Hardening SSH, appending iptables rules, adding iptables persistence

install.sh

@@ -5,8 +5,12 @@
 # ln -sv “~/.dotfiles/runcom/.inputrc” ~
 # ln -sv “~/.dotfiles/git/.gitconfig” ~
 
-# Setup our apt repos
+# Safety first
-./apt-repos.sh
+./sshd-config.sh
+./iptables/iptables-config.sh
+
+# Setup apt repos and install some of our favorites
+./apt-install.sh
 
 # Install a retro looking font that I like to use in my terminal
 ./install-fonts.sh
@@ -16,4 +20,4 @@
 paste ~/.vimrc ./vimrc > ~/vimrc.new
 mv ~/.vimrc ~/.vimrc.bak
 mv ~/vimrc.new ~/.vimrc
-./vim-setup.sh
+./vim-setup.sh

iptables/iptables-config.sh

@@ -0,0 +1,2 @@
+apt install -q -y iptables-persistent
+yes | cp -rf ./rules.v4 /etc/iptables/rules.v4

iptables/rules.v4

@@ -0,0 +1,17 @@
+# Generated by iptables-save v1.8.9 (nf_tables) on Thu Sep  5 12:02:50 2024
+*filter
+:INPUT DROP [78122:5351686]
+:FORWARD DROP [0:0]
+-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 10 --hitcount 10 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
+-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
+-A INPUT -i eth0 -m set --match-set hostile-countries src -j DROP
+-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
+-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 10 --hitcount 10 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
+-A INPUT -i wg2 -j ACCEPT
+-A INPUT -p udp -m udp --dport 51823 -j ACCEPT
+-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
+-A INPUT -i wg0 -j ACCEPT
+-A INPUT -p udp -m udp --dport 52821 -j ACCEPT
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

sshd-config.sh

@@ -0,0 +1,9 @@
+sudo -i
+rm /etc/ssh/ssh_host_*
+ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
+ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
+awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
+mv /etc/ssh/moduli.safe /etc/ssh/moduli
+echo -e "# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\n
+KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\n\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\n\nHostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256\n\nRequiredRSASize 3072\n\nCASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256\n\nGSSAPIKexAlgorithms gss-curve25519-sha256-,gss-group16-sha512-\n\nHostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256\n\nPubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256\n\n" > /etc/ssh/sshd_config.d/ssh-audit_hardening.conf
+service ssh restart