smolkik_adm/scripts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

v.1.2

Browse Source
This commit is contained in:
smolkik-code
2026-01-12 20:13:46 +07:00
parent 959afaddcf
commit 968f377e41
1 changed files with 149 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

211
ib.sh
View File

@@ -1,16 +1,25 @@
#!/bin/bash #!/bin/bash
# ============================================================================= # =============================================================================
# 🌍 УНИВЕРСАЛЬНЫЙ СЕРВЕРНЫЙ КОМБАЙН v4.0 # УНИВЕРСАЛЬНЫЙ СЕРВЕРНЫЙ КОМБАЙН v1.2
# Поддержка: Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, Fedora # Ubuntu/Debian/AlmaLinux/Rocky/CentOS/Fedora + Unattended Upgrades
# ============================================================================= # =============================================================================
GREEN='\033[0;32m' GREEN='\033[0;32m'
RED='\033[0;31m' RED='\033[0;31m'
YELLOW='\033[1;33m' YELLOW='\033[1;33m'
BLUE='\033[0;34m' BLUE='\033[0;34m'
PURPLE='\033[0;35m'
NC='\033[0m' NC='\033[0m'
# Глобальные переменные
OS_ID="" OS_VERSION="" PKG_MGR="" SSH_SERVICE=""
if [ "$EUID" -ne 0 ]; then
echo -e "${RED}🚫 Запустите от root!${NC}"
exit 1
fi
# --- ДЕТЕКЦИЯ ОС --- # --- ДЕТЕКЦИЯ ОС ---
detect_os() { detect_os() {
if [ -f /etc/os-release ]; then if [ -f /etc/os-release ]; then
@@ -39,8 +48,8 @@ detect_os() {
} }
# --- УТИЛИТЫ --- # --- УТИЛИТЫ ---
pause(){ read -p "Нажмите [Enter]..." fackEnterKey; } pause(){ read -p " Нажмите [Enter]..." fackEnterKey; }
pkg_install() { $PKG_MGR update -y && $PKG_MGR install -y "$@"; } pkg_install() { echo -e "${PURPLE}📦 Установка: $@${NC}"; $PKG_MGR update -y && $PKG_MGR install -y "$@"; }
service_restart() { service_restart() {
if command -v systemctl >/dev/null; then if command -v systemctl >/dev/null; then
systemctl restart "$1" systemctl restart "$1"
@@ -48,36 +57,44 @@ service_restart() {
service "$1" restart service "$1" restart
fi fi
} }
service_enable() {
if command -v systemctl >/dev/null; then
systemctl enable --now "$1"
else
service "$1" start && chkconfig "$1" on
fi
}
check_other_users() { check_other_users() {
USER_COUNT=$(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd | wc -l) awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd | wc -l
[ "$USER_COUNT" -eq 0 ] && return 1 || return 0
} }
# --- ФУНКЦИИ --- # --- ФУНКЦИИ ---
setup_timezone_interactive() { setup_timezone_interactive() {
echo -e "${GREEN}🌍 Часовой пояс${NC}" clear
echo "1) Europe/Moscow 2) Europe/Kiev 3) Asia/Almaty" echo -e "${GREEN}🌍 ЧАСОВОЙ ПОЯС${NC}"
echo "1) Europe/Moscow 2) Europe/Kiev 3) Asia/Almaty"
echo "4) Asia/Yekaterinburg 5) Asia/Novosibirsk 6) Europe/Berlin" echo "4) Asia/Yekaterinburg 5) Asia/Novosibirsk 6) Europe/Berlin"
echo "7) America/New_York 8) Asia/Tokyo 0) Ручной" echo "7) America/New_York 8) Asia/Tokyo 0) Ручной ввод"
echo ""
read -p "► " TZ_CHOICE read -p "► " TZ_CHOICE
