49 lines
1.3 KiB
Bash
49 lines
1.3 KiB
Bash
secure_ssh() {
|
|
CONF="/etc/ssh/sshd_config"
|
|
PROFILE="/opt/server-ultimate/config/ssh-hardening.conf"
|
|
|
|
SNAP=$(backup_create ssh "$CONF")
|
|
|
|
echo ""
|
|
read -p "Отключить вход по паролю? (y/N): " DISABLE_PASS
|
|
|
|
if [[ "$DISABLE_PASS" == "y" ]]; then
|
|
confirm_ssh_key_works || {
|
|
err "Ключ не подтверждён. Операция отменена."
|
|
pause
|
|
return
|
|
}
|
|
fi
|
|
|
|
# Удаляем старые параметры
|
|
sed -i '/^PermitRootLogin/d
|
|
/^PasswordAuthentication/d
|
|
/^PubkeyAuthentication/d
|
|
/^MaxAuthTries/d
|
|
/^ClientAliveInterval/d
|
|
/^ClientAliveCountMax/d
|
|
/^X11Forwarding/d
|
|
/^AllowTcpForwarding/d
|
|
/^TCPKeepAlive/d
|
|
/^UseDNS/d' "$CONF"
|
|
|
|
# Применяем профиль
|
|
cat "$PROFILE" >> "$CONF"
|
|
|
|
# Пароль — по выбору
|
|
if [[ "$DISABLE_PASS" != "y" ]]; then
|
|
sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/' "$CONF"
|
|
fi
|
|
|
|
if sshd -t; then
|
|
systemctl restart sshd
|
|
log "SSH security профиль применён"
|
|
else
|
|
err "Ошибка SSH → rollback"
|
|
cp "$SNAP/sshd_config" "$CONF"
|
|
systemctl restart sshd
|
|
fi
|
|
|
|
pause
|
|
}
|