Update something
This commit is contained in:
tiff
parent
e2770b318f
commit
5f5e43f781
4 changed files with 364 additions and 0 deletions
135
jupyter-notebook.sh
Normal file
135
jupyter-notebook.sh
Normal file
|
|
@ -0,0 +1,135 @@
|
|||
#!/bin/bash
|
||||
################################################################################
|
||||
# Script: jupyter-notebook.sh
|
||||
# Author: Eric Ruzanski
|
||||
# Description: This script installs and configures the classic Jupyter Notebook,
|
||||
# serves it securely via an Nginx reverse proxy, and makes it
|
||||
# accessible through a web browser via the provided domain or
|
||||
# default reverse DNS (rDNS) of the Linode. If the Linode is ever
|
||||
# rebooted, or Jupyter Notebook stops running, simply start
|
||||
# Jupyter Notebook from the command line using 'jupyter notebook &'.
|
||||
#
|
||||
# GitHub Repository:
|
||||
# https://github.com/ericruzanski/StackScripts/blob/main/jupyter-notebook.sh
|
||||
#
|
||||
# Jupyter Notebook Docs:
|
||||
# https://jupyter-notebook.readthedocs.io/en/latest/
|
||||
#
|
||||
# Disclaimer: This script is provided as-is without any warranties.
|
||||
################################################################################
|
||||
## Jupyter Notebook Settings
|
||||
#<UDF name="notebook_password" label="Jupyter Notebook Password" example="s3cure_p4ssw0rd">
|
||||
#<UDF name="soa_email_address" label="Email address (for the Let's Encrypt SSL certificate)" example="user@domain.tld">
|
||||
## Linode/SSH Security Settings
|
||||
#<UDF name="username" label="The limited sudo user to be created for the Linode" default="">
|
||||
#<UDF name="password" label="The password for the limited sudo user" example="an0th3r_s3cure_p4ssw0rd" default="">
|
||||
#<UDF name="pubkey" label="The SSH Public Key that will be used to access the Linode" default="">
|
||||
#<UDF name="disable_root" label="Disable root access over SSH?" oneOf="Yes,No" default="No">
|
||||
## Domain Settings
|
||||
#<UDF name="token_password" label="Your Linode API token. This is needed to create your server's DNS records" default="">
|
||||
#<UDF name="subdomain" label="Subdomain" example="The subdomain for the DNS record: www (Requires Domain)" default="">
|
||||
#<UDF name="domain" label="Domain" example="The domain for the DNS record: example.com (Requires API token)" default="">