case $TZ_CHOICE in case $TZ_CHOICE in
1) TZ="Europe/Moscow";; 2) TZ="Europe/Kiev";; 1) TZ="Europe/Moscow";; 2) TZ="Europe/Kiev";;
3) TZ="Asia/Almaty";; 4) TZ="Asia/Yekaterinburg";; 3) TZ="Asia/Almaty";; 4) TZ="Asia/Yekaterinburg";;
5) TZ="Asia/Novosibirsk";; 6) TZ="Europe/Berlin";; 5) TZ="Asia/Novosibirsk";; 6) TZ="Europe/Berlin";;
7) TZ="America/New_York";; 8) TZ="Asia/Tokyo";; 7) TZ="America/New_York";; 8) TZ="Asia/Tokyo";;
0) read -p "Зона: " TZ;; 0) read -p "Зона (ex: Europe/Moscow): " TZ;;
*) return;; *) echo -e "${RED}Неверный выбор${NC}"; pause; return;;
esac esac
timedatectl set-timezone "$TZ" 2>/dev/null || echo "timedatectl недоступен" timedatectl set-timezone "$TZ" 2>/dev/null && timedatectl set-ntp true 2>/dev/null
timedatectl set-ntp true 2>/dev/null || true
echo -e "${GREEN}✅ $TZ | $(date)${NC}" echo -e "${GREEN}✅ $TZ | $(date)${NC}"
pause
} }
install_base_pkgs() { install_base_pkgs() {
echo -e "${GREEN}📦 База${NC}" echo -e "${GREEN}📦 БАЗОВЫЕ ПАКЕТЫ${NC}"
case $PKG_MGR in case $PKG_MGR in
apt) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;; apt) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;;
dnf) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;; dnf) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;;
@@ -86,73 +103,118 @@ install_base_pkgs() {
# gdu для всех # gdu для всех
curl -L "https://github.com/dundee/gdu/releases/latest/download/gdu_linux_amd64.tgz" | tar xz curl -L "https://github.com/dundee/gdu/releases/latest/download/gdu_linux_amd64.tgz" | tar xz
chmod +x gdu_linux_amd64 && mv gdu_linux_amd64 /usr/local/bin/ chmod +x gdu_linux_amd64 && mv gdu_linux_amd64 /usr/local/bin/
echo -e "${GREEN}✅ gdu установлен${NC}"
} }
create_user_full() { create_user_full() {
echo -e "${GREEN}👤 Пользователь${NC}" echo -e "${GREEN}👤 СОЗДАНИЕ ПОЛЬЗОВАТЕЛЯ${NC}"
read -p "Имя: " UNAME read -p "Имя: " UNAME
echo "1) Только SSH 2) Пароль+SSH" echo "1) Только SSH ключ 🔑 2) Пароль + SSH 🔐"
read -p "► " AUTH_METHOD read -p "► " AUTH_METHOD
useradd -m -s /bin/bash "$UNAME" useradd -m -s /bin/bash "$UNAME"
usermod -aG wheel,sudo "$UNAME" 2>/dev/null || usermod -aG sudo "$UNAME" usermod -aG wheel,sudo "$UNAME" 2>/dev/null || usermod -aG sudo "$UNAME"
if [ "$AUTH_METHOD" == "1" ]; then if [ "$AUTH_METHOD" == "1" ]; then
read -p "SSH ключ: " UKEY echo -e "${GREEN}🔑 SSH ПУБЛИЧНЫЙ КЛЮЧ:${NC}"
read -p "> " UKEY
mkdir -p /home/$UNAME/.ssh mkdir -p /home/$UNAME/.ssh
echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
passwd -l "$UNAME" passwd -l "$UNAME"
echo -e "${GREEN}✅ Только SSH${NC}" echo -e "${GREEN}✅ Только SSH ключ${NC}"
else else
read -s -p "Пароль: " PASS1; echo read -s -p "🔐 Пароль: " PASS1; echo
read -s -p "Повторить: " PASS2; echo read -s -p "Повторить: " PASS2; echo
[ "$PASS1" = "$PASS2" ] && echo "$UNAME:$PASS1" | chpasswd [ "$PASS1" = "$PASS2" ] && echo "$UNAME:$PASS1" | chpasswd
read -p "SSH ключ (опц.): " UKEY echo -e "${GREEN}✅ Пароль установлен${NC}"
