#!/bin/bash # ============================================================================= # 🌍 УНИВЕРСАЛЬНЫЙ СЕРВЕРНЫЙ КОМБАЙН v4.0 # Поддержка: Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, Fedora # ============================================================================= GREEN='\033[0;32m' RED='\033[0;31m' YELLOW='\033[1;33m' BLUE='\033[0;34m' NC='\033[0m' # --- ДЕТЕКЦИЯ ОС --- detect_os() { if [ -f /etc/os-release ]; then . /etc/os-release OS_ID=$ID OS_VERSION=$VERSION_ID else OS_ID=$(uname -s | tr '[:upper:]' '[:lower:]') fi case $OS_ID in ubuntu|debian) PKG_MGR="apt" SSH_SERVICE="ssh" DOCKER_CMD="curl -fsSL https://get.docker.com | sh" ;; "almalinux"|"rocky"|"centos"|"fedora") PKG_MGR="dnf" SSH_SERVICE="sshd" DOCKER_CMD="dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo && dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin" ;; *) echo -e "${RED}❌ Неподдерживаемая ОС: $OS_ID${NC}"; exit 1 ;; esac echo -e "${BLUE}🖥️ ОС: ${OS_ID}${NC} | Пакеты: ${PKG_MGR} | SSH: ${SSH_SERVICE}" } # --- УТИЛИТЫ --- pause(){ read -p "Нажмите [Enter]..." fackEnterKey; } pkg_install() { $PKG_MGR update -y && $PKG_MGR install -y "$@"; } service_restart() { if command -v systemctl >/dev/null; then systemctl restart "$1" else service "$1" restart fi } check_other_users() { USER_COUNT=$(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd | wc -l) [ "$USER_COUNT" -eq 0 ] && return 1 || return 0 } # --- ФУНКЦИИ --- setup_timezone_interactive() { echo -e "${GREEN}🌍 Часовой пояс${NC}" echo "1) Europe/Moscow 2) Europe/Kiev 3) Asia/Almaty" echo "4) Asia/Yekaterinburg 5) Asia/Novosibirsk 6) Europe/Berlin" echo "7) America/New_York 8) Asia/Tokyo 0) Ручной" read -p "► " TZ_CHOICE case $TZ_CHOICE in 1) TZ="Europe/Moscow";; 2) TZ="Europe/Kiev";; 3) TZ="Asia/Almaty";; 4) TZ="Asia/Yekaterinburg";; 5) TZ="Asia/Novosibirsk";; 6) TZ="Europe/Berlin";; 7) TZ="America/New_York";; 8) TZ="Asia/Tokyo";; 0) read -p "Зона: " TZ;; *) return;; esac timedatectl set-timezone "$TZ" 2>/dev/null || echo "timedatectl недоступен" timedatectl set-ntp true 2>/dev/null || true echo -e "${GREEN}✅ $TZ | $(date)${NC}" } install_base_pkgs() { echo -e "${GREEN}📦 База${NC}" case $PKG_MGR in apt) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;; dnf) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;; esac # gdu для всех curl -L "https://github.com/dundee/gdu/releases/latest/download/gdu_linux_amd64.tgz" | tar xz chmod +x gdu_linux_amd64 && mv gdu_linux_amd64 /usr/local/bin/ } create_user_full() { echo -e "${GREEN}👤 Пользователь${NC}" read -p "Имя: " UNAME echo "1) Только SSH 2) Пароль+SSH" read -p "► " AUTH_METHOD useradd -m -s /bin/bash "$UNAME" usermod -aG wheel,sudo "$UNAME" 2>/dev/null || usermod -aG sudo "$UNAME" if [ "$AUTH_METHOD" == "1" ]; then read -p "SSH ключ: " UKEY mkdir -p /home/$UNAME/.ssh echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys passwd -l "$UNAME" echo -e "${GREEN}✅ Только SSH${NC}" else read -s -p "Пароль: " PASS1; echo read -s -p "Повторить: " PASS2; echo [ "$PASS1" = "$PASS2" ] && echo "$UNAME:$PASS1" | chpasswd read -p "SSH ключ (опц.): " UKEY [ -n "$UKEY" ] && echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys fi chown -R "$UNAME:$UNAME" /home/$UNAME/.ssh chmod 700 /home/$UNAME/.ssh; chmod 600 /home/$UNAME/.ssh/authorized_keys # Sudo без пароля echo "$UNAME ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${UNAME}" chmod 440 "/etc/sudoers.d/${UNAME}" } setup_ssh_security() { clear; echo -e "${RED}🔒 SSH БЕЗОПАСНОСТЬ${NC}" if ! check_other_users; then echo -e "${RED}🚫 Только root! Сначала пункт 3!