Update Linux/SSH/README.md
This commit is contained in:
@@ -4,8 +4,6 @@
|
|||||||
curl -s https://gitea.glaeser-it.de/WirFixenAlles/Boilerplates/raw/branch/main/Linux/SSH/colorscheme.sh | bash
|
curl -s https://gitea.glaeser-it.de/WirFixenAlles/Boilerplates/raw/branch/main/Linux/SSH/colorscheme.sh | bash
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Erstellen einer sicheren SSH-Anmeldung
|
# Erstellen einer sicheren SSH-Anmeldung
|
||||||
|
|
||||||
Dieses Skript richtet OpenSSH mit sicheren Einstellungen ein und erstellt bei Bedarf Benutzer mit SSH-Zugriff.
|
Dieses Skript richtet OpenSSH mit sicheren Einstellungen ein und erstellt bei Bedarf Benutzer mit SSH-Zugriff.
|
||||||
@@ -20,254 +18,8 @@ Das Skript erlaubt es, SSH-Zugriff nur für bestimmte Benutzer zu konfigurieren.
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Skript: Secure SSH Setup
|
# Secure-SSH Setup ausführen
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
#!/bin/bash
|
curl -s https://gitea.glaeser-it.de/WirFixenAlles/Boilerplates/raw/branch/main/Linux/SSH/secure_ssh.sh | bash
|
||||||
|
|
||||||
printf "\033c"
|
|
||||||
|
|
||||||
SSH_CONFIG_DIR="/etc/ssh/sshd_config.d"
|
|
||||||
SSH_MAIN_CONFIG="/etc/ssh/sshd_config"
|
|
||||||
SSH_CONFIG_FILE="$SSH_CONFIG_DIR/secure.conf"
|
|
||||||
ED25519_KEY="/etc/ssh/ssh_host_ed25519_key"
|
|
||||||
ECDSA_KEY="/etc/ssh/ssh_host_ecdsa_key"
|
|
||||||
|
|
||||||
RED='\033[1;31m'
|
|
||||||
GREEN='\033[1;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
BLUE='\033[1;34m'
|
|
||||||
WHITE='\033[1;37m'
|
|
||||||
RESET='\033[0m'
|
|
||||||
|
|
||||||
log() {
|
|
||||||
echo -e "${GREEN}$1${RESET}"
|
|
||||||
}
|
|
||||||
|
|
||||||
warn() {
|
|
||||||
echo -e "${YELLOW}$1${RESET}"
|
|
||||||
}
|
|
||||||
|
|
||||||
error() {
|
|
||||||
echo -e "${RED}$1${RESET}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_package() {
|
|
||||||
local package=$1
|
|
||||||
local cmd=$2
|
|
||||||
warn "Installiere $package..."
|
|
||||||
if eval "$cmd" &> /dev/null; then
|
|
||||||
log "$package wurde erfolgreich installiert."
|
|
||||||
else
|
|
||||||
error "Fehler bei der Installation von $package."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
if ! command -v sudo &> /dev/null; then
|
|
||||||
warn "sudo ist nicht installiert. Versuche, sudo zu installieren..."
|
|
||||||
|
|
||||||
if command -v apt &> /dev/null; then
|
|
||||||
install_package "sudo" "apt update && apt install -y sudo"
|
|
||||||
elif command -v dnf &> /dev/null; then
|
|
||||||
install_package "sudo" "dnf install -y sudo"
|
|
||||||
elif command -v apk &> /dev/null; then
|
|
||||||
install_package "sudo" "apk add sudo"
|
|
||||||
else
|
|
||||||
error "Nicht unterstütztes System. Bitte sudo manuell installieren."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
log "sudo ist bereits installiert."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! command -v sshd &> /dev/null; then
|
|
||||||
warn "OpenSSH-Server wird installiert..."
|
|
||||||
|
|
||||||
if command -v apt &> /dev/null; then
|
|
||||||
install_package "OpenSSH-Server" "sudo apt update && sudo apt install -y openssh-server"
|
|
||||||
elif command -v dnf &> /dev/null; then
|
|
||||||
install_package "OpenSSH-Server" "sudo dnf install -y openssh-server"
|
|
||||||
elif command -v apk &> /dev/null; then
|
|
||||||
install_package "OpenSSH-Server" "sudo apk add openssh"
|
|
||||||
else
|
|
||||||
error "Nicht unterstütztes System. Bitte OpenSSH manuell installieren."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
log "OpenSSH-Server ist bereits installiert."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -f "$ED25519_KEY" ]; then
|
|
||||||
warn "Host-Schlüssel fehlt. Generiere ssh_host_ed25519_key..."
