DebianTweaks/DebianTweaks.sh

#!/usr/bin/env bash

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
    echo "Dit script moet als root worden uitgevoerd."
    exit 1
fi

export DEBIAN_FRONTEND=noninteractive

echo "===================="
echo "Installing packages"

apt update
apt install fortune cowsay snmpd postfix curl figlet wget gnupg2 -y


echo "===================="
echo "Configuring mail"

hostname -f > /etc/mailname

if ! grep -q "root: thomas@de-roo.org" /etc/aliases; then
    echo "root: thomas@de-roo.org" >> /etc/aliases
fi

newaliases


echo "===================="
echo "Configuring cron mail"

if ! grep -q "MAILTO=thomas@de-roo.org" /etc/crontab; then
    sed -i '/^PATH=.*\/usr\/bin/a MAILTO=thomas@de-roo.org' /etc/crontab
fi


echo "===================="
echo "Installing MOTD"

cat > /usr/local/bin/update-motd.sh << 'EOF'
#!/usr/bin/env bash

{
    figlet "$(hostname)"
    fortune | cowsay -k tux
} > /etc/motd
EOF

chmod +x /usr/local/bin/update-motd.sh

if ! grep -q "update-motd.sh" /etc/crontab; then
    echo "0 0 * * * root /usr/local/bin/update-motd.sh" >> /etc/crontab
fi

/usr/local/bin/update-motd.sh


echo "===================="
echo "Installing apt updater"

curl -fsSL \
https://git.de-roo.org/DEROO/apt-update/raw/branch/main/apt-update.sh \
-o /usr/local/bin/apt-update.sh

chmod +x /usr/local/bin/apt-update.sh

if ! grep -q "apt-update.sh" /etc/crontab; then
    echo "5 0 * * * root /usr/local/bin/apt-update.sh" >> /etc/crontab
fi


echo "===================="
echo "Configuring SNMP"

cat > /etc/snmp/snmpd.conf << 'EOF'
sysLocation VULHIERDELOCATIEIN
sysContact Thomas de Roo <thomas@de-roo.org>

rocommunity cacti
rocommunity librenms

includeAllDisks 10%

extend distro /usr/bin/distro

extend manufacturer '/bin/cat /sys/devices/virtual/dmi/id/sys_vendor'
extend hardware '/bin/cat /sys/devices/virtual/dmi/id/product_name'
extend serial '/bin/cat /sys/devices/virtual/dmi/id/product_serial'
EOF


curl -fsSL \
-o /usr/bin/distro \
https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro

chmod +x /usr/bin/distro

systemctl restart snmpd
systemctl enable snmpd


echo "===================="
echo "Configuring Debian repositories"

cat > /etc/apt/sources.list << "EOF"
deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian trixie main contrib non-free non-free-firmware

deb http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware

deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
EOF


echo "===================="
echo "Adding multimedia repository"

cd /tmp

wget -q \
https://www.deb-multimedia.org/pool/main/d/deb-multimedia-keyring/deb-multimedia-keyring_2024.9.1_all.deb

apt install ./deb-multimedia-keyring_2024.9.1_all.deb -y

cat > /etc/apt/sources.list.d/multimedia.list << "EOF"
deb [arch=amd64 signed-by=/usr/share/keyrings/deb-multimedia-keyring.pgp] https://www.deb-multimedia.org trixie main non-free
EOF


echo "===================="
echo "Adding Microsoft repository"

curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
| gpg --dearmor \
> /usr/share/keyrings/packages.microsoft.gpg

cat > /etc/apt/sources.list.d/microsoft.list << "EOF"
deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/debian/12/prod bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] http://packages.microsoft.com/repos/code stable main
EOF


echo "===================="
echo "Adding Brave repository"

curl -fsSLo \
/usr/share/keyrings/brave-browser-archive-keyring.gpg \
https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg

cat > /etc/apt/sources.list.d/brave-browser-release.list << "EOF"
deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main
EOF


apt update


echo "===================="
echo "Installing osquery"

mkdir -p /etc/apt/keyrings

curl -fsSLo \
/usr/share/keyrings/osquery-keyring.gpg \
https://pkg.osquery.io/deb/pubkey.gpg


cat > /etc/apt/sources.list.d/osquery.list << "EOF"
deb [signed-by=/usr/share/keyrings/osquery-keyring.gpg] https://pkg.osquery.io/deb deb main
EOF


apt update
apt install osquery -y


cat > /etc/osquery/osquery.conf << "EOF"
{
    "options": {
        "config_plugin": "filesystem",
        "logger_plugin": "filesystem",
        "utc": "true"
    },

    "schedule": {
        "system_info": {
            "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
            "interval": 3600
        },

        "high_load_average": {
            "query": "SELECT period, average FROM load_average WHERE period='15m' AND average > 0.7;",
            "interval": 900
        }
    }
}
EOF


systemctl enable osqueryd
systemctl restart osqueryd


echo "===================="
echo "Installing Wazuh agent"

curl -fsSL https://packages.wazuh.com/key/GPG-KEY-WAZUH \
| gpg --dearmor \
> /usr/share/keyrings/wazuh.gpg


cat > /etc/apt/sources.list.d/wazuh.list << "EOF"
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main
EOF


apt update

WAZUH_MANAGER="siem01.de-roo.org" apt install wazuh-agent -y


systemctl daemon-reload
systemctl enable wazuh-agent
systemctl restart wazuh-agent


echo "===================="
echo "Done!"