alpha 0.1

lib/backup.sh

@@ -0,0 +1,23 @@
+source /opt/server-ultimate/config/main.conf
+
+backup_create() {
+    local COMP="$1"; shift
+    local FILES="$@"
+
+    TS="$(date +%F_%H-%M-%S)"
+    DEST="$BACKUP_DIR/$COMP/$TS"
+
+    mkdir -p "$DEST"
+    for f in $FILES; do
+        [ -f "$f" ] && cp -a "$f" "$DEST/"
+    done
+
+    echo "$DEST"
+}
+
+backup_restore() {
+    local COMP="$1"
+    ls "$BACKUP_DIR/$COMP"
+    read -p "Snapshot: " TS
+    cp -av "$BACKUP_DIR/$COMP/$TS"/* /
+}

lib/colors.sh

@@ -0,0 +1,4 @@
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+NC='\033[0m'

lib/fail2ban.sh

@@ -0,0 +1,21 @@
+setup_fail2ban() {
+    $PKG install -y fail2ban
+    CONF="/etc/fail2ban/jail.local"
+    SNAP=$(backup_create fail2ban "$CONF")
+
+    cat > "$CONF" <<EOF
+[sshd]
+enabled = true
+bantime = 1d
+findtime = 10m
+maxretry = 3
+EOF
+
+    fail2ban-client -t || {
+        cp "$SNAP/jail.local" "$CONF"
+        err "Fail2Ban rollback"
+    }
+
+    systemctl enable --now fail2ban
+    pause
+}

lib/os-detect.sh

@@ -0,0 +1,21 @@
+detect_os() {
+    . /etc/os-release
+    OS_ID=$ID
+    OS_VERSION=$VERSION_ID
+
+    case $OS_ID in
+        ubuntu|debian)
+            PKG=apt
+            SSHD=sshd
+            ;;
+        almalinux|rocky|centos|fedora)
+            PKG=dnf
+            SSHD=sshd
+            ;;
+        *)
+            err "Неподдерживаемая ОС"
+            exit 1
+    esac
+
+    log "ОС: $OS_ID $OS_VERSION"
+}

lib/samba.sh

@@ -0,0 +1,52 @@
+create_or_use_directory() {
+    read -p "Путь к папке: " DIR
+    if [ -d "$DIR" ]; then
+        log "Используем $DIR"
+    else
+        read -p "Создать $DIR ? (y/N): " Y
+        [[ "$Y" != "y" ]] && return 1
+        mkdir -p "$DIR"
+        chmod 770 "$DIR"
+    fi
+    echo "$DIR"
+}
+
+setup_samba() {
+    $PKG install -y samba
+    CONF="/etc/samba/smb.conf"
+    SNAP=$(backup_create samba "$CONF")
+
+    cat > "$CONF" <<EOF
+[global]
+workgroup = WORKGROUP
+security = user
+map to guest = bad user
+EOF
+
+    while true; do
+        read -p "Имя шары (Enter=выход): " NAME
+        [ -z "$NAME" ] && break
+
+        PATH=$(create_or_use_directory) || continue
+        read -p "Пользователи (guest или user1,user2): " USERS
+
+        if [[ "$USERS" == "guest" ]]; then
+            GUEST="yes"; VALID=""
+        else
+            GUEST="no"; VALID="valid users = $USERS"
+        fi
+
+        cat >> "$CONF" <<EOF
+
+[$NAME]
+path = $PATH
+guest ok = $GUEST
+writable = yes
+$VALID
+EOF
+    done
+
+    testparm || { cp "$SNAP/smb.conf" "$CONF"; }
+    systemctl restart smbd
+    pause
+}

lib/ssh.sh

@@ -0,0 +1,48 @@
+secure_ssh() {
+    CONF="/etc/ssh/sshd_config"
+    PROFILE="/opt/server-ultimate/config/ssh-hardening.conf"
+
+    SNAP=$(backup_create ssh "$CONF")
+
+    echo ""
+    read -p "Отключить вход по паролю? (y/N): " DISABLE_PASS
+
+    if [[ "$DISABLE_PASS" == "y" ]]; then
+        confirm_ssh_key_works || {
+            err "Ключ не подтверждён. Операция отменена."
+            pause
+            return
+        }
+    fi
+
+    # Удаляем старые параметры
+    sed -i '/^PermitRootLogin/d
+            /^PasswordAuthentication/d
+            /^PubkeyAuthentication/d
+            /^MaxAuthTries/d
+            /^ClientAliveInterval/d
+            /^ClientAliveCountMax/d
+            /^X11Forwarding/d
+            /^AllowTcpForwarding/d
+            /^TCPKeepAlive/d
+            /^UseDNS/d' "$CONF"
+
+    # Применяем профиль
+    cat "$PROFILE" >> "$CONF"
+
+    # Пароль — по выбору
+    if [[ "$DISABLE_PASS" != "y" ]]; then
+        sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/' "$CONF"
+    fi
+
+    if sshd -t; then
+        systemctl restart sshd
+        log "SSH security профиль применён"
+    else
+        err "Ошибка SSH → rollback"
+        cp "$SNAP/sshd_config" "$CONF"
+        systemctl restart sshd
+    fi
+
+    pause
+}

lib/sysctl.sh

@@ -0,0 +1,13 @@
+harden_sysctl() {
+    CONF="/etc/sysctl.d/99-hardening.conf"
+    SNAP=$(backup_create sysctl "$CONF")
+
+    cat > "$CONF" <<EOF
+net.ipv4.conf.all.accept_redirects = 0
+kernel.kptr_restrict = 2
+fs.protected_symlinks = 1
+EOF
+
+    sysctl --system || rm -f "$CONF"
+    pause
+}

lib/users.sh

@@ -0,0 +1,44 @@
+create_user() {
+    clear
+    read -p "Имя пользователя: " USER
+    id "$USER" &>/dev/null && { err "Уже существует"; pause; return; }
+
+    echo "Способ входа:"
+    echo "1) 🔑 Только ключ"
+    echo "2) 🔐 Пароль + ключ"
+    echo "3) 🔐 Только пароль"
+    read -p "> " MODE
+
+    useradd -m -s /bin/bash "$USER"
+    mkdir -p /home/$USER/.ssh
+    chmod 700 /home/$USER/.ssh
+
+    case "$MODE" in
+        1)
+            read -p "Вставь публичный ключ: " KEY
+            echo "$KEY" > /home/$USER/.ssh/authorized_keys
+            chmod 600 /home/$USER/.ssh/authorized_keys
+            passwd -l "$USER"
+            ;;
+        2)
+            passwd "$USER"
+            read -p "Публичный ключ (Enter чтобы пропустить): " KEY
+            [[ -n "$KEY" ]] && echo "$KEY" > /home/$USER/.ssh/authorized_keys
+            ;;
+        3)
+            passwd "$USER"
+            ;;
+        *)
+            userdel -r "$USER"
+            err "Отмена"
+            pause
+            return
+            ;;
+    esac
+
+    chown -R $USER:$USER /home/$USER/.ssh
+    usermod -aG sudo "$USER"
+
+    log "Создан пользователь $USER"
+    pause
+}

lib/utils.sh

@@ -0,0 +1,20 @@
+require_root() {
+    [[ $EUID -ne 0 ]] && { echo "❌ Запусти от root"; exit 1; }
+}
+
+log() {
+    echo "[+] $1"
+    echo "$(date) | $1" >> "$LOG_FILE"
+}
+
+warn() {
+    echo "[!] $1"
+}
+
+err() {
+    echo "[x] $1"
+}
+
+pause() {
+    read -p "Нажмите Enter..."
+}