|
|
||||||
if sudo ssh-keygen -t ed25519 -f "$ED25519_KEY" -N "" &> /dev/null; then
|
|
||||||
sudo chown root:root "$ED25519_KEY"
|
|
||||||
sudo chmod 600 "$ED25519_KEY"
|
|
||||||
log "Host-Schlüssel ssh_host_ed25519_key wurde erstellt."
|
|
||||||
else
|
|
||||||
error "Fehler beim Erstellen des Host-Schlüssels."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
log "Host-Schlüssel ssh_host_ed25519_key ist bereits vorhanden."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -f "$ECDSA_KEY" ]; then
|
|
||||||
warn "Host-Schlüssel fehlt. Generiere ssh_host_ecdsa_key..."
|
|
||||||
if sudo ssh-keygen -t ecdsa -b 384 -f "$ECDSA_KEY" -N "" &> /dev/null; then
|
|
||||||
sudo chown root:root "$ECDSA_KEY"
|
|
||||||
sudo chmod 600 "$ECDSA_KEY"
|
|
||||||
log "Host-Schlüssel ssh_host_ecdsa_key wurde erstellt."
|
|
||||||
else
|
|
||||||
error "Fehler beim Erstellen des Host-Schlüssels."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
log "Host-Schlüssel ssh_host_ecdsa_key ist bereits vorhanden."
|
|
||||||
fi
|
|
||||||
|
|
||||||
sudo rm -f $SSH_CONFIG_DIR/*
|
|
||||||
echo "Include $SSH_CONFIG_DIR/*" | sudo tee $SSH_MAIN_CONFIG > /dev/null
|
|
||||||
|
|
||||||
echo -en "${BLUE}Welche Benutzer dürfen sich per SSH anmelden? (Benutzer durch ${WHITE}Leerzeichen${BLUE} trennen): ${RESET}"
|
|
||||||
read SSH_USERS
|
|
||||||
|
|
||||||
VALID_USERS=""
|
|
||||||
|
|
||||||
# Bestimme die sudo-Gruppe abhängig von der Distribution
|
|
||||||
if [ -f /etc/os-release ]; then
|
|
||||||
. /etc/os-release
|
|
||||||
case "$ID" in
|
|
||||||
ubuntu|debian)
|
|
||||||
SUDO_GROUP="sudo"
|
|
||||||
;;
|
|
||||||
centos|fedora|rhel|almalinux|rocky)
|
|
||||||
SUDO_GROUP="wheel"
|
|
||||||
;;
|
|
||||||
arch|manjaro)
|
|
||||||
SUDO_GROUP="wheel"
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
SUDO_GROUP="sudo" # Fallback auf "sudo"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
else
|
|
||||||
SUDO_GROUP="sudo" # Fallback falls os-release nicht existiert
|
|
||||||
fi
|
|
||||||
|
|
||||||
for user in $SSH_USERS; do
|
|
||||||
if id "$user" &>/dev/null; then
|
|
||||||
log "Benutzer $user existiert."
|
|
||||||
VALID_USERS+="$user "
|
|
||||||
else
|
|
||||||
echo -en "${BLUE}Benutzer ${WHITE}$user${BLUE} existiert nicht. Soll dieser erstellt werden? ${YELLOW}[${WHITE}y/n${YELLOW}]${RESET}: "
|
|
||||||
read CREATE_USER
|
|
||||||
echo -en "${BLUE}Gib ein Passwort für ${WHITE}$user${BLUE} ein: ${RESET}"
|
|
||||||
read -s USER_PASSWORD
|
|
||||||
echo
|
|
||||||
if [ "$CREATE_USER" == "y" ]; then
|
|
||||||
if sudo adduser --disabled-password --gecos "" "$user" &>/dev/null && echo "$user:$USER_PASSWORD" | sudo chpasswd &>/dev/null && sudo usermod -aG $SUDO_GROUP "$user" &>/dev/null; then
|
|
||||||
log "Benutzer $user wurde erstellt und zur $SUDO_GROUP-Gruppe hinzugefügt."
|
|
||||||
sudo mkdir -p /home/$user/.ssh
|
|
||||||
sudo touch /home/$user/.ssh/authorized_keys
|
|
||||||
sudo chown -R $user:$user /home/$user/.ssh
|
|
||||||
sudo chmod 700 /home/$user/.ssh
|
|
||||||
sudo chmod 600 /home/$user/.ssh/authorized_keys
|
|
||||||
echo -en "${BLUE}Möchtest du einen SSH Public Key für ${WHITE}$user${BLUE} hinzufügen? ${YELLOW}[${WHITE}y/n${YELLOW}]${RESET}: "
|
|
||||||
read ADD_KEY
|
|
||||||
if [ "$ADD_KEY" == "y" ]; then
|
|
||||||
echo -en "${BLUE}Füge den SSH Public Key hier ein: ${RESET}"
|
|
||||||
read SSH_KEY
|
|
||||||
echo "$SSH_KEY" | sudo tee -a /home/$user/.ssh/authorized_keys &> /dev/null
|
|
||||||
fi
|
|
||||||
VALID_USERS+="$user "
|
|
||||||
else
|
|
||||||
error "Fehler bei der Erstellung von Benutzer $user."