read -p "🔑 SSH ключ (опционально): " UKEY
[ -n "$UKEY" ] && echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys [ -n "$UKEY" ] && echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
fi fi
chown -R "$UNAME:$UNAME" /home/$UNAME/.ssh chown -R "$UNAME:$UNAME" /home/$UNAME/.ssh 2>/dev/null || true
chmod 700 /home/$UNAME/.ssh; chmod 600 /home/$UNAME/.ssh/authorized_keys chmod 700 /home/$UNAME/.ssh 2>/dev/null || true
chmod 600 /home/$UNAME/.ssh/authorized_keys 2>/dev/null || true
# Sudo без пароля
echo "$UNAME ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${UNAME}" echo "$UNAME ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${UNAME}"
chmod 440 "/etc/sudoers.d/${UNAME}" chmod 440 "/etc/sudoers.d/${UNAME}"
echo -e "${GREEN}✅ $UNAME готов (sudo без пароля)${NC}"
pause
} }
setup_ssh_security() { setup_ssh_security() {
clear; echo -e "${RED}🔒 SSH БЕЗОПАСНОСТЬ${NC}" clear
echo -e "${RED}🔒 НАСТРОЙКА SSH БЕЗОПАСНОСТИ${NC}"
if ! check_other_users; then USER_COUNT=$(check_other_users)
echo -e "${RED}🚫 Только root! Сначала пункт 3!${NC}" if [ "$USER_COUNT" -eq 0 ]; then
echo -e "${RED}🚫 ОШИБКА: Только root!${NC}"
echo -e "${YELLOW}✅ Сначала пункт 3 → Создать пользователя${NC}"
pause; return pause; return
fi fi
echo -e "${YELLOW}⚠️ Будет:${NC}" echo -e "${YELLOW}⚠️ Будет изменено:${NC}"
echo " ${RED}✖${NC} root, ${RED}✖${NC} пароли, ${GREEN}✔${NC} только ключи" echo " ${RED}✖${NC} Вход root"
read -p "ПРОДолжить? (y/N): " CONFIRM echo " ${RED}✖${NC} Пароли"
echo " ${GREEN}✔${NC} Только SSH ключи"
echo ""
read -p "ПРОДОЛЖИТЬ? (y/N): " CONFIRM
[ "$CONFIRM" != "y" ] && { echo "Отменено."; pause; return; } [ "$CONFIRM" != "y" ] && { echo "Отменено."; pause; return; }
SSHD_CONFIG="/etc/ssh/${SSH_SERVICE}_config" SSHD_CONFIG="/etc/ssh/${SSH_SERVICE}_config"
cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak.$(date +%Y%m%d)" cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M)"
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG" sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG"
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' "$SSHD_CONFIG" sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' "$SSHD_CONFIG"
sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' "$SSHD_CONFIG" sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' "$SSHD_CONFIG"
if command -v "$SSH_SERVICE" >/dev/null && "$SSH_SERVICE" -t 2>/dev/null; then if command -v "${SSH_SERVICE}" >/dev/null && "${SSH_SERVICE}" -t 2>/dev/null; then
service_restart "$SSH_SERVICE" service_restart "$SSH_SERVICE"
echo -e "${GREEN}✅ SSH защищён!${NC}" echo -e "${GREEN}✅ SSH защищён!${NC}"
else else
echo -e "${RED}❌ Ошибка! Восстановление...${NC}" echo -e "${RED}❌ Ошибка конфига! Восстановление...${NC}"
cp "${SSHD_CONFIG}.bak.$(date +%Y%m%d)" "$SSHD_CONFIG" cp "${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M)" "$SSHD_CONFIG"
service_restart "$SSH_SERVICE" service_restart "$SSH_SERVICE"
fi fi
pause pause
