Skip to content

Instantly share code, notes, and snippets.

@AnnoyingTechnology

AnnoyingTechnology/debian-security-tools.sh

Last active July 6, 2024 12:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save AnnoyingTechnology/34a415f6931aca97cc2c38dd144c6f66 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save AnnoyingTechnology/34a415f6931aca97cc2c38dd144c6f66 to your computer and use it in GitHub Desktop.
Download ZIP
Install debian basic security utilities. You still need to configure some of those, and a lot of other things have to be manually tweaked across a system to keep it secure.
Raw
debian-security-tools.sh
#!/bin/bash
# update apt
apt update
# install proper tools
apt install \
# rkhunter : rootkit scanner
rkhunter \
# chkrootkit : another rootkit scanner
chkrootkit \
# debsums : checksums of system files for sanity checks
debsums \
# apt-listbugs : check for bugs before updates
apt-listbugs \
# knockd : open ports on demand
knockd \
# fail2ban : ban bruforce attacks
fail2ban \
# detect and block portscans (this one is commented out by default, because your server should either
# be placed behing a NAT router that only forwards required ports
# be running a set of IPTABLES rules that already block all but the required ports
# portsentry \
# needrestart : checks if system needs a restart after updates
needrestart \
# unattended-upgrades : applies reliable security upgrades on its own
unattended-upgrades \
# lynis : audits a system for best security practices
lynis \
# debsecan : list known vulnerabilities for current system
debsecan \
# auditd : keeps track of users actions/sessions
auditd \
# iptables-persistent : brings back your iptables rules after a reboot
iptables-persistent
# some of these tools should be set up to be ran by a cron, and to repport via email
@AnnoyingTechnology
Copy link
Copy Markdown
Author

AnnoyingTechnology commented May 30, 2018 •
edited
Loading

Ideas :

  • add questions to define iptables "firewall" rules.
  • add a question to define sysadmin email
  • create proper crontasks that report to said email
  • update unattended-upgrades config file with said email
  • add a question to choose a port sequence to unhide ssh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment