Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 03ce460a4e | |||
| ca0c66687a | |||
| 968f377e41 | |||
| 959afaddcf | |||
| c67a2fe0e1 | |||
| 2f1fa03509 |
337
ib.sh
337
ib.sh
@@ -1,114 +1,293 @@
|
||||
#!/bin/bash
|
||||
|
||||
# =============================================================================
|
||||
# 🌍 УНИВЕРСАЛЬНЫЙ СЕРВЕРНЫЙ КОМБАЙН v1.2.1
|
||||
# Ubuntu/Debian/AlmaLinux/Rocky/CentOS/Fedora
|
||||
# =============================================================================
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
RED='\033[0;31m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
PURPLE='\033[0;35m'
|
||||
NC='\033[0m'
|
||||
|
||||
OS_ID="" OS_VERSION="" PKG_MGR="" SSH_SERVICE=""
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo -e "${RED}Запустите скрипт от имени root!${NC}"
|
||||
echo "🚫 Запустите от root!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
pause(){
|
||||
read -p "Нажмите [Enter], чтобы продолжить..." fackEnterKey
|
||||
detect_os() {
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
OS_ID=$ID
|
||||
OS_VERSION=$VERSION_ID
|
||||
else
|
||||
OS_ID=$(uname -s | tr '[:upper:]' '[:lower:]')
|
||||
fi
|
||||
|
||||
case $OS_ID in
|
||||
ubuntu|debian)
|
||||
PKG_MGR="apt"
|
||||
SSH_SERVICE="ssh"
|
||||
DOCKER_CMD="curl -fsSL https://get.docker.com | sh"
|
||||
;;
|
||||
"almalinux"|"rocky"|"centos"|"fedora")
|
||||
PKG_MGR="dnf"
|
||||
SSH_SERVICE="sshd"
|
||||
DOCKER_CMD="dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo && dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin"
|
||||
;;
|
||||
*) echo "❌ Неподдерживаемая ОС: $OS_ID"; exit 1 ;;
|
||||
esac
|
||||
|
||||
echo "🖥️ ОС: $OS_ID | Пакеты: $PKG_MGR | SSH: $SSH_SERVICE"
|
||||
}
|
||||
|
||||
# --- ПРОВЕРКИ ---
|
||||
pause(){ read -p " Нажмите [Enter]..." fackEnterKey; }
|
||||
pkg_install() { echo "📦 Установка: $@"; $PKG_MGR update -y && $PKG_MGR install -y "$@"; }
|
||||
service_restart() {
|
||||
if command -v systemctl >/dev/null; then
|
||||
systemctl restart "$1"
|
||||
else
|
||||
service "$1" restart
|
||||
fi
|
||||
}
|
||||
service_enable() {
|
||||
if command -v systemctl >/dev/null; then
|
||||
systemctl enable --now "$1"
|
||||
else
|
||||
service "$1" start && chkconfig "$1" on 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
check_other_users() {
|
||||
# Считаем пользователей с UID >= 1000 (обычные пользователи)
|
||||
USER_COUNT=$(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd | wc -l)
|
||||
if [ "$USER_COUNT" -eq 0 ]; then
|
||||
echo -e "${RED}ВНИМАНИЕ: В системе только root!${NC}"
|
||||
echo -e "${YELLOW}Сначала создайте обычного пользователя (пункт 3), прежде чем отключать SSH пароли.${NC}"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd | wc -l
|
||||
}
|
||||
|
||||
# --- ФУНКЦИИ ---
|
||||
setup_timezone_interactive() {
|
||||
clear
|
||||
echo "${GREEN}🌍 ЧАСОВОЙ ПОЯС${NC}"
|
