From 5f5e43f781aae4ffe952d7b24aab7e03f4ad23f8 Mon Sep 17 00:00:00 2001 From: tiff Date: Wed, 17 Jul 2024 14:47:42 -0400 Subject: [PATCH] Update something --- jupyter-notebook.sh | 135 ++++++++++++++++++++++++++++++++++++ kali-gui-linode.sh | 34 +++++++++ shadowsocks-server.sh | 40 +++++++++++ wazuh.sh | 155 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 364 insertions(+) create mode 100644 jupyter-notebook.sh create mode 100644 kali-gui-linode.sh create mode 100644 shadowsocks-server.sh create mode 100644 wazuh.sh diff --git a/jupyter-notebook.sh b/jupyter-notebook.sh new file mode 100644 index 0000000..f9f6896 --- /dev/null +++ b/jupyter-notebook.sh @@ -0,0 +1,135 @@ +#!/bin/bash +################################################################################ +# Script: jupyter-notebook.sh +# Author: Eric Ruzanski +# Description: This script installs and configures the classic Jupyter Notebook, +# serves it securely via an Nginx reverse proxy, and makes it +# accessible through a web browser via the provided domain or +# default reverse DNS (rDNS) of the Linode. If the Linode is ever +# rebooted, or Jupyter Notebook stops running, simply start +# Jupyter Notebook from the command line using 'jupyter notebook &'. +# +# GitHub Repository: +# https://github.com/ericruzanski/StackScripts/blob/main/jupyter-notebook.sh +# +# Jupyter Notebook Docs: +# https://jupyter-notebook.readthedocs.io/en/latest/ +# +# Disclaimer: This script is provided as-is without any warranties. +################################################################################ +## Jupyter Notebook Settings +# +# +## Linode/SSH Security Settings +# +# +# +# +## Domain Settings +# +# +# +## Enable logging +set -x +exec > >(tee /dev/ttyS0 /var/log/stackscript.log) 2>&1 +## Import the Bash StackScript Library +source +## Import the DNS/API Functions Library +source +## Import the OCA Helper Functions +source +## Run initial configuration tasks (DNS/SSH stuff, etc...) +source +## Register default rDNS +export DEFAULT_RDNS=$(dnsdomainname -A | awk '{print $1}') +## Set absolute domain if any, otherwise use DEFAULT_RDNS +if [[ $DOMAIN = "" ]]; then + readonly ABS_DOMAIN="$DEFAULT_RDNS" +elif [[ $SUBDOMAIN = "" ]]; then + readonly ABS_DOMAIN="$DOMAIN" +else + readonly ABS_DOMAIN="$SUBDOMAIN.$DOMAIN" +fi +create_a_record $SUBDOMAIN $IP $DOMAIN +## Update system, set hostname & install basic security +set_hostname +apt_setup_update +ufw_install +fail2ban_install +## Add UFW rules +ufw allow http +ufw allow https +ufw allow 8888 +## Prepare the Python venv +apt-get install python3-venv python3-pip -y +mkdir /root/jupyter-notebook +mkdir /opt/notebooks +python3 -m venv /root/jupyter-notebook +source /root/jupyter-notebook/bin/activate +python3 -m pip install notebook +# Configure Jupyter Notebook +jupyter notebook --generate-config +CONFIG_FILE="/root/.jupyter/jupyter_notebook_config.py" +HASHED_PASSWORD=$(python3 -c "from jupyter_server.auth import passwd; print(passwd('$NOTEBOOK_PASSWORD'))") +sudo tee -a $CONFIG_FILE < /etc/nginx/sites-available/reverse-proxy.conf +server { + listen 80; + server_name ${ABS_DOMAIN}; + access_log /var/log/nginx/reverse-access.log; + error_log /var/log/nginx/reverse-error.log; + location /wss/ { + proxy_pass http://127.0.0.1:8888; + proxy_http_version 1.1; + proxy_buffering off; + proxy_set_header Upgrade \$http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_read_timeout 86400; + } + location /api/kernels/ { + proxy_pass http://127.0.0.1:8888; + proxy_http_version 1.1; + proxy_buffering off; + proxy_set_header Upgrade \$http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_read_timeout 86400; + } + location /terminals/ { + proxy_pass http://127.0.0.1:8888; + proxy_http_version 1.1; + proxy_buffering off; + proxy_set_header Upgrade \$http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_read_timeout 86400; + } + location / { + proxy_pass http://127.0.0.1:8888; + } +} +END +ln -s /etc/nginx/sites-available/reverse-proxy.conf /etc/nginx/sites-enabled/reverse-proxy.conf +# Enable and start NGINX +systemctl enable nginx +systemctl restart nginx +sleep 90 +## Configure SSL +apt-get install python3-certbot-nginx -y +certbot run --non-interactive --nginx --agree-tos --redirect -d ${ABS_DOMAIN} -m ${SOA_EMAIL_ADDRESS} -w /var/www/html/ +## Cleanup +stackscript_cleanup +## Start Jupyter Notebook +source /root/jupyter-notebook/bin/activate +jupyter notebook \ No newline at end of file diff --git a/kali-gui-linode.sh b/kali-gui-linode.sh new file mode 100644 index 0000000..1a6327d --- /dev/null +++ b/kali-gui-linode.sh @@ -0,0 +1,34 @@ +#!