feat: add core script

narsil.sh

@@ -0,0 +1,261 @@
+#!/usr/bin/env bash
+#
+# Narsil (Ubuntu) - Security hardening tool
+# Seaton Jiang <[email protected]>
+#
+# The latest version of Narsil can be found at:
+# https://github.com/seatonjiang/narsil-ubuntu
+#
+# Licensed under the MIT license:
+# https://github.com/seatonjiang/narsil-ubuntu/blob/main/LICENSE
+#
+
+export LC_ALL=C.UTF-8
+
+set -u -o pipefail
+
+# Check Permission
+if (( EUID != 0 )); then
+    printf '%s\n\n' "$(tput setaf 1)$(tput bold)Error: Narsil must run as root. Either use sudo or 'sudo bash ${0}'!$(tput sgr0)" >&2
+    exit 1
+fi
+
+# Check Ubuntu
+if ! grep -Eqi "Ubuntu" /etc/os-release; then
+    printf '%s\n\n' "$(tput setaf 1)$(tput bold)Error: Narsil is only available for Ubuntu!$(tput sgr0)" >&2
+    exit 1
+fi
+
+# Path to the log file
+LOGFILE=/var/log/narsil-$(date +%Y%m%d-%s).log
+
+# Create log file
+truncate -s0 "${LOGFILE}"
+
+# Send all output to the logfile as well as stdout.
+# Output to 1 goes to stdout and the logfile.
+# Output to 2 goes to stderr and the logfile.
+# Output to 3 just goes to stdout.
+# Output to 4 just goes to stderr.
+# Output to 5 just goes to the logfile.
+# shellcheck disable=SC2094
+exec \
+    3>&1 \
+    4>&2 \
+    5>> "${LOGFILE}" \
+    > >(tee -a "${LOGFILE}") \
+    2> >(tee -a "${LOGFILE}" >&2)
+
+# Single arg just gets returned verbatim, multi arg gets formatted via printf.
+# First arg is the name of a variable to store the results.
+function msg_format()
+{
+    local _VAR
+    _VAR="$1"
+    shift
+    if (( $# > 1 )); then
+        # shellcheck disable=SC2059
+        printf -v "${_VAR}" "$@"
+    else
+        printf -v "${_VAR}" "%s" "$1"
+    fi
+}
+
+# Send an info message to the log file and stdout.
+function msg_info()
+{
+    local MSG
+    msg_format MSG "$@"
+    printf '%s' "${MSG}" >&5
+    printf '%s%s%s' "$(tput setaf 4)$(tput bold)" "${MSG}" "$(tput sgr0)" >&3
+}
+
+# Send an notic message to the log file and stdout.
+function msg_notic()
+{
+    local MSG
+    msg_format MSG "$@"
+    printf '%s' "${MSG}" >&5
+    printf '%s%s%s' "$(tput setaf 3)$(tput bold)" "${MSG}" "$(tput sgr0)" >&3
+}
+
+# Send an success message to the log file and stdout.
+function msg_succ()
+{
+    local MSG
+    msg_format MSG "$@"
+    printf '%s' "${MSG}" >&5
+    printf '%s%s%s' "$(tput setaf 2)$(tput bold)" "${MSG}" "$(tput sgr0)" >&3
+}
+
+# Send an error message to the log file and stderr.
+function msg_error()
+{
+    local MSG
+    msg_format MSG "$@"
+    printf '%s' "${MSG}" >&5
+    printf '%s%s%s' "$(tput setaf 1)$(tput bold)" "${MSG}" "$(tput sgr0)" >&4
+}
+
+# shellcheck disable=SC1091
+source narsil.conf
+
+# shellcheck disable=SC1090
+for SCRIPTS in scripts/narsil-*.sh; do
+    [[ -f ${SCRIPTS} ]] || break
+    source "${SCRIPTS}"
+done
+
+# shellcheck disable=SC2034
+function narsil_logo()
+{
+    msg_info '%s\n'   '    _   __                    _  __    ______            __           '
+    msg_info '%s\n'   '   / | / /____ _ _____ _____ (_)/ /   /_  __/___  ____  / /           '
+    msg_info '%s\n'   '  /  |/ // __ `// ___// ___// // /     / / / __ \/ __ \/ /            '
+    msg_info '%s\n'   ' / /|  // /_/ // /   (__  )/ // /     / / / /_/ / /_/ / /             '
+    msg_info '%s\n\n' '/_/ |_/ \__,_//_/   /____//_//_/     /_/  \____/\____/_/              '
+    msg_info '%s\n'   'This is the version for Ubuntu!                                       '
+    msg_info '%s\n\n' 'For more information: https://github.com/seatonjiang/narsil-ubuntu    '
+    msg_info '%s\n'   'Please read the manual and check the config before using the script.  '
+    msg_info '%s\n'   'If there is a problem with the execution, please provide the log file.'