} }
install_unattended_upgrades() {
echo -e "${GREEN}🔄 АВТООБНОВЛЕНИЯ БЕЗОПАСНОСТИ${NC}"
if [[ "$OS_ID" != "ubuntu" && "$OS_ID" != "debian" ]]; then
echo -e "${YELLOW}⚠️ Только Ubuntu/Debian (RHEL: dnf-automatic)${NC}"
pause; return
fi
pkg_install unattended-upgrades needrestart
cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
cat > /etc/apt/apt.conf.d/50unattended-upgrades << 'EOF'
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-security";
"${distro_id}:${distro_codename}-updates";
};
Unattended-Upgrade::Mail "root";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
EOF
dpkg-reconfigure -plow unattended-upgrades
service_enable unattended-upgrades
echo -e "${GREEN}✅ Ежедневные обновления безопасности${NC}"
echo " 📅 Логи: /var/log/unattended-upgrades/"
echo " ⚠️ Авто-ребут: ${RED}отключен${NC}"
pause
}
install_audit_with_rotation() { install_audit_with_rotation() {
echo -e "${GREEN}🔒 Аудит${NC}" echo -e "${GREEN}🔒 АУДИТ + РОТАЦИЯ ЛОГОВ${NC}"
case $PKG_MGR in case $PKG_MGR in
apt) pkg_install auditd audispd-plugins logrotate ;; apt) pkg_install auditd audispd-plugins logrotate ;;
dnf) pkg_install audit policycoreutils-python-utils logrotate ;; dnf) pkg_install audit policycoreutils-python-utils logrotate ;;
@@ -161,48 +223,73 @@ install_audit_with_rotation() {
cat > /etc/audit/rules.d/server-setup.rules << 'EOF' cat > /etc/audit/rules.d/server-setup.rules << 'EOF'
-w /etc/sudoers -p wa -k sudoers -w /etc/sudoers -p wa -k sudoers
-w /etc/passwd -p wa -k identity -w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k ssh_config -w /etc/ssh/sshd_config -p wa -k ssh_config
-a always,exit -F arch=b64 -S execve -k process_exec
EOF EOF
sed -i '/^max_log_file/c\max_log_file = 50' /etc/audit/auditd.conf 2>/dev/null || \ if grep -q "^max_log_file" /etc/audit/auditd.conf 2>/dev/null; then
echo 'max_log_file = 50' >> /etc/audit/auditd.conf sed -i 's/^max_log_file.*/max_log_file = 50/' /etc/audit/auditd.conf
else
echo 'max_log_file = 50' >> /etc/audit/auditd.conf
fi
echo 'num_logs = 8' >> /etc/audit/auditd.conf
systemctl restart auditd rsyslog 2>/dev/null || service auditd restart service_restart auditd; service_enable auditd
systemctl enable auditd 2>/dev/null || chkconfig auditd on echo -e "${GREEN}✅ Аудит: /var/log/audit/audit.log${NC}"
pause
} }
# --- МЕНЮ --- status_all() {
clear
echo -e "${GREEN}📊 СТАТУС СИСТЕМЫ${NC}"
echo "=============================================="
echo "🔄 Unattended: $(systemctl is-active unattended-upgrades 2>/dev/null || echo 'Неактивен')"
echo "🔒 SSH: $(systemctl is-active $SSH_SERVICE 2>/dev/null || echo 'Неактивен')"
echo "🛡️ Fail2Ban: $(systemctl is-active fail2ban 2>/dev/null || echo 'Неактивен')"
echo "📊 Auditd: $(systemctl is-active auditd 2>/dev/null || echo 'Неактивен')"
echo "🐳 Docker: $(systemctl is-active docker 2>/dev/null || echo 'Неактивен')"
echo "=============================================="
echo "Пользователей: $(check_other_users)"
