Skip to content

Instantly share code, notes, and snippets.

@AnnoyingTechnology

AnnoyingTechnology/debian-security-tools.sh

Last active July 6, 2024 12:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save AnnoyingTechnology/34a415f6931aca97cc2c38dd144c6f66 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save AnnoyingTechnology/34a415f6931aca97cc2c38dd144c6f66 to your computer and use it in GitHub Desktop.
Download ZIP
Install debian basic security utilities. You still need to configure some of those, and a lot of other things have to be manually tweaked across a system to keep it secure.
Raw
debian-security-tools.sh
#!/bin/bash
# update apt
apt update
# rkhunter : rootkit scanner
apt install rkhunter
# chkrootkit : another rootkit scanner
apt install chkrootkit
# debsums : checksums of system files for sanity checks
apt install debsums
# apt-listbugs : check for bugs before updates
apt install apt-listbugs
# knockd : open ports on demand
apt install knockd
# fail2ban : ban bruforce attacks
apt install fail2ban
# detect and block portscans (this one is commented out by default, because your server should either
# be placed behing a NAT router that only forwards required ports
# be running a set of IPTABLES rules that already block all but the required ports
# apt install portsentry
# needrestart : checks if system needs a restart after updates
apt install needrestart
# unattended-upgrades : applies reliable security upgrades on its own
apt install unattended-upgrades
# lynis : audits a system for best security practices
apt install lynis
# debsecan : list known vulnerabilities for current system
apt install debsecan
# auditd : keeps track of users actions/sessions
apt install auditd
# iptables-persistent : brings back your iptables rules after a reboot
apt install iptables-persistent
# some of these tools should be set up to be ran by a cron, and to repport via email
@AnnoyingTechnology
Copy link
Copy Markdown
Author

AnnoyingTechnology commented May 30, 2018 •
edited
Loading

Ideas :

  • add questions to define iptables "firewall" rules.
  • add a question to define sysadmin email
  • create proper crontasks that report to said email
  • update unattended-upgrades config file with said email
  • add a question to choose a port sequence to unhide ssh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment