworm main
 deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm main
 deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] http://packages.microsoft.com/repos/code stable main
 EOF
 
 
+echo "===================="
+echo "Adding Brave repository"
 
-echo "--------------------"
+curl -fsSLo \
-echo Brave browser
+/usr/share/keyrings/brave-browser-archive-keyring.gpg \
-apt install curl
+https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
-curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
-echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main"|tee /etc/apt/sources.list.d/brave-browser-release.list
-apt update
-#apt install brave-browser
 
-
+cat > /etc/apt/sources.list.d/brave-browser-release.list << "EOF"
-echo "--------------------"
+deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main
-echo  osquery
-mkdir -p /etc/apt/keyrings
-curl -fsSLo /usr/share/keyrings/osquery-keyring.gpg https://pkg.osquery.io/deb/pubkey.gpg
-cat >> /etc/apt/sources.list.d/osquery.list << "EOF"
-deb [trusted=yes signed-by=/usr/share/keyrings/osquery-keyring.gpg] https://pkg.osquery.io/deb deb main
 EOF
+
+
 apt update
-apt install -y osquery
+
-cat >> /etc/osquery/osquery.conf << "EOF"
+
+echo "===================="
+echo "Installing osquery"
+
+mkdir -p /etc/apt/keyrings
+
+curl -fsSLo \
+/usr/share/keyrings/osquery-keyring.gpg \
+https://pkg.osquery.io/deb/pubkey.gpg
+
+
+cat > /etc/apt/sources.list.d/osquery.list << "EOF"
+deb [signed-by=/usr/share/keyrings/osquery-keyring.gpg] https://pkg.osquery.io/deb deb main
+EOF
+
+
+apt update
+apt install osquery -y
+
+
+cat > /etc/osquery/osquery.conf << "EOF"
 {
     "options": {
         "config_plugin": "filesystem",
@@ -114,40 +189,45 @@ cat >> /etc/osquery/osquery.conf << "EOF"
 
     "schedule": {
         "system_info": {
-        "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
+            "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
-        "interval": 3600
+            "interval": 3600
         },
-        "high_load_average": {
-        "query": "SELECT period, average, '70%' AS 'threshold' FROM load_average WHERE period = '15m' AND average > '0.7';",
-        "interval": 900,
-        "description": "Report if load charge is over 70 percent."
-        },
-        "low_free_memory": {
-        "query": "SELECT memory_total, memory_free, CAST(memory_free AS real) / memory_total AS memory_free_perc, '10%' AS threshold FROM memory_info WHERE memory_free_perc < 0.1;",
-        "interval": 1800,
-        "description": "Free RAM is under 10%."
-        }
-    },
 
-    "packs": {
+        "high_load_average": {
-        "osquery-monitoring": "/opt/osquery/share/osquery/packs/osquery-monitoring.conf",
+            "query": "SELECT period, average FROM load_average WHERE period='15m' AND average > 0.7;",
-        "incident-response": "/opt/osquery/share/osquery/packs/incident-response.conf",
+            "interval": 900
-        "it-compliance": "/opt/osquery/share/osquery/packs/it-compliance.conf",
+        }
-        "vuln-management": "/opt/osquery/share/osquery/packs/vuln-management.conf",
-        "hardware-monitoring": "/opt/osquery/share/osquery/packs/hardware-monitoring.conf",
-        "ossec-rootkit": "/opt/osquery/share/osquery/packs/ossec-rootkit.conf"
     }
 }
 EOF
-systemctl enable osqueryd
-systemctl start osqueryd
 
-echo "--------------------"
+
-echo Wazuh agent
+systemctl enable osqueryd
-curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+systemctl restart osqueryd
-echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+
+
+echo "===================="
+echo "Installing Wazuh agent"
+
+curl -fsSL https://packages.wazuh.com/key/GPG-KEY-WAZUH \
+| gpg --dearmor \
+> /usr/share/keyrings/wazuh.gpg
+
+
+cat > /etc/apt/sources.list.d/wazuh.list << "EOF"
+deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main
+EOF
+
+
 apt update
+
 WAZUH_MANAGER="siem01.de-roo.org" apt install wazuh-agent -y
+
+
 systemctl daemon-reload
 systemctl enable wazuh-agent
-systemctl start wazuh-agent
+systemctl restart wazuh-agent
+
+
+echo "===================="
+echo "Done!"