Skip to content

Instantly share code, notes, and snippets.

@AnnoyingTechnology

AnnoyingTechnology/debian-security-tools.sh

Last active July 6, 2024 12:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save AnnoyingTechnology/34a415f6931aca97cc2c38dd144c6f66 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save AnnoyingTechnology/34a415f6931aca97cc2c38dd144c6f66 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 5 additions and 4 deletions.
    9 changes: 5 additions & 4 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -17,10 +17,6 @@ apt install apt-listbugs
    apt install knockd
    # fail2ban : ban bruforce attacks
    apt install fail2ban
    # detect and block portscans (this one is commented out by default, because your server should either
    # be placed behing a NAT router that only forwards required ports
    # be running a set of IPTABLES rules that already block all but the required ports
    # apt install portsentry
    # needrestart : checks if system needs a restart after updates
    apt install needrestart
    # unattended-upgrades : applies reliable security upgrades on its own
    @@ -37,5 +33,10 @@ apt install iptables-persistent
    apt install logwatch
    # logcheck : report suspicious/unusual log messages by email
    apt install logcheck
    # detect and block portscans (this one is commented out by default, because your server should either
    # be placed behing a NAT router that only forwards required ports
    # be running a set of IPTABLES rules that already block all but the required ports
    # apt install portsentry
    # *************************************************
    # this script is only an helper to install the most
    # common/userful security tools for most servers
  2. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 2 additions and 4 deletions.
    6 changes: 2 additions & 4 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -37,7 +37,5 @@ apt install iptables-persistent
    apt install logwatch
    # logcheck : report suspicious/unusual log messages by email
    apt install logcheck
    # !!!!!!!!!!!!!!!! DISCLAIMER !!!!!!!!!!!!!!!!!!!!!
    # !! THIS WILL NOT SECURE YOUR SYSTEM ON ITS OWN !!
    # !! Most of these tools should be set up and/or !!
    # !!!!!! ran by a cron with proper repporting !!!!!
    # this script is only an helper to install the most
    # common/userful security tools for most servers
  3. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 12 additions and 1 deletion.
    13 changes: 12 additions & 1 deletion debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,8 @@
    #!/bin/bash
    # !!!!!!!!!!!!!!!! DISCLAIMER !!!!!!!!!!!!!!!!!!!!!
    # !! THIS WILL NOT SECURE YOUR SYSTEM ON ITS OWN !!
    # !! Most of these tools should be set up and/or !!
    # !!!!!! ran by a cron with proper repporting !!!!!
    # update apt
    apt update
    # rkhunter : rootkit scanner
    @@ -29,4 +33,11 @@ apt install debsecan
    apt install auditd
    # iptables-persistent : brings back your iptables rules after a reboot
    apt install iptables-persistent
    # some of these tools should be set up to be ran by a cron, and to repport via email
    # logwatch : generates synthetic log repport, to be sent periodically by email
    apt install logwatch
    # logcheck : report suspicious/unusual log messages by email
    apt install logcheck
    # !!!!!!!!!!!!!!!! DISCLAIMER !!!!!!!!!!!!!!!!!!!!!
    # !! THIS WILL NOT SECURE YOUR SYSTEM ON ITS OWN !!
    # !! Most of these tools should be set up and/or !!
    # !!!!!! ran by a cron with proper repporting !!!!!
  4. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -6,7 +6,7 @@ apt install rkhunter
    # chkrootkit : another rootkit scanner
    apt install chkrootkit
    # debsums : checksums of system files for sanity checks
    apt install debsums
    apt install debsums
    # apt-listbugs : check for bugs before updates
    apt install apt-listbugs
    # knockd : open ports on demand
  5. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 13 additions and 15 deletions.
    28 changes: 13 additions & 15 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,34 +1,32 @@
    #!/bin/bash
    # update apt
    apt update
    # install proper tools
    apt install \
    # rkhunter : rootkit scanner
    rkhunter \
    apt install rkhunter
    # chkrootkit : another rootkit scanner
    chkrootkit \
    apt install chkrootkit
    # debsums : checksums of system files for sanity checks
    debsums \
    apt install debsums
    # apt-listbugs : check for bugs before updates
    apt-listbugs \
    apt install apt-listbugs
    # knockd : open ports on demand
    knockd \
    apt install knockd
    # fail2ban : ban bruforce attacks
    fail2ban \
    apt install fail2ban
    # detect and block portscans (this one is commented out by default, because your server should either
    # be placed behing a NAT router that only forwards required ports
    # be running a set of IPTABLES rules that already block all but the required ports
    # portsentry \
    # apt install portsentry
    # needrestart : checks if system needs a restart after updates
    needrestart \
    apt install needrestart
    # unattended-upgrades : applies reliable security upgrades on its own
    unattended-upgrades \
    apt install unattended-upgrades
    # lynis : audits a system for best security practices
    lynis \
    apt install lynis
    # debsecan : list known vulnerabilities for current system
    debsecan \
    apt install debsecan
    # auditd : keeps track of users actions/sessions
    auditd \
    apt install auditd
    # iptables-persistent : brings back your iptables rules after a reboot
    iptables-persistent
    apt install iptables-persistent
    # some of these tools should be set up to be ran by a cron, and to repport via email
  6. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 21 additions and 17 deletions.
    38 changes: 21 additions & 17 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,30 +1,34 @@
    #!/bin/bash
    # update apt
    apt update
    # install proper tools
    apt install \
    # rootkit scanner
    # rkhunter : rootkit scanner
    rkhunter \
    # another rootkit scanner
    # chkrootkit : another rootkit scanner
    chkrootkit \
    # checksums of system files for sanity checks
    # debsums : checksums of system files for sanity checks
    debsums \
    # check for bugs before updates
    # apt-listbugs : check for bugs before updates
    apt-listbugs \
    # open ports on demand
    # knockd : open ports on demand
    knockd \
    # ban bruforce attacks
    # fail2ban : ban bruforce attacks
    fail2ban \
    # detect and block portscans
    portsentry \
    # checks if system needs a restart after updates
    # detect and block portscans (this one is commented out by default, because your server should either
    # be placed behing a NAT router that only forwards required ports
    # be running a set of IPTABLES rules that already block all but the required ports
    # portsentry \
    # needrestart : checks if system needs a restart after updates
    needrestart \
    # applies reliable security upgrades on its own
    # unattended-upgrades : applies reliable security upgrades on its own
    unattended-upgrades \
    # audits a system for best security practices
    # lynis : audits a system for best security practices
    lynis \
    # list known vulnerabilities for current system
    # debsecan : list known vulnerabilities for current system
    debsecan \
    # keeps track of users actions/sessions
    audits \