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
warn "Erstelle SSH-Konfigurationsdatei..."
|
|
||||||
sudo tee $SSH_CONFIG_FILE > /dev/null <<EOL
|
|
||||||
# SSHD Config – Maximale Sicherheit (Nur IPv4)
|
|
||||||
|
|
||||||
# Nur IPv4-Verbindungen
|
|
||||||
AddressFamily inet
|
|
||||||
|
|
||||||
# Standardport (22), kann bei Bedarf geändert werden
|
|
||||||
Port 22
|
|
||||||
|
|
||||||
# Nur Protokoll 2 zulassen (Protokoll 1 ist unsicher)
|
|
||||||
Protocol 2
|
|
||||||
|
|
||||||
# Host-Schlüssel (nur moderne Schlüssel)
|
|
||||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
||||||
HostKey /etc/ssh/ssh_host_ecdsa_key
|
|
||||||
|
|
||||||
# Sichere Key Exchange-Algorithmen (Kex)
|
|
||||||
KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group14-sha256
|
|
||||||
|
|
||||||
# Sichere Ciphers (Chiffren)
|
|
||||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
|
||||||
|
|
||||||
# Sichere MAC-Algorithmen
|
|
||||||
MACs hmac-sha2-512,hmac-sha2-256
|
|
||||||
|
|
||||||
# Log-Einstellungen
|
|
||||||
SyslogFacility AUTHPRIV
|
|
||||||
LogLevel VERBOSE
|
|
||||||
|
|
||||||
# Maximale Login-Wartezeit
|
|
||||||
LoginGraceTime 30s
|
|
||||||
|
|
||||||
# Root-Login verbieten
|
|
||||||
PermitRootLogin no
|
|
||||||
|
|
||||||
# Nur Schlüssel-Authentifizierung erlauben
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
PasswordAuthentication no
|
|
||||||
ChallengeResponseAuthentication no
|
|
||||||
|
|
||||||
# PAM für zusätzliche Sicherheitsmodule verwenden
|
|
||||||
UsePAM yes
|
|
||||||
|
|
||||||
# X11-Weiterleitung deaktivieren (falls nicht benötigt)
|
|
||||||
X11Forwarding no
|
|
||||||
|
|
||||||
# Kein MOTD durch SSH (über PAM regeln)
|
|
||||||
PrintMotd no
|
|
||||||
|
|
||||||
# Pfad zur Authorized Keys-Datei
|
|
||||||
AuthorizedKeysFile .ssh/authorized_keys
|
|
||||||
|
|
||||||
# SFTP-Subsystem (Standard)
|
|
||||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
||||||
|
|
||||||
# Inaktive SSH-Sitzungen überwachen und beenden
|
|
||||||
ClientAliveInterval 300
|
|
||||||
ClientAliveCountMax 2
|
|
||||||
|
|
||||||
AllowUsers $VALID_USERS
|
|
||||||
EOL
|
|
||||||
|
|
||||||
log "Prüfe SSH-Konfiguration..."
|
|
||||||
# Überprüfe, ob der Dienst 'ssh' oder 'sshd' existiert und starte ihn
|
|
||||||
if systemctl list-units --type=service | grep -q "ssh"; then
|
|
||||||
SERVICE_NAME="ssh"
|
|
||||||
elif systemctl list-units --type=service | grep -q "sshd"; then
|
|
||||||
SERVICE_NAME="sshd"
|
|
||||||
else
|
|
||||||
error "Kein SSH-Dienst gefunden."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if sudo systemctl restart $SERVICE_NAME; then
|
|
||||||
log "SSH-Dienst erfolgreich neu gestartet."
|
|
||||||
else
|
|
||||||
error "Fehler beim Neustart des SSH-Dienstes."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
log "Setup abgeschlossen! Nur folgende Benutzer dürfen sich per SSH anmelden: ${WHITE}$VALID_USERS"
|
|
||||||
```
|
```
|
||||||
Reference in New Issue
Block a user