||||
echo "1) Europe/Moscow 2) Europe/Kiev 3) Asia/Almaty"
|
||||
echo "4) Asia/Yekaterinburg 5) Asia/Novosibirsk 6) Europe/Berlin"
|
||||
echo "7) America/New_York 8) Asia/Tokyo 0) Ручной ввод"
|
||||
echo ""
|
||||
read -p "► " TZ_CHOICE
|
||||
|
||||
case $TZ_CHOICE in
|
||||
1) TZ="Europe/Moscow";; 2) TZ="Europe/Kiev";;
|
||||
3) TZ="Asia/Almaty";; 4) TZ="Asia/Yekaterinburg";;
|
||||
5) TZ="Asia/Novosibirsk";; 6) TZ="Europe/Berlin";;
|
||||
7) TZ="America/New_York";; 8) TZ="Asia/Tokyo";;
|
||||
0) read -p "Зона (ex: Europe/Moscow): " TZ;;
|
||||
*) echo "Неверный выбор"; pause; return;;
|
||||
esac
|
||||
|
||||
timedatectl set-timezone "$TZ" 2>/dev/null && timedatectl set-ntp true 2>/dev/null
|
||||
echo "${GREEN}✅ $TZ | $(date)${NC}"
|
||||
pause
|
||||
}
|
||||
|
||||
install_audit() {
|
||||
echo -e "${GREEN}Установка и настройка аудита (auditd)...${NC}"
|
||||
apt update && apt install -y auditd audispd-plugins
|
||||
# Базовые правила аудита (логирование изменений в sudoers, passwd, и SSH)
|
||||
cat > /etc/audit/rules.d/audit.rules << EOF
|
||||
-w /etc/sudoers -p wa -k scope
|
||||
-w /etc/passwd -p wa -k identity
|
||||
-w /etc/ssh/sshd_config -p wa -k sshd_config
|
||||
EOF
|
||||
service auditd restart
|
||||
echo "Аудит запущен. Просмотр логов: ausearch -k sshd_config"
|
||||
install_base_pkgs() {
|
||||
echo "${GREEN}📦 БАЗОВЫЕ ПАКЕТЫ${NC}"
|
||||
case $PKG_MGR in
|
||||
apt) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;;
|
||||
dnf) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;;
|
||||
esac
|
||||
|
||||
curl -L "https://github.com/dundee/gdu/releases/latest/download/gdu_linux_amd64.tgz" | tar xz
|
||||
chmod +x gdu_linux_amd64 && mv gdu_linux_amd64 /usr/local/bin/
|
||||
echo "${GREEN}✅ gdu установлен${NC}"
|
||||
}
|
||||
|
||||
create_user_full() {
|
||||
echo "${GREEN}👤 СОЗДАНИЕ ПОЛЬЗОВАТЕЛЯ${NC}"
|
||||
read -p "Имя: " UNAME
|
||||
echo "1) Только SSH ключ 🔑 2) Пароль + SSH 🔐"
|
||||
read -p "► " AUTH_METHOD
|
||||
|
||||
useradd -m -s /bin/bash "$UNAME"
|
||||
usermod -aG wheel,sudo "$UNAME" 2>/dev/null || usermod -aG sudo "$UNAME"
|
||||
|
||||
if [ "$AUTH_METHOD" == "1" ]; then
|
||||
echo "${GREEN}🔑 SSH ПУБЛИЧНЫЙ КЛЮЧ:${NC}"
|
||||
read -p "> " UKEY
|
||||
mkdir -p /home/$UNAME/.ssh
|
||||
echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
|
||||
passwd -l "$UNAME"
|
||||
echo "${GREEN}✅ Только SSH ключ${NC}"
|
||||
else
|
||||
read -s -p "🔐 Пароль: " PASS1; echo
|
||||
read -s -p "Повторить: " PASS2; echo
|
||||
[ "$PASS1" = "$PASS2" ] && echo "$UNAME:$PASS1" | chpasswd
|
||||
echo "${GREEN}✅ Пароль установлен${NC}"
|
||||
read -p "🔑 SSH ключ (опционально): " UKEY
|
||||
[ -n "$UKEY" ] && echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
|
||||
fi
|
||||
|
||||
chown -R "$UNAME:$UNAME" /home/$UNAME/.ssh 2>/dev/null || true
|
||||
chmod 700 /home/$UNAME/.ssh 2>/dev/null || true
|
||||