+
+    STATS=1
+}
+
+function narsil_help()
+{
+    printf '%s\n' "$(tput setaf 3)$(tput bold)Usage:$(tput sgr0)"
+    printf '%s\n\n' "   bash $0 [options]"
+    printf '%s\n' "$(tput setaf 3)$(tput bold)Options:$(tput sgr0)"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -c, --clear$(tput sgr0)         Clear all syslog files, cache and backup folders"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -d, --docker$(tput sgr0)        Install docker service and set registry mirrors"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -f, --fdisk$(tput sgr0)         Interactive mount data disk"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -n, --hostname$(tput sgr0)      Change system hostname"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -p, --port$(tput sgr0)          Modify the SSH port"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -r, --removeagent$(tput sgr0)   Remove monitor from cloud servers"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -s, --swap$(tput sgr0)          Add swap space"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -v, --version$(tput sgr0)       Print version and quit"
+    printf '%s\n' "$(tput setaf 2)$(tput bold)   -h, --help$(tput sgr0)          Get help for commands and quit"
+    printf '\n%s\n' "$(tput setaf 3)$(tput bold)Help:$(tput sgr0)"
+    printf '%s\n' "   If a problem is encountered, please provide the log file(/var/log/narsil-*.log)."
+    printf '%s\n\n' "   Submit bug reports or suggestions to $(tput setaf 2)$(tput bold)https://github.com/seatonjiang/narsil-ubuntu/issues$(tput sgr0)"
+}
+
+function narsil_version()
+{
+    printf '%s\n\n' "Narsil version $(tput setaf 2)v1.0$(tput sgr0)"
+}
+
+function narsil_auto_check()
+{
+    if [ -e ~/.narsil ]; then
+        msg_error '\n%s\n\n' "Error: Narsil initialization is complete, do not run it again!"
+        exit 1
+    fi
+}
+
+function narsil_reboot()
+{
+    echo 'Narsil initialization completed!' > ~/.narsil
+    printf '\n%s%s\n%s%s\n\n' "$(tput setaf 4)$(tput bold)" \
+    "Narsil is complete and the system is about to reboot." \
+    "The log of this execution can be found at ${LOGFILE}" \
+    "$(tput sgr0)" >&3
+    reboot
+}
+
+# Reconfirm
+function narsil_reconfirm()
+{
+    msg_info '\n%s' 'Press any key to start or Press Ctrl+C to cancel...'
+    read -rsn1
+    echo
+}
+
+function narsil_auto()
+{
+    clear
+    narsil_logo
+    narsil_auto_check
+    narsil_reconfirm
+    narsil_dnsserver
+    narsil_timezone
+    narsil_ntpserver
+    narsil_sshdconfig
+    narsil_useradd
+    narsil_logindefs
+    narsil_limits
+    narsil_timeout
+    narsil_tcpbbr
+    narsil_apport
+    narsil_debugshell
+    narsil_ctrlaltdel
+    narsil_removepackages
+    narsil_banner
+    narsil_reboot
+}
+
+if [ $# -eq 0 ];then
+    narsil_auto
+    exit 0
+fi
+
+while :; do
+    [ -z "$1" ] && exit 0;
+    case $1 in
+        -c|--clear)
+            clear
+            narsil_logo
+            narsil_clearlogs
+            exit 0
+        ;;
+        -d|--docker)
+            clear
+            narsil_logo
+            narsil_docker
+            exit 0
+        ;;
+        -f|--fdisk)
+            clear
+            narsil_logo
+            narsil_fdisk
+            exit 0
+        ;;
+        -n|--hostname)
+            clear
+            narsil_logo
+            narsil_hostname
+            exit 0
+        ;;
+        -p|--port)
+            clear
+            narsil_logo
+            narsil_sshport
+            exit 0
+        ;;
+        -r|--removeagent)
+            clear
+            narsil_logo
+            narsil_removeagent
+            exit 0
+        ;;
+        -s|--swap)
+            clear
+            narsil_logo
+            narsil_swap
+            exit 0
+        ;;
+        -v|--version)
+            narsil_version
+            exit 0
+        ;;
+        -h|--help)
+            narsil_help
+            exit 0
+        ;;
+        *)
+            printf '%s\n\n' "The \"$(tput setaf 1)$(tput bold)$1$(tput sgr0)\" option does not exist."
+            exit 1
+        ;;
+    esac
+done