    # auditd : keeps track of users actions/sessions
    auditd \
    # iptables-persistent : brings back your iptables rules after a reboot
    iptables-persistent
    # some of these tools should be set up to be ran by a cron, and to repport via email
  7. AnnoyingTechnology revised this gist May 29, 2018. No changes.
  8. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -21,5 +21,10 @@ needrestart \
    unattended-upgrades \
    # audits a system for best security practices
    lynis \
    # list known vulnerabilities for current system
    debsecan \
    # keeps track of users actions/sessions
    audits \



  9. AnnoyingTechnology revised this gist May 29, 2018. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,4 @@
    #!/bin/bash
    apt update
    apt install \
    # rootkit scanner
  10. AnnoyingTechnology created this gist May 29, 2018.
    24 changes: 24 additions & 0 deletions debian-security-tools.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,24 @@
    apt update
    apt install \
    # rootkit scanner
    rkhunter \
    # another rootkit scanner
    chkrootkit \
    # checksums of system files for sanity checks
    debsums \
    # check for bugs before updates
    apt-listbugs \
    # open ports on demand
    knockd \
    # ban bruforce attacks
    fail2ban \
    # detect and block portscans
    portsentry \
    # checks if system needs a restart after updates
    needrestart \
    # applies reliable security upgrades on its own
    unattended-upgrades \
    # audits a system for best security practices
    lynis \