chmod 600 /home/$UNAME/.ssh/authorized_keys 2>/dev/null || true
|
||||
|
||||
echo "$UNAME ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${UNAME}"
|
||||
chmod 440 "/etc/sudoers.d/${UNAME}"
|
||||
echo "${GREEN}✅ $UNAME готов (sudo без пароля)${NC}"
|
||||
pause
|
||||
}
|
||||
|
||||
setup_ssh_security() {
|
||||
if ! check_other_users; then pause; return; fi
|
||||
|
||||
echo -e "${YELLOW}ВНИМАНИЕ: Сейчас будет произведена настройка безопасности SSH.${NC}"
|
||||
read -p "Отключить вход по ПАРОЛЮ и оставить только КЛЮЧИ? (y/n): " SSH_CONFIRM
|
||||
clear
|
||||
echo "${RED}🔒 НАСТРОЙКА SSH БЕЗОПАСНОСТИ${NC}"
|
||||
|
||||
if [ "$SSH_CONFIRM" == "y" ]; then
|
||||
SSHD_CONFIG="/etc/ssh/sshd_config"
|
||||
cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak"
|
||||
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG"
|
||||
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' "$SSHD_CONFIG"
|
||||
sshd -t && systemctl restart ssh
|
||||
echo -e "${GREEN}SSH защищен. Вход под root и по паролю запрещен.${NC}"
|
||||
else
|
||||
echo "Настройка SSH отменена."
|
||||
USER_COUNT=$(check_other_users)
|
||||
if [ "$USER_COUNT" -eq 0 ]; then
|
||||
echo "${RED}🚫 ОШИБКА: Только root!${NC}"
|
||||
echo "${YELLOW}✅ Сначала пункт 3 → Создать пользователя${NC}"
|
||||
pause; return
|
||||
fi
|
||||
|
||||
echo "${YELLOW}⚠️ Будет изменено:${NC}"
|
||||
echo " ✖ Вход root"
|
||||
echo " ✖ Пароли"
|
||||
echo " ✔ Только SSH ключи"
|
||||
echo ""
|
||||
read -p "ПРОДОЛЖИТЬ? (y/N): " CONFIRM
|
||||
|
||||
[ "$CONFIRM" != "y" ] && { echo "Отменено."; pause; return; }
|
||||
|
||||
SSHD_CONFIG="/etc/ssh/${SSH_SERVICE}_config"
|
||||
cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M)"
|
||||
|
||||
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG"
|
||||
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' "$SSHD_CONFIG"
|
||||
sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' "$SSHD_CONFIG"
|
||||
|
||||
if command -v "${SSH_SERVICE}" >/dev/null && "${SSH_SERVICE}" -t 2>/dev/null; then
|
||||
service_restart "$SSH_SERVICE"
|
||||
echo "${GREEN}✅ SSH защищён!${NC}"
|
||||
else
|
||||
echo "${RED}❌ Ошибка конфига! Восстановление...${NC}"
|
||||
cp "${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M)" "$SSHD_CONFIG"
|
||||
service_restart "$SSH_SERVICE"
|
||||
fi
|
||||
pause
|
||||
}
|
||||
|
||||
install_openvpn_angristan() {
|
||||
echo -e "${GREEN}Установка OpenVPN (by Angristan)...${NC}"
|
||||
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
|
||||
chmod +x openvpn-install.sh
|
||||
./openvpn-install.sh
|
||||
install_unattended_upgrades() {
|
||||
echo "${GREEN}🔄 АВТООБНОВЛЕНИЯ БЕЗОПАСНОСТИ${NC}"
|
||||
|
||||
if [[ "$OS_ID" != "ubuntu" && "$OS_ID" != "debian" ]]; then
|
||||
echo "${YELLOW}⚠️ Только Ubuntu/Debian${NC}"
|
||||
pause; return
|
||||
fi
|
||||
|
||||
pkg_install unattended-upgrades needrestart
|
||||
|
||||
cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
