ben/DebianTweaks
1
0
Fork 0
forked from DEROO/DebianTweaks
Code Pull Requests Activity

Update DebianTweaks.sh

Browse Source
This commit is contained in:
ben
2026-07-13 20:43:22 +02:00
parent 60448ac377
commit 38c6405f60
1 changed files with 167 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DebianTweaks.sh
+167 -99
View File
@@ -1,26 +1,46 @@
#!/bin/bash #!/usr/bin/env bash
#deze packages zijn nodig set -euo pipefail
apt install fortune snmpd postfix curl figlet wget gnupg2 -y
if [[ $EUID -ne 0 ]]; then
echo "Dit script moet als root worden uitgevoerd."
exit 1
fi
export DEBIAN_FRONTEND=noninteractive
echo "===================="
echo "Installing packages"
apt update
apt install fortune cowsay snmpd postfix curl figlet wget gnupg2 -y
echo "===================="
echo "Configuring mail"
echo "--------------------"
echo Set the correct mailer fqdn
hostname -f > /etc/mailname hostname -f > /etc/mailname
echo "--------------------" if ! grep -q "root: thomas@de-roo.org" /etc/aliases; then
echo Forward mail to root echo "root: thomas@de-roo.org" >> /etc/aliases
echo root: thomas@de-roo.org >> /etc/aliases fi
/usr/bin/newaliases
echo "--------------------" newaliases
echo Add mailto address in crontab
awk '/PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin/ { print; print "MAILTO=thomas@de-roo.org"; next }1' /etc/crontab > /tmp/crontab.temp
cat /tmp/crontab.temp > /etc/crontab echo "===================="
rm /tmp/crontab.temp echo "Configuring cron mail"
if ! grep -q "MAILTO=thomas@de-roo.org" /etc/crontab; then
sed -i '/^PATH=.*\/usr\/bin/a MAILTO=thomas@de-roo.org' /etc/crontab
fi
echo "===================="
echo "Installing MOTD"
echo "--------------------"
cat > /usr/local/bin/update-motd.sh << 'EOF' cat > /usr/local/bin/update-motd.sh << 'EOF'
#!/bin/bash #!/usr/bin/env bash
{ {
figlet "$(hostname)" figlet "$(hostname)"
@@ -30,93 +50,136 @@ EOF
chmod +x /usr/local/bin/update-motd.sh chmod +x /usr/local/bin/update-motd.sh
cat >> /etc/crontab << 'EOF' if ! grep -q "update-motd.sh" /etc/crontab; then
0 0 * * * root /usr/local/bin/update-motd.sh echo "0 0 * * * root /usr/local/bin/update-motd.sh" >> /etc/crontab
EOF fi
echo "--------------------" /usr/local/bin/update-motd.sh
echo Apt Updates
curl -s https://git.de-roo.org/DEROO/apt-update/raw/branch/main/apt-update.sh -o /usr/local/bin/apt-update.sh
chmod a+x /usr/local/bin/apt-update.sh echo "===================="
echo 0 0 * * * root /usr/local/bin/apt-update.sh >> /etc/crontab echo "Installing apt updater"
curl -fsSL \
https://git.de-roo.org/DEROO/apt-update/raw/branch/main/apt-update.sh \
-o /usr/local/bin/apt-update.sh
chmod +x /usr/local/bin/apt-update.sh
if ! grep -q "apt-update.sh" /etc/crontab; then
echo "5 0 * * * root /usr/local/bin/apt-update.sh" >> /etc/crontab
fi
echo "===================="
echo "Configuring SNMP"
echo "--------------------"
echo SNMP things. N.B.: replace VULHIERDELOCATIEIN later
cat > /etc/snmp/snmpd.conf << 'EOF' cat > /etc/snmp/snmpd.conf << 'EOF'
sysLocation VULHIERDELOCATIEIN sysLocation VULHIERDELOCATIEIN
sysContact Thomas de Roo <thomas@de-roo.org> sysContact Thomas de Roo <thomas@de-roo.org>
rocommunity cacti
rocommunity librenms rocommunity cacti
rocommunity librenms
includeAllDisks 10% includeAllDisks 10%
#OS Distribution Detection
extend distro /usr/bin/distro extend distro /usr/bin/distro
#Hardware Detection
# (uncomment for x86 platforms)
extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor' extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor'
extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name' extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name'
extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial' extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial'
# (uncomment for ARM platforms)
#extend hardware '/bin/cat /sys/firmware/devicetree/base/model'
#extend serial '/bin/cat /sys/firmware/devicetree/base/serial-number'
EOF EOF
curl -s -o /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
chmod a+x /usr/bin/distro
echo @reboot root chmod 444 /sys/devices/virtual/dmi/id/product_serial >> /etc/crontab
chmod 444 /sys/devices/virtual/dmi/id/product_serial
systemctl restart snmpd
echo "--------------------" curl -fsSL \
echo Debian Trixie apt sources -o /usr/bin/distro \
https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
chmod +x /usr/bin/distro
systemctl restart snmpd
systemctl enable snmpd
echo "===================="
echo "Configuring Debian repositories"
cat > /etc/apt/sources.list << "EOF" cat > /etc/apt/sources.list << "EOF"
deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian trixie main contrib non-free non-free-firmware deb-src http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
deb http://deb.debian.org/debian-security/ trixie-security main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian-security/ trixie-security main contrib non-free non-free-firmware deb http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware
deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware deb-src http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
EOF EOF
cd $HOME
wget https://www.deb-multimedia.org/pool/main/d/deb-multimedia-keyring/deb-multimedia-keyring_2024.9.1_all.deb
apt install ./deb-multimedia-keyring_2024.9.1_all.deb echo "===================="
