Ubuntu.sh

#!/bin/bash
if [ -r Ubuntu.conf ]; then
  
  #Load Config Values
  source Ubuntu.conf

  #Get updates
  if [ "$UPDATES" = true ]; then
    echo "getting updates"
    apt-get update -y
  fi #UPDATES

  #Install and enable auditing
  if [ "$AUDITING" = true ]; then
    echo "Installing auditing daemon"
    apt-get install auditd -y
    echo "enabling auditing"
    auditctl -e 1 > /var/local/audit.log
  fi #AUDITING

  #Install Uncomplicated Firewall (UFW)
  if [ "$FIREWALL" = true ]; then
    echo "installing Uncomplicated firewall"
    apt-get install ufw -y
  fi #FIREWALL

  #Install openssh-server
  if [ "$INSTALL_SSH_SERVER" = true ]; then
    apt-get install openssh-server -y
  fi #INSTALL_SSH_SERVER

  #Upgrade all installed packages
  if [ "$UPGRADES" = true ]; then
  echo "installing updates"
  apt-get dist-upgrade -y
  fi #UPGRADES

  #Clean up unnecessary junk
  if [ "$CLEAN" = true ]; then
    echo "running autoclean and autoremove"
    apt-get autoclean -y
    apt-get autoremove -y
  fi #CLEAN

  #enable UFW
  if [ "$FIREWALL" = true ]; then
    echo "enabling UFW"
    ufw enable
  fi #FIREWALL

  #make log dir
  echo "creating /var/local"
  mkdir /var/local/

  #Create/clear log files
  echo "creating log files in /var/local"
  echo -n "" > /var/local/netstat.log
  echo -n "" > /var/local/ASAO.log
  echo -n "" > /var/local/mediafiles.log
  echo -n "" > /var/local/cronjoblist.log
  echo -n "" > /var/local/pslist.log

  #Add additional instructions to log file
  echo "adding instructions to log file"
  echo "getent group <groupname> |||| Users in group" >> /var/local/ASAO.log
  echo "edit /etc/audit/auditd.conf" >> /var/local/ASAO.log
  echo "Don't Forget to Restart" >> /var/local/ASAO.log
  echo "more password stuff @ https://www.cyberciti.biz/tips/linux-check-passwords-against-a-dictionary-attack.html" >> /var/local/ASAO.log

  #Install libpam-cracklib which is used to check passwords
  if [ "$LPAMCLIB" = true ]; then
    echo "installing libpam-cracklib for passwords"
    apt-get install libpam-cracklib -y
  fi #LPAMCLIB

  #Pam config
  if [ "$PAMCONF" = true ]; then
    echo "changing PAM config"

    #grep for 'pam_unix.so' and get line number
    PAMUNIX="$(grep -n 'pam_unix.so' /etc/pam.d/common-password | grep -v '#' | cut -f1 -d:)"
    sed -e "${PAMUNIX}s/.*/password	[success=1 default=ignore]	pam_unix.so obscure use_authtok try_first_pass sha512 remember=5/" /etc/pam.d/common-password > /var/local/temp.txt

    #grep for 'pam_cracklib.so' and get line number
    PAMCRACKLIB="$(grep -n 'pam_cracklib.so' /etc/pam.d/common-password | grep -v '#' | cut -f1 -d:)"
    sed -e "${PAMCRACKLIB}s/.*/password	requisite	pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 1credit=-2 ocredit=-1/" /var/local/temp.txt > /var/local/temp2.txt
    rm /var/local/temp.txt
    mv /etc/pam.d/common-password /etc/pam.d/common-password.old
    mv /var/local/temp2.txt /etc/pam.d/common-password
  fi #PAMCONF

  #Password aging policy
  if [ "$PSAGE" = true ]; then
    echo "setting passwords to reset after 30 days"
    PASSMAX="$(grep -n 'PASS_MAX_DAYS' /etc/login.defs | grep -v '#' | cut -f1 -d:)"
    sed -e "${PASSMAX}s/.*/PASS_MAX_DAYS	90/" /etc/login.defs > /var/local/temp1.txt
    PASSMIN="$(grep -n 'PASS_MIN_DAYS' /etc/login.defs | grep -v '#' | cut -f1 -d:)"
    sed -e "${PASSMIN}s/.*/