EOF
|
||||
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades << 'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}:${distro_codename}-updates";
|
||||
};
|
||||
Unattended-Upgrade::Mail "root";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
EOF
|
||||
|
||||
dpkg-reconfigure -plow unattended-upgrades
|
||||
service_enable unattended-upgrades
|
||||
|
||||
echo "${GREEN}✅ НАСТРОЕНО:${NC}"
|
||||
echo " 📅 Обновления: ежедневно"
|
||||
echo " 🔒 Только: security + updates"
|
||||
echo " 📋 Логи: /var/log/unattended-upgrades/"
|
||||
echo " ⚠️ Авто-ребут: отключен"
|
||||
pause
|
||||
}
|
||||
|
||||
# --- МЕНЮ ---
|
||||
install_audit_with_rotation() {
|
||||
echo "${GREEN}🔒 АУДИТ + РОТАЦИЯ ЛОГОВ${NC}"
|
||||
case $PKG_MGR in
|
||||
apt) pkg_install auditd audispd-plugins logrotate ;;
|
||||
dnf) pkg_install audit policycoreutils-python-utils logrotate ;;
|
||||
esac
|
||||
|
||||
cat > /etc/audit/rules.d/server-setup.rules << 'EOF'
|
||||
-w /etc/sudoers -p wa -k sudoers
|
||||
-w /etc/passwd -p wa -k identity
|
||||
-w /etc/group -p wa -k identity
|
||||
-w /etc/ssh/sshd_config -p wa -k ssh_config
|
||||
-a always,exit -F arch=b64 -S execve -k process_exec
|
||||
EOF
|
||||
|
||||
if grep -q "^max_log_file" /etc/audit/auditd.conf 2>/dev/null; then
|
||||
sed -i 's/^max_log_file.*/max_log_file = 50/' /etc/audit/auditd.conf
|
||||
else
|
||||
echo 'max_log_file = 50' >> /etc/audit/auditd.conf
|
||||
fi
|
||||
echo 'num_logs = 8' >> /etc/audit/auditd.conf
|
||||
|
||||
service_restart auditd 2>/dev/null || true
|
||||
service_enable auditd 2>/dev/null || true
|
||||
echo "${GREEN}✅ Аудит: /var/log/audit/audit.log${NC}"
|
||||
pause
|
||||
}
|
||||
|
||||
status_all() {
|
||||
clear
|
||||
echo "${GREEN}📊 СТАТУС СИСТЕМЫ${NC}"
|
||||
echo "=============================================="
|
||||
echo "🔄 Unattended: $(systemctl is-active unattended-upgrades 2>/dev/null || echo 'Неактивен')"
|
||||
echo "🔒 SSH: $(systemctl is-active $SSH_SERVICE 2>/dev/null || echo 'Неактивен')"
|
||||
echo "🛡️ Fail2Ban: $(systemctl is-active fail2ban 2>/dev/null || echo 'Неактивен')"
|
||||
echo "📊 Auditd: $(systemctl is-active auditd 2>/dev/null || echo 'Неактивен')"
|
||||
echo "🐳 Docker: $(systemctl is-active docker 2>/dev/null || echo 'Неактивен')"
|
||||
echo "=============================================="
|
||||
echo "👥 Пользователей: $(check_other_users)"
|
||||
echo "📅 Время: $(date)"
|
||||
pause
|
||||
}
|
||||
|
||||
# --- ГЛАВНОЕ МЕНЮ ---
|
||||
detect_os
|
||||
|
||||
while true; do
|
||||
clear
|
||||
echo "======================================"
|
||||
echo " SERVER ULTIMATE SETUP v3.0 "
|
||||
echo "======================================"
|
||||
echo "1) Сменить Hostname"
|
||||
echo "2) Настроить время и базу (mc, gdu...)"
|
||||
echo "3) СОЗДАТЬ ПОЛЬЗОВАТЕЛЯ (SSH Key + sudo)"
|
||||
echo "4) БЕЗОПАСНОСТЬ SSH (Только после п.3!)"
|
||||
echo "5) Аудит системы (auditd)"
|
||||
echo "6) Установить Docker + Compose"
|
||||
echo "7) Установить WireGuard"
|
||||
echo "8) Установить OpenVPN (Angristan)"
|
||||
echo "9) Мониторинг (Netdata/Glances)"
|
||||
echo "10) Защита (Fail2Ban)"
|
||||
echo "11) ОЧИСТКА: Удалить старые ядра"
|
||||
echo "0) Выход"
|
||||
echo "======================================"
|
||||
read -p "Выберите пункт: " opt
|
||||
echo "=============================================="
|
||||
echo " 🚀 SERVER ULTIMATE v5.1 ($OS_ID $OS_VERSION) 🚀"
|
||||
echo "=============================================="
|
||||
echo "1) 📛 Hostname 2) 🌍 Часовой пояс + база"
|
||||
echo "3) 👤 Пользователь 4) 🔒 SSH безопасность"
|
||||
echo "5) 📊 Аудит + ротация 6) 🐳 Docker + Compose"
|
||||
echo "7) 🌐 WireGuard 8) 🔐 OpenVPN (Angristan)"
|
||||
echo "9) 📈 Мониторинг 10) 🛡️ Fail2Ban"
|
||||
echo "11) 🧹 Очистка пакетов 12) 🔄 Автообновления"
|
||||
echo "S) 📊 Статус всех сервисов 0) ❌ Выход"
|
||||
echo "=============================================="
|
||||
read -p "► " opt
|
||||
|
||||
case $opt in
|
||||
1) hostnamectl set-hostname "$(read -p 'Name: ' name; echo $name)" ; systemctl restart systemd-hostnamed ; pause ;;
|
||||
2) timedatectl set-timezone Europe/Moscow ; apt update && apt install -y mc htop zip wget curl git net-tools gnupg2 ; pause ;;
|
||||
3)
|
||||
read -p "Имя: " UNAME
|
||||
read -p "SSH Key: " UKEY
|
||||
useradd -m -s /bin/bash "$UNAME"
|
||||
usermod -aG sudo "$UNAME"
|
||||
mkdir -p /home/$UNAME/.ssh && echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
|
||||
chown -R $UNAME:$UNAME /home/$UNAME/.ssh
|
||||
echo "$UNAME ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/$UNAME
|
||||
echo -e "${GREEN}Пользователь $UNAME готов.${NC}" ; pause ;;
|
||||
4) setup_ssh_security ; pause ;;
|
||||
5) install_audit ; pause ;;
|
||||
6) curl -fsSL https://get.docker.com | sh ; apt install -y docker-compose-plugin ; pause ;;
|
||||
7) wget https://git.io/wireguard -O wg.sh && bash wg.sh ; pause ;;
|
||||
8) install_openvpn_angristan ; pause ;;
|
||||
9) apt install -y glances ; pause ;;
|
||||
10) apt install -y fail2ban ; systemctl enable --now fail2ban ; pause ;;
|
||||
11) apt-get purge $(dpkg -l 'linux-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d' | head -n -1) -y ; apt autoremove -y ; pause ;;
|
||||
1) read -p "Имя хоста: " HN; hostnamectl set-hostname "$HN" 2>/dev/null || hostname "$HN"; systemctl restart systemd-hostnamed 2>/dev/null || true; pause ;;
|
||||
2) setup_timezone_interactive; install_base_pkgs ;;
|
||||
3) create_user_full ;;
|
||||
4) setup_ssh_security ;;
|
||||
5) install_audit_with_rotation ;;
|
||||
6) $DOCKER_CMD; service_enable docker; pause ;;
|
||||
7) curl -fsSL https://git.io/wireguard -o wg.sh && bash wg.sh; pause ;;
|
||||
8) curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && chmod +x openvpn-install.sh && ./openvpn-install.sh; pause ;;
|
||||
9) pkg_install glances htop; pause ;;
|
||||
10) pkg_install fail2ban; service_enable fail2ban; pause ;;
|
||||
11) $PKG_MGR autoremove -y && $PKG_MGR autoclean -y; pause ;;
|
||||
12) install_unattended_upgrades ;;
|
||||
[Ss]) status_all ;;
|
||||
0) break ;;
|
||||
*) echo "❌ Неверный пункт!"; sleep 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo "🎉 Настройка завершена! Сервер готов к работе!"
|
||||
|
||||
Reference in New Issue
Block a user