/bin/bash + + +# Install Xfce desktop environment and related packages +apt-get update -y +apt-get install -y xfce4 xfce4-goodies xorg dbus-x11 x11-xserver-utils +# Install and configure Xrdp +apt-get install -y xrdp +sed -i 's/3389/3390/g' /etc/xrdp/xrdp.ini +systemctl enable xrdp +systemctl restart xrdp +# Open firewall ports +ufw allow 3390/tcp +# Create user with password +useradd -m -s /bin/bash username +echo "username:password" | chpasswd +# Set up VNC server +apt-get install -y tightvncserver +su -c "echo 'password' | vncpasswd -f > ~/.vnc/passwd" username +chmod 0600 /home/username/.vnc/passwd +echo "#!/bin/sh" > /etc/init.d/vncserver +echo "" >> /etc/init.d/vncserver +echo "export USER='username'" >> /etc/init.d/vncserver +echo "eval cd ~\$USER" >> /etc/init.d/vncserver +echo "" >> /etc/init.d/vncserver +echo "/usr/bin/vncserver :1 -geometry 1280x720 -depth 16 -localhost" >> /etc/init.d/vncserver +echo "" >> /etc/init.d/vncserver +chmod +x /etc/init.d/vncserver +update-rc.d vncserver defaults +# Clean up +apt-get clean +rm -rf /var/lib/apt/lists/* +# Reboot the system +shutdown -r now \ No newline at end of file diff --git a/shadowsocks-server.sh b/shadowsocks-server.sh new file mode 100644 index 0000000..5c8a645 --- /dev/null +++ b/shadowsocks-server.sh @@ -0,0 +1,40 @@ +#!/bin/bash + +# +# +# +# +# +# +# +# +cat >>/etc/gai.conf<>/etc/shadowsocks.json<>/etc/rc.local<> /etc/sysctl.conf +echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf +sysctl -p +reboot diff --git a/wazuh.sh b/wazuh.sh new file mode 100644 index 0000000..c455f2e --- /dev/null +++ b/wazuh.sh @@ -0,0 +1,155 @@ +#!/usr/bin/env bash +# # +## Linode/SSH Security Settings +# +# +# +# +## Domain Settings +# +# +# +## Enable logging +set -xo pipefail +exec > >(tee /dev/ttyS0 /var/log/stackscript.log) 2>&1 +## Import the Bash StackScript Library +source +## Import the DNS/API Functions Library +source +## Import the OCA Helper Functions +source +## Run initial configuration tasks (DNS/SSH stuff, etc...) +source +# UFW https://documentation.wazuh.com/current/getting-started/architecture.html +ufw allow 1514 +ufw allow 1515 +ufw allow 1516 +ufw allow 514 +ufw allow 55000 +ufw allow 443 +ufw allow 80 +ufw allow 9200 +ufw allow 9300 +# Prereqs & Wazuh Install +apt install -y curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg2 default-jre +curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo apt-key add - +echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list +apt_setup_update +apt install -y wazuh-manager +systemctl daemon-reload +systemctl enable --now wazuh-manager +# Elastic +apt install -y elasticsearch-oss opendistroforelasticsearch +curl -so /etc/elasticsearch/elasticsearch.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/7.x/elasticsearch_all_in_one.yml +curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles.yml +curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles_mapping.