cat >> /etc/apt/sources.list.d/multimedia.list << "EOF" echo "Adding multimedia repository"
cd /tmp
wget -q \
https://www.deb-multimedia.org/pool/main/d/deb-multimedia-keyring/deb-multimedia-keyring_2024.9.1_all.deb
apt install ./deb-multimedia-keyring_2024.9.1_all.deb -y
cat > /etc/apt/sources.list.d/multimedia.list << "EOF"
deb [arch=amd64 signed-by=/usr/share/keyrings/deb-multimedia-keyring.pgp] https://www.deb-multimedia.org trixie main non-free deb [arch=amd64 signed-by=/usr/share/keyrings/deb-multimedia-keyring.pgp] https://www.deb-multimedia.org trixie main non-free
EOF EOF
#curl -s https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo sh -c 'gpg --dearmor > /usr/share/keyrings/google-chrome-keyring.gpg'
#cat >> /etc/apt/sources.list.d/chrome.list << "EOF"
#deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main echo "===================="
#EOF echo "Adding Microsoft repository"
curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /usr/share/keyrings/packages.microsoft.gpg
cat >> /etc/apt/sources.list.d/microsoft.list << "EOF" curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
| gpg --dearmor \
> /usr/share/keyrings/packages.microsoft.gpg
cat > /etc/apt/sources.list.d/microsoft.list << "EOF"
deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/debian/12/prod bookworm main deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/debian/12/prod bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm main deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] http://packages.microsoft.com/repos/code stable main deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] http://packages.microsoft.com/repos/code stable main
EOF EOF
echo "===================="
echo "Adding Brave repository"
echo "--------------------" curl -fsSLo \
echo Brave browser /usr/share/keyrings/brave-browser-archive-keyring.gpg \
apt install curl https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main"|tee /etc/apt/sources.list.d/brave-browser-release.list
apt update
#apt install brave-browser
cat > /etc/apt/sources.list.d/brave-browser-release.list << "EOF"
echo "--------------------" deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main
echo osquery
mkdir -p /etc/apt/keyrings
curl -fsSLo /usr/share/keyrings/osquery-keyring.gpg https://pkg.osquery.io/deb/pubkey.gpg
cat >> /etc/apt/sources.list.d/osquery.list << "EOF"
deb [trusted=yes signed-by=/usr/share/keyrings/osquery-keyring.gpg] https://pkg.osquery.io/deb deb main
EOF EOF
apt update apt update
apt install -y osquery
cat >> /etc/osquery/osquery.conf << "EOF"
echo "===================="
echo "Installing osquery"
mkdir -p /etc/apt/keyrings
curl -fsSLo \
/usr/share/keyrings/osquery-keyring.gpg \
https://pkg.osquery.io/deb/pubkey.gpg
cat > /etc/apt/sources.list.d/osquery.list << "EOF"
deb [signed-by=/usr/share/keyrings/osquery-keyring.gpg] https://pkg.osquery.io/deb deb main
EOF
apt update
apt install osquery -y
cat > /etc/osquery/osquery.conf << "EOF"
{ {
"options": { "options": {
"config_plugin": "filesystem", "config_plugin": "filesystem",
@@ -126,40 +189,45 @@ cat >> /etc/osquery/osquery.conf << "EOF"
"schedule": { "schedule": {
"system_info": { "system_info": {
"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;", "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
"interval": 3600 "interval": 3600
}, },
"high_load_average": {
"query": "SELECT period, average, '70%' AS 'threshold' FROM load_average WHERE period = '15m' AND average > '0.7';",
"interval": 900,
"description": "Report if load charge is over 70 percent."
},
"low_free_memory": {
"query": "SELECT memory_total, memory_free, CAST(memory_free AS real) / memory_total AS memory_free_perc, '10%' AS threshold FROM memory_info WHERE memory_free_perc < 0.1;",
"interval": 1800,
"description": "Free RAM is under 10%."
}
},
"packs": { "high_load_average": {
"osquery-monitoring": "/opt/osquery/share/osquery/packs/osquery-monitoring.conf", "query": "SELECT period, average FROM load_average WHERE period='15m' AND average > 0.7;",
"incident-response": "/opt/osquery/share/osquery/packs/incident-response.conf", "interval": 900
"it-compliance": "/opt/osquery/share/osquery/packs/it-compliance.conf", }
"vuln-management": "/opt/osquery/share/osquery/packs/vuln-management.conf",
"hardware-monitoring": "/opt/osquery/share/osquery/packs/hardware-monitoring.conf",
"ossec-rootkit": "/opt/osquery/share/osquery/packs/ossec-rootkit.conf"
} }
} }
EOF EOF
systemctl enable osqueryd
systemctl start osqueryd
echo "--------------------"
echo Wazuh agent systemctl enable osqueryd
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg systemctl restart osqueryd
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
echo "===================="
echo "Installing Wazuh agent"
curl -fsSL https://packages.wazuh.com/key/GPG-KEY-WAZUH \
| gpg --dearmor \
> /usr/share/keyrings/wazuh.gpg
cat > /etc/apt/sources.list.d/wazuh.list << "EOF"
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main
EOF
apt update apt update
WAZUH_MANAGER="siem01.de-roo.org" apt install wazuh-agent -y WAZUH_MANAGER="siem01.de-roo.org" apt install wazuh-agent -y
systemctl daemon-reload systemctl daemon-reload
systemctl enable wazuh-agent systemctl enable wazuh-agent
systemctl start wazuh-agent systemctl restart wazuh-agent
echo "===================="
echo "Done!"