${NC}" pause; return fi echo -e "${YELLOW}⚠️ Будет:${NC}" echo " ${RED}✖${NC} root, ${RED}✖${NC} пароли, ${GREEN}✔${NC} только ключи" read -p "ПРОДолжить? (y/N): " CONFIRM [ "$CONFIRM" != "y" ] && { echo "Отменено."; pause; return; } SSHD_CONFIG="/etc/ssh/${SSH_SERVICE}_config" cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak.$(date +%Y%m%d)" sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG" sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' "$SSHD_CONFIG" sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' "$SSHD_CONFIG" if command -v "$SSH_SERVICE" >/dev/null && "$SSH_SERVICE" -t 2>/dev/null; then service_restart "$SSH_SERVICE" echo -e "${GREEN}✅ SSH защищён!${NC}" else echo -e "${RED}❌ Ошибка! Восстановление...${NC}" cp "${SSHD_CONFIG}.bak.$(date +%Y%m%d)" "$SSHD_CONFIG" service_restart "$SSH_SERVICE" fi pause } install_audit_with_rotation() { echo -e "${GREEN}🔒 Аудит${NC}" case $PKG_MGR in apt) pkg_install auditd audispd-plugins logrotate ;; dnf) pkg_install audit policycoreutils-python-utils logrotate ;; esac cat > /etc/audit/rules.d/server-setup.rules << 'EOF' -w /etc/sudoers -p wa -k sudoers -w /etc/passwd -p wa -k identity -w /etc/ssh/sshd_config -p wa -k ssh_config EOF sed -i '/^max_log_file/c\max_log_file = 50' /etc/audit/auditd.conf 2>/dev/null || \ echo 'max_log_file = 50' >> /etc/audit/auditd.conf systemctl restart auditd rsyslog 2>/dev/null || service auditd restart systemctl enable auditd 2>/dev/null || chkconfig auditd on } # --- МЕНЮ --- detect_os while true; do clear echo "=============================================" echo " 🚀 SERVER ULTIMATE v4.0 ($OS_ID $OS_VERSION) 🚀" echo "=============================================" echo "1) 📛 Hostname 2) 🌍 ${GREEN}Часовой пояс${NC} + база" echo "3) 👤 ${GREEN}Пользователь${NC} 4) 🔒 SSH безопасность" echo "5) 📊 Аудит 6) 🐳 Docker" echo "7) 🌐 WireGuard 8) 🔐 OpenVPN" echo "9) 📈 Мониторинг 10) 🛡️ Fail2Ban" echo "11) 🧹 Очистка 0) ❌ Выход" echo "=============================================" read -p "► " opt case $opt in 1) read -p "Имя: " HN; hostnamectl set-hostname "$HN" 2>/dev/null || hostname "$HN"; pause ;; 2) setup_timezone_interactive; install_base_pkgs; pause ;; 3) create_user_full; pause ;; 4) setup_ssh_security ;; 5) install_audit_with_rotation; pause ;; 6) $DOCKER_CMD; systemctl enable --now docker 2>/dev/null || service docker start; pause ;; 7) curl -fsSL https://git.io/wireguard -o wg.sh && bash wg.sh; pause ;; 8) curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && chmod +x openvpn-install.sh && ./openvpn-install.sh; pause ;; 9) pkg_install glances htop; pause ;; 10) pkg_install fail2ban; systemctl enable --now fail2ban 2>/dev/null || service fail2ban start; pause ;; 11) $PKG_MGR autoremove -y; pause ;; 0) break ;; *) echo -e "${RED}❌ Неверно!${NC}"; sleep 1 ;; esac done echo -e "${GREEN}🎉 Настройка завершена!${NC}"