echo "Время: $(date)"
pause
}
# --- ГЛАВНОЕ МЕНЮ ---
detect_os detect_os
while true; do while true; do
clear clear
echo "=============================================" echo "=============================================="
echo " 🚀 SERVER ULTIMATE v4.0 ($OS_ID $OS_VERSION) 🚀" echo " 🚀 SERVER ULTIMATE v5.0 ($OS_ID $OS_VERSION) 🚀"
echo "=============================================" echo "=============================================="
echo "1) 📛 Hostname 2) 🌍 ${GREEN}Часовой пояс${NC} + база" echo "1) 📛 Hostname 2) 🌍 Часовой пояс + база"
echo "3) 👤 ${GREEN}Пользователь${NC} 4) 🔒 SSH безопасность" echo "3) 👤 ${GREEN}Пользователь${NC} 4) 🔒 SSH безопасность"
echo "5) 📊 Аудит 6) 🐳 Docker" echo "5) 📊 Аудит + ротация 6) 🐳 Docker + Compose"
echo "7) 🌐 WireGuard 8) 🔐 OpenVPN" echo "7) 🌐 WireGuard 8) 🔐 OpenVPN (Angristan)"
echo "9) 📈 Мониторинг 10) 🛡️ Fail2Ban" echo "9) 📈 Мониторинг 10) 🛡️ Fail2Ban"
echo "11) 🧹 Очистка 0) ❌ Выход" echo "11) 🧹 Очистка пакетов 12) 🔄 ${GREEN}Автообновления${NC}"
echo "=============================================" echo "S) 📊 Статус всех сервисов 0) ❌ Выход"
echo "=============================================="
read -p "► " opt read -p "► " opt
case $opt in case $opt in
1) read -p "Имя: " HN; hostnamectl set-hostname "$HN" 2>/dev/null || hostname "$HN"; pause ;; 1) read -p "Имя хоста: " HN; hostnamectl set-hostname "$HN" 2>/dev/null || hostname "$HN"; systemctl restart systemd-hostnamed 2>/dev/null || true; pause ;;
2) setup_timezone_interactive; install_base_pkgs; pause ;; 2) setup_timezone_interactive; install_base_pkgs ;;
3) create_user_full; pause ;; 3) create_user_full ;;
4) setup_ssh_security ;; 4) setup_ssh_security ;;
5) install_audit_with_rotation; pause ;; 5) install_audit_with_rotation ;;
6) $DOCKER_CMD; systemctl enable --now docker 2>/dev/null || service docker start; pause ;; 6) $DOCKER_CMD; service_enable docker; pause ;;
7) curl -fsSL https://git.io/wireguard -o wg.sh && bash wg.sh; pause ;; 7) curl -fsSL https://git.io/wireguard -o wg.sh && bash wg.sh; pause ;;
8) curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && chmod +x openvpn-install.sh && ./openvpn-install.sh; pause ;; 8) curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && chmod +x openvpn-install.sh && ./openvpn-install.sh; pause ;;
9) pkg_install glances htop; pause ;; 9) pkg_install glances htop; pause ;;
10) pkg_install fail2ban; systemctl enable --now fail2ban 2>/dev/null || service fail2ban start; pause ;; 10) pkg_install fail2ban; service_enable fail2ban; pause ;;
11) $PKG_MGR autoremove -y; pause ;; 11) $PKG_MGR autoremove -y && $PKG_MGR autoclean -y; pause ;;
12) install_unattended_upgrades ;;
[Ss]) status_all ;;
0) break ;; 0) break ;;
*) echo -e "${RED}❌ Неверно!${NC}"; sleep 1 ;; *) echo -e "${RED}❌ Неверный пункт!${NC}"; sleep 1 ;;
esac esac
done done
echo -e "${GREEN}🎉 Настройка завершена!${NC}" echo -e "${GREEN}🎉 Настройка завершена! Сервер готов к работе!${NC}"