|
||||
## Enable logging
|
||||
set -x
|
||||
exec > >(tee /dev/ttyS0 /var/log/stackscript.log) 2>&1
|
||||
## Import the Bash StackScript Library
|
||||
source <ssinclude StackScriptID=1>
|
||||
## Import the DNS/API Functions Library
|
||||
source <ssinclude StackScriptID=632759>
|
||||
## Import the OCA Helper Functions
|
||||
source <ssinclude StackScriptID=401712>
|
||||
## Run initial configuration tasks (DNS/SSH stuff, etc...)
|
||||
source <ssinclude StackScriptID=666912>
|
||||
## Register default rDNS
|
||||
export DEFAULT_RDNS=$(dnsdomainname -A | awk '{print $1}')
|
||||
## Set absolute domain if any, otherwise use DEFAULT_RDNS
|
||||
if [[ $DOMAIN = "" ]]; then
|
||||
readonly ABS_DOMAIN="$DEFAULT_RDNS"
|
||||
elif [[ $SUBDOMAIN = "" ]]; then
|
||||
readonly ABS_DOMAIN="$DOMAIN"
|
||||
else
|
||||
readonly ABS_DOMAIN="$SUBDOMAIN.$DOMAIN"
|
||||
fi
|
||||
create_a_record $SUBDOMAIN $IP $DOMAIN
|
||||
## Update system, set hostname & install basic security
|
||||
set_hostname
|
||||
apt_setup_update
|
||||
ufw_install
|
||||
fail2ban_install
|
||||
## Add UFW rules
|
||||
ufw allow http
|
||||
ufw allow https
|
||||
ufw allow 8888
|
||||
## Prepare the Python venv
|
||||
apt-get install python3-venv python3-pip -y
|
||||
mkdir /root/jupyter-notebook
|
||||
mkdir /opt/notebooks
|
||||
python3 -m venv /root/jupyter-notebook
|
||||
source /root/jupyter-notebook/bin/activate
|
||||
python3 -m pip install notebook
|
||||
# Configure Jupyter Notebook
|
||||
jupyter notebook --generate-config
|
||||
CONFIG_FILE="/root/.jupyter/jupyter_notebook_config.py"
|
||||
HASHED_PASSWORD=$(python3 -c "from jupyter_server.auth import passwd; print(passwd('$NOTEBOOK_PASSWORD'))")
|
||||
sudo tee -a $CONFIG_FILE <<EOF
|
||||
c.NotebookApp.notebook_dir = '/opt/notebooks'
|
||||
c.NotebookApp.open_browser = False
|
||||
c.NotebookApp.password = u'$HASHED_PASSWORD'
|
||||
c.NotebookApp.allow_origin = '*'
|
||||
c.NotebookApp.allow_root = True
|
||||
c.NotebookApp.trust_xheaders = True
|
||||
EOF
|
||||
deactivate
|
||||
## Install NGINX reverse-proxy
|
||||
apt-get install nginx -y
|
||||
# Configure NGINX reverse proxy
|
||||
rm /etc/nginx/sites-enabled/default
|
||||
touch /etc/nginx/sites-available/reverse-proxy.conf
|
||||
cat <<END > /etc/nginx/sites-available/reverse-proxy.conf
|
||||
server {
|
||||
listen 80;
|
||||
server_name ${ABS_DOMAIN};
|
||||
access_log /var/log/nginx/reverse-access.log;
|
||||
error_log /var/log/nginx/reverse-error.log;
|
||||
location /wss/ {
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
proxy_http_version 1.1;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
location /api/kernels/ {
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
proxy_http_version 1.1;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
location /terminals/ {
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
proxy_http_version 1.1;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
}
|
||||
}
|
||||
END
|
||||
ln -s /etc/nginx/sites-available/reverse-proxy.conf /etc/nginx/sites-enabled/reverse-proxy.conf
|
||||
# Enable and start NGINX
|
||||
systemctl enable nginx
|
||||
systemctl restart nginx
|
||||
sleep 90
|
||||
## Configure SSL
|
||||
apt-get install python3-certbot-nginx -y
|
||||
certbot run --non-interactive --nginx --agree-tos --redirect -d ${ABS_DOMAIN} -m ${SOA_EMAIL_ADDRESS} -w /var/www/html/
|
||||
## Cleanup
|
||||
stackscript_cleanup
|
||||
## Start Jupyter Notebook
|
||||
source /root/jupyter-notebook/bin/activate
|
||||
jupyter notebook
|
||||
34
kali-gui-linode.sh
Normal file
34
kali-gui-linode.sh
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
#!/bin/bash
|
||||
|
||||
|
||||
# Install Xfce desktop environment and related packages
|
||||
apt-get update -y
|
||||
apt-get install -y xfce4 xfce4-goodies xorg dbus-x11 x11-xserver-utils
|
||||
# Install and configure Xrdp
|
||||
apt-get install -y xrdp
|
||||
sed -i 's/3389/3390/g' /etc/xrdp/xrdp.ini
|
||||
systemctl enable xrdp
|
||||
systemctl restart xrdp
|
||||
# Open firewall ports
|
||||
ufw allow 3390/tcp
|
||||
# Create user with password
|
||||
useradd -m -s /bin/bash username
|
||||
echo "username:password" | chpasswd
|
||||
# Set up VNC server
|
||||
apt-get install -y tightvncserver
|
||||
su -c "echo 'password' | vncpasswd -f > ~/.vnc/passwd" username
|
||||
chmod 0600 /home/username/.vnc/passwd
|
||||
echo "#!/bin/sh" > /etc/init.d/vncserver
|
||||
echo "" >> /etc/init.d/vncserver
|
||||
echo "export USER='username'" >> /etc/init.d/vncserver
|
||||
echo "eval cd ~\$USER" >> /etc/init.d/vncserver
|
||||
echo "" >> /etc/init.d/vncserver
|
||||
echo "/usr/bin/vncserver :1 -geometry 1280x720 -depth 16 -localhost" >> /etc/init.d/vncserver
|
||||
echo "" >> /etc/init.d/vncserver
|
||||
chmod +x /etc/init.d/vncserver
|
||||
update-rc.d vncserver defaults
|
||||
# Clean up
|
||||
apt-get clean
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
# Reboot the system
|
||||
shutdown -r now
|
||||
40
shadowsocks-server.sh
Normal file
40
shadowsocks-server.sh
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
#!/bin/bash
|
||||
|
||||
# <UDF name="SERVER_PORT" Label="Shadowsocks Server Port" default="8388" />
|
||||
# <UDF name="LOCAL_ADDRESS" Label="Local Address" default="127.0.0.1" />
|
||||
# <UDF name="LOCAL_PORT" Label="Local Port" default="1080" />
|
||||
# <UDF name="PASSWORD" Label="Password" />
|
||||
# <UDF name="METHOD" Label="Method" default="rc4-md5" />
|
||||
# <UDF name="L2TP_USERNAME" Label="L2TP Username" default="" />
|
||||
# <UDF name="L2TP_PASSWORD" Label="L2TP Password" default="" />
|
||||
# <UDF name="L2TP_PSK" Label="L2TP PSK" default="" />
|
||||
cat >>/etc/gai.conf<<EOF
|
||||
precedence ::ffff:0:0/96 100
|
||||
EOF
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y python-pip
|
||||
pip install --upgrade pip
|
||||
sudo pip install shadowsocks
|
||||
sudo apt-get install -y python-m2crypto
|
||||
cat >>/etc/shadowsocks.json<<EOF
|
||||
{
|
||||
"server":"0.0.0.0",
|
||||
"server_port":$SERVER_PORT,
|
||||
"password":"$PASSWORD",
|
||||
"local_address":"$LOCAL_ADDRESS",
|
||||
"local_port":$LOCAL_PORT,
|
||||
"method":"$METHOD",
|
||||
"timeout":300
|
||||
}
|
||||
EOF
|
||||
sudo chmod 755 /etc/shadowsocks.json
|
||||
cat >>/etc/rc.local<<EOF
|
||||
/usr/local/bin/ssserver –c /etc/shadowsocks.json
|
||||
EOF
|
||||
sudo ssserver -c /etc/shadowsocks.json -d start
|
||||
wget https://git.io/vpnsetup -O vpnsetup.sh
|
||||
sudo VPN_IPSEC_PSK=$L2TP_PSK VPN_USER=$L2TP_USERNAME VPN_PASSWORD=$L2TP_PASSWORD sh vpnsetup.sh
|
||||
echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
|
||||
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
|
||||
sysctl -p
|
||||
reboot
|
||||
155
wazuh.sh
Normal file
155
wazuh.sh
Normal file
|
|
@ -0,0 +1,155 @@
|
|||
#!/usr/bin/env bash
|
||||
# #<UDF name="soa_email_address" label="Email address (for the Let's Encrypt SSL certificate)" example="user@domain.tld">
|
||||
## Linode/SSH Security Settings
|
||||
#<UDF name="username" label="The limited sudo user to be created for the Linode" default="">
|
||||
#<UDF name="password" label="The password for the limited sudo user" example="an0th3r_s3cure_p4ssw0rd" default="">
|
||||
#<UDF name="pubkey" label="The SSH Public Key that will be used to access the Linode" default="">
|
||||
#<UDF name="disable_root" label="Disable root access over SSH?" oneOf="Yes,No" default="No">
|
||||
## Domain Settings
|
||||
#<UDF name="token_password" label="Your Linode API token. This is needed to create your WordPress server's DNS records" default="">
|
||||
#<UDF name="subdomain" label="Subdomain" example="The subdomain for the DNS record: www (Requires Domain)" default="">
|
||||
#<UDF name="domain" label="Domain" example="The domain for the DNS record: example.com (Requires API token)" default="">
|
||||
## Enable logging
|
||||
set -xo pipefail
|
||||
exec > >(tee /dev/ttyS0 /var/log/stackscript.log) 2>&1
|
||||
## Import the Bash StackScript Library
|
||||
source <ssinclude StackScriptID=1>
|
||||
## Import the DNS/API Functions Library
|
||||
source <ssinclude StackScriptID=632759>
|
||||
## Import the OCA Helper Functions
|
||||
source <ssinclude StackScriptID=401712>
|
||||
## Run initial configuration tasks (DNS/SSH stuff, etc...)
|
||||
source <ssinclude StackScriptID=666912>
|
||||
# UFW https://documentation.wazuh.com/current/getting-started/architecture.html
|
||||
ufw allow 1514
|
||||
ufw allow 1515
|
||||
ufw allow 1516
|
||||
ufw allow 514
|
||||
ufw allow 55000
|
||||
ufw allow 443
|
||||
ufw allow 80
|
||||
ufw allow 9200
|
||||
ufw allow 9300
|
||||
# Prereqs & Wazuh Install
|
||||
apt install -y curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg2 default-jre
|
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo apt-key add -
|
||||
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
|
||||
apt_setup_update
|
||||
apt install -y wazuh-manager
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now wazuh-manager
|
||||
# Elastic
|
||||
apt install -y elasticsearch-oss opendistroforelasticsearch
|
||||
curl -so /etc/elasticsearch/elasticsearch.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/7.x/elasticsearch_all_in_one.yml
|
||||
curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles.yml
|
||||
curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles_mapping.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles_mapping.yml
|
||||
curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/internal_users.yml
|
||||
rm -f /etc/elasticsearch/{esnode-key.pem,esnode.pem,kirk-key.pem,kirk.pem,root-ca.pem}
|
||||
curl -so ~/wazuh-cert-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/wazuh-cert-tool.sh
|
||||
curl -so ~/instances.yml https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/instances_aio.yml
|
||||
bash ~/wazuh-cert-tool.sh
|
||||
mkdir /etc/elasticsearch/certs/
|
||||
mv ~/certs/elasticsearch* /etc/elasticsearch/certs/
|
||||
mv ~/certs/admin* /etc/elasticsearch/certs/
|
||||
cp ~/certs/root-ca* /etc/elasticsearch/certs/
|
||||
systemctl daemon-reload
|
||||
systemctl enable elasticsearch
|
||||
systemctl start elasticsearch
|
||||
export JAVA_HOME=/usr/share/elasticsearch/jdk/ && /usr/share/elasticsearch/plugins/opendistro_security/tools/securityadmin.sh -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -nhnv -cacert /etc/elasticsearch/certs/root-ca.pem -cert /etc/elasticsearch/certs/admin.pem -key /etc/elasticsearch/certs/admin-key.pem
|
||||
# FOR TESTING
|
||||
curl -XGET https://localhost:9200 -u admin:admin -k
|
||||
# Filebeat
|
||||
apt install -y filebeat
|
||||
curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/resources/4.2/open-distro/filebeat/7.x/filebeat_all_in_one.yml
|
||||
curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.2/extensions/elasticsearch/7.x/wazuh-template.json
|
||||
chmod go+r /etc/filebeat/wazuh-template.json
|
||||
curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module
|
||||
mkdir /etc/filebeat/certs
|
||||
cp ~/certs/root-ca.pem /etc/filebeat/certs/
|
||||
mv ~/certs/filebeat* /etc/filebeat/certs/
|
||||
systemctl daemon-reload
|
||||
systemctl enable filebeat
|
||||
systemctl start filebeat
|
||||
# TESTING
|
||||
filebeat test output
|
||||
# Kibana
|
||||
apt install -y opendistroforelasticsearch-kibana
|
||||
curl -so /etc/kibana/kibana.yml https://packages.wazuh.com/resources/4.2/open-distro/kibana/7.x/kibana_all_in_one.yml
|
||||
mkdir /usr/share/kibana/data
|
||||
chown -R kibana:kibana /usr/share/kibana/data
|
||||
cd /usr/share/kibana
|
||||
sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.2_7.10.2-1.zip
|
||||
mkdir /etc/kibana/certs
|
||||
cp ~/certs/root-ca.pem /etc/kibana/certs/
|
||||
mv ~/certs/kibana* /etc/kibana/certs/
|
||||
chown kibana:kibana /etc/kibana/certs/*
|
||||
setcap 'cap_net_bind_service=+ep' /usr/share/kibana/node/bin/node
|
||||
systemctl daemon-reload
|
||||
systemctl enable kibana
|
||||
systemctl start kibana
|
||||
# Get Passwords
|
||||
cd && curl -so wazuh-passwords-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/wazuh-passwords-tool.sh
|
||||
#bash wazuh-passwords-tool.sh -a > .wazuh_creds.txt
|
||||
# NGINX
|
||||
apt install git nginx certbot python3-certbot-nginx -y
|
||||
mkdir -p /var/www/certs/.well-known
|
||||
chown -R www-data:www-data /var/www/certs/
|
||||
cat <<EOF > /etc/nginx/sites-available/$FQDN
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name $FQDN;
|
||||
root /var/www/certs;
|
||||
location / {
|
||||
try_files \$uri \$uri/ =404;
|
||||
}
|
||||
# allow .well-known
|
||||
location ^~ /.well-known {
|
||||
allow all;
|
||||
auth_basic off;
|
||||
alias /var/www/certs/.well-known;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ln -s /etc/nginx/sites-available/$FQDN /etc/nginx/sites-enabled/$FQDN
|
||||
unlink /etc/nginx/sites-enabled/default
|
||||
systemctl restart nginx
|
||||
# SSL Certbot
|
||||
certbot certonly --agree-tos --webroot --webroot-path=/var/www/certs -d $FQDN -m $SOA_EMAIL_ADDRESS
|
||||
# Set Variables
|
||||
export KIBANA_FULL=/etc/kibana/certs/fullchain.pem
|
||||
export KIBANA_PRIVKEY=/etc/kibana/certs/privkey.pem
|
||||
export FULLCHAIN=/etc/letsencrypt/live/$FQDN/fullchain.pem
|
||||
export PRIVKEY=/etc/letsencrypt/live/$FQDN/privkey.pem
|
||||
# Place certificates in /etc/kibana/kibana.yml
|
||||
cat $FULLCHAIN > $KIBANA_FULL
|
||||
cat $PRIVKEY > $KIBANA_PRIVKEY
|
||||
# Update kibana config to point to letsencrypt certs
|
||||
sed -i -e "s/kibana-key.pem/privkey.pem/" /etc/kibana/kibana.yml
|
||||
sed -i -e "s/kibana.pem/fullchain.pem/" /etc/kibana/kibana.yml
|
||||
# Restart Kibana
|
||||
service kibana restart
|
||||
# Create Cert renewal cron script
|
||||
cat <<END >/root/certbot-kibana-renewal.sh
|
||||
#!/bin/bash
|
||||
#
|
||||
# Script to handle Certbot renewal & Kibana
|
||||
# Debug
|
||||
# set -xo pipefail
|
||||
export KIBANA_FULL=/etc/kibana/certs/fullchain.pem
|
||||
export KIBANA_PRIVKEY=/etc/kibana/certs/privkey.pem
|
||||
export FULLCHAIN=/etc/letsencrypt/live/$FQDN/fullchain.pem
|
||||
export PRIVKEY=/etc/letsencrypt/live/$FQDN/privkey.pem
|
||||
certbot renew
|
||||
cat \$FULLCHAIN > \$KIBANA_FULL
|
||||
cat \$PRIVKEY > \$KIBANA_PRIVKEY
|
||||
service kibana restart
|
||||
END
|
||||
chmod +x /root/certbot-kibana-renewal.sh
|
||||
# Setup Cron
|
||||
crontab -l > cron
|
||||
echo "* 1 * * 1 bash /root/certbot-kibana-renewal.sh" >> cron
|
||||
crontab cron
|
||||
rm cron
|
||||
# Cleanup
|
||||
stackscript_cleanup
|
||||
Loading…
Reference in a new issue