51 lines
2.0 KiB
Bash
51 lines
2.0 KiB
Bash
#!/bin/bash
|
|
|
|
#Nginx Repo setup
|
|
echo '[#] Installing pre-requisites'
|
|
sudo apt install -y curl gnupg2 ca-certificates lsb-release debian-archive-keyring git > /dev/null
|
|
echo '[#] NGINX Repo setup'
|
|
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
|
|
gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg > /dev/null
|
|
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/debian `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list > /dev/null
|
|
echo '[#] Updating APT cache'
|
|
sudo apt update > /dev/null
|
|
|
|
#Crowdsec Repo setup
|
|
echo '[#] Crowdsec Repo setup'
|
|
curl -s https://install.crowdsec.net | sudo sh > /dev/null
|
|
|
|
#Package install
|
|
echo '[#] Installing packages'
|
|
sudo apt install -y iptables nginx crowdsec crowdsec-firewall-bouncer-iptables wireguard avah-daemon > /dev/null
|
|
|
|
#rsyslog setup
|
|
echo '[#] syslog forwarder setup'
|
|
sudo apt install -y rsyslog
|
|
echo '*.* 10.0.100.34:514' | sudo tee --append /etc/rsyslog.conf > /dev/null
|
|
sudo systemctl enable rsyslog
|
|
sudo systemctl start rsyslog
|
|
|
|
#Crowdsec setup
|
|
echo '[#] Enroling endpoint into Crowdsec console'
|
|
sudo cscli console enroll -e context clz7m6x9o0003jo08v8g6lm0v
|
|
|
|
#Add authorized keys to user matthew
|
|
echo '[#] Adding ssh keys'
|
|
mkdir ~/.ssh
|
|
curl http://git.lan.fisherhome.xyz/matthew/project_tunnelfin/raw/branch/main/authorized_keys > ~/.ssh/authorized_keys
|
|
|
|
#Start wireguard service
|
|
echo '[#] Starting Wireguard service'
|
|
sudo systemctl enable --now wg-quick@wg0
|
|
|
|
#Setup iptables
|
|
#iptables -A INPUT -i lo -j ACCEPT
|
|
#iptables -A OUTPUT -o lo -j ACCEPT
|
|
#iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
|
|
#iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
|
|
#iptables -P INPUT DROP
|
|
#iptables -P OUTPUT DROP
|
|
|
|
#Setup Nginx
|
|
sudo apt install -y lua5.1 libnginx-mod-http-lua luarocks gettext-base lua-cjson
|
|
sudo apt install -y crowdsec-nginx-bouncer |