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles_mapping.yml +curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/internal_users.yml +rm -f /etc/elasticsearch/{esnode-key.pem,esnode.pem,kirk-key.pem,kirk.pem,root-ca.pem} +curl -so ~/wazuh-cert-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/wazuh-cert-tool.sh +curl -so ~/instances.yml https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/instances_aio.yml +bash ~/wazuh-cert-tool.sh +mkdir /etc/elasticsearch/certs/ +mv ~/certs/elasticsearch* /etc/elasticsearch/certs/ +mv ~/certs/admin* /etc/elasticsearch/certs/ +cp ~/certs/root-ca* /etc/elasticsearch/certs/ +systemctl daemon-reload +systemctl enable elasticsearch +systemctl start elasticsearch +export JAVA_HOME=/usr/share/elasticsearch/jdk/ && /usr/share/elasticsearch/plugins/opendistro_security/tools/securityadmin.sh -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -nhnv -cacert /etc/elasticsearch/certs/root-ca.pem -cert /etc/elasticsearch/certs/admin.pem -key /etc/elasticsearch/certs/admin-key.pem +# FOR TESTING +curl -XGET https://localhost:9200 -u admin:admin -k +# Filebeat +apt install -y filebeat +curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/resources/4.2/open-distro/filebeat/7.x/filebeat_all_in_one.yml +curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.2/extensions/elasticsearch/7.x/wazuh-template.json +chmod go+r /etc/filebeat/wazuh-template.json +curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module +mkdir /etc/filebeat/certs +cp ~/certs/root-ca.pem /etc/filebeat/certs/ +mv ~/certs/filebeat* /etc/filebeat/certs/ +systemctl daemon-reload +systemctl enable filebeat +systemctl start filebeat +# TESTING +filebeat test output +# Kibana +apt install -y opendistroforelasticsearch-kibana +curl -so /etc/kibana/kibana.yml https://packages.wazuh.com/resources/4.2/open-distro/kibana/7.x/kibana_all_in_one.yml +mkdir /usr/share/kibana/data +chown -R kibana:kibana /usr/share/kibana/data +cd /usr/share/kibana +sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.2_7.10.2-1.zip +mkdir /etc/kibana/certs +cp ~/certs/root-ca.pem /etc/kibana/certs/ +mv ~/certs/kibana* /etc/kibana/certs/ +chown kibana:kibana /etc/kibana/certs/* +setcap 'cap_net_bind_service=+ep' /usr/share/kibana/node/bin/node +systemctl daemon-reload +systemctl enable kibana +systemctl start kibana +# Get Passwords +cd && curl -so wazuh-passwords-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/wazuh-passwords-tool.sh +#bash wazuh-passwords-tool.sh -a > .wazuh_creds.txt +# NGINX +apt install git nginx certbot python3-certbot-nginx -y +mkdir -p /var/www/certs/.well-known +chown -R www-data:www-data /var/www/certs/ +cat < /etc/nginx/sites-available/$FQDN +server { + listen 80; + listen [::]:80; + server_name $FQDN; + root /var/www/certs; + location / { + try_files \$uri \$uri/ =404; + } +# allow .well-known + location ^~ /.well-known { + allow all; + auth_basic off; + alias /var/www/certs/.well-known; + } +} +EOF +ln -s /etc/nginx/sites-available/$FQDN /etc/nginx/sites-enabled/$FQDN +unlink /etc/nginx/sites-enabled/default +systemctl restart nginx +# SSL Certbot +certbot certonly --agree-tos --webroot --webroot-path=/var/www/certs -d $FQDN -m $SOA_EMAIL_ADDRESS +# Set Variables +export KIBANA_FULL=/etc/kibana/certs/fullchain.pem +export KIBANA_PRIVKEY=/etc/kibana/certs/privkey.pem +export FULLCHAIN=/etc/letsencrypt/live/$FQDN/fullchain.pem +export PRIVKEY=/etc/letsencrypt/live/$FQDN/privkey.pem +# Place certificates in /etc/kibana/kibana.yml +cat $FULLCHAIN > $KIBANA_FULL +cat $PRIVKEY > $KIBANA_PRIVKEY +# Update kibana config to point to letsencrypt certs +sed -i -e "s/kibana-key.pem/privkey.pem/" /etc/kibana/kibana.yml +sed -i -e "s/kibana.pem/fullchain.pem/" /etc/kibana/kibana.yml +# Restart Kibana +service kibana restart +# Create Cert renewal cron script +cat </root/certbot-kibana-renewal.sh +#!/bin/bash +# +# Script to handle Certbot renewal & Kibana +# Debug +# set -xo pipefail +export KIBANA_FULL=/etc/kibana/certs/fullchain.pem +export KIBANA_PRIVKEY=/etc/kibana/certs/privkey.pem +export FULLCHAIN=/etc/letsencrypt/live/$FQDN/fullchain.pem +export PRIVKEY=/etc/letsencrypt/live/$FQDN/privkey.pem +certbot renew +cat \$FULLCHAIN > \$KIBANA_FULL +cat \$PRIVKEY > \$KIBANA_PRIVKEY +service kibana restart +END +chmod +x /root/certbot-kibana-renewal.sh +# Setup Cron +crontab -l > cron +echo "* 1 * * 1 bash /root/certbot-kibana-renewal.sh" >> cron +crontab cron +rm cron +# Cleanup +stackscript_cleanup \ No newline at end of file