|
|
|
|
41
|
return
|
41
|
return
|
42
|
fi
|
42
|
fi
|
43
|
sed -i "s/Port .*/Port $SSH_PORT/g" /etc/ssh/sshd_config
|
43
|
sed -i "s/Port .*/Port $SSH_PORT/g" /etc/ssh/sshd_config
|
|
|
44
|
+ sed -i "s/#Port ${SSH_PORT}/Port ${SSH_PORT}/g" /etc/ssh/sshd_config
|
44
|
sed -i 's/PermitRootLogin.*/PermitRootLogin no/g' /etc/ssh/sshd_config
|
45
|
sed -i 's/PermitRootLogin.*/PermitRootLogin no/g' /etc/ssh/sshd_config
|
|
|
46
|
+ sed -i 's/#PermitRootLogin no/PermitRootLogin no/g' /etc/ssh/sshd_config
|
45
|
sed -i 's/X11Forwarding.*/X11Forwarding no/g' /etc/ssh/sshd_config
|
47
|
sed -i 's/X11Forwarding.*/X11Forwarding no/g' /etc/ssh/sshd_config
|
|
|
48
|
+ sed -i 's/#X11Forwarding no/X11Forwarding no/g' /etc/ssh/sshd_config
|
46
|
sed -i 's/ServerKeyBits.*/ServerKeyBits 4096/g' /etc/ssh/sshd_config
|
49
|
sed -i 's/ServerKeyBits.*/ServerKeyBits 4096/g' /etc/ssh/sshd_config
|
|
|
50
|
+ sed -i 's/#ServerKeyBits 4096/ServerKeyBits 4096/g' /etc/ssh/sshd_config
|
47
|
sed -i 's/TCPKeepAlive.*/TCPKeepAlive no/g' /etc/ssh/sshd_config
|
51
|
sed -i 's/TCPKeepAlive.*/TCPKeepAlive no/g' /etc/ssh/sshd_config
|
|
|
52
|
+ sed -i 's/#TCPKeepAlive no/TCPKeepAlive no/g' /etc/ssh/sshd_config
|
48
|
sed -i 's|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g' /etc/ssh/sshd_config
|
53
|
sed -i 's|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g' /etc/ssh/sshd_config
|
49
|
sed -i 's|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g' /etc/ssh/sshd_config
|
54
|
sed -i 's|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g' /etc/ssh/sshd_config
|
50
|
if ! grep -q 'DebianBanner' /etc/ssh/sshd_config; then
|
55
|
if ! grep -q 'DebianBanner' /etc/ssh/sshd_config; then
|
|
|
|
|
57
|
else
|
62
|
else
|
58
|
echo 'ClientAliveInterval 60' >> /etc/ssh/sshd_config
|
63
|
echo 'ClientAliveInterval 60' >> /etc/ssh/sshd_config
|
59
|
fi
|
64
|
fi
|
|
|
65
|
+ sed -i 's/#ClientAliveInterval 60/ClientAliveInterval 60/g' /etc/ssh/sshd_config
|
60
|
if grep -q 'ClientAliveCountMax' /etc/ssh/sshd_config; then
|
66
|
if grep -q 'ClientAliveCountMax' /etc/ssh/sshd_config; then
|
61
|
sed -i 's/ClientAliveCountMax.*/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
|
67
|
sed -i 's/ClientAliveCountMax.*/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
|
62
|
else
|
68
|
else
|
63
|
echo 'ClientAliveCountMax 3' >> /etc/ssh/sshd_config
|
69
|
echo 'ClientAliveCountMax 3' >> /etc/ssh/sshd_config
|
64
|
fi
|
70
|
fi
|
|
|
71
|
+ sed -i 's/#ClientAliveCountMax 3/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
|
65
|
if grep -q 'Ciphers' /etc/ssh/sshd_config; then
|
72
|
if grep -q 'Ciphers' /etc/ssh/sshd_config; then
|
66
|
sed -i "s|Ciphers.*|Ciphers $SSH_CIPHERS|g" /etc/ssh/sshd_config
|
73
|
sed -i "s|Ciphers.*|Ciphers $SSH_CIPHERS|g" /etc/ssh/sshd_config
|
67
|
else
|
74
|
else
|
68
|
echo "Ciphers $SSH_CIPHERS" >> /etc/ssh/sshd_config
|
75
|
echo "Ciphers $SSH_CIPHERS" >> /etc/ssh/sshd_config
|
69
|
fi
|
76
|
fi
|
|
|
77
|
+ sed -i "s|#Ciphers $SSH_CIPHERS|Ciphers $SSH_CIPHERS|g" /etc/ssh/sshd_config
|
70
|
if grep -q 'MACs' /etc/ssh/sshd_config; then
|
78
|
if grep -q 'MACs' /etc/ssh/sshd_config; then
|
71
|
sed -i "s|MACs.*|MACs $SSH_MACS|g" /etc/ssh/sshd_config
|
79
|
sed -i "s|MACs.*|MACs $SSH_MACS|g" /etc/ssh/sshd_config
|
72
|
else
|
80
|
else
|
73
|
echo "MACs $SSH_MACS" >> /etc/ssh/sshd_config
|
81
|
echo "MACs $SSH_MACS" >> /etc/ssh/sshd_config
|
74
|
fi
|
82
|
fi
|
|
|
83
|
+ sed -i "s|#MACs $SSH_MACS|MACs $SSH_MACS|g" /etc/ssh/sshd_config
|
75
|
if grep -q 'KexAlgorithms' /etc/ssh/sshd_config; then
|
84
|
if grep -q 'KexAlgorithms' /etc/ssh/sshd_config; then
|
76
|
sed -i "s|KexAlgorithms.*|KexAlgorithms $SSH_KEX|g" /etc/ssh/sshd_config
|
85
|
sed -i "s|KexAlgorithms.*|KexAlgorithms $SSH_KEX|g" /etc/ssh/sshd_config
|
77
|
else
|
86
|
else
|
78
|
echo "KexAlgorithms $SSH_KEX" >> /etc/ssh/sshd_config
|
87
|
echo "KexAlgorithms $SSH_KEX" >> /etc/ssh/sshd_config
|
79
|
fi
|
88
|
fi
|
|
|
89
|
+ sed -i "s|#KexAlgorithms $SSH_KEX|KexAlgorithms $SSH_KEX|g" /etc/ssh/sshd_config
|
80
|
|
90
|
|
81
|
apt-get -yq install fail2ban vim-common
|
91
|
apt-get -yq install fail2ban vim-common
|
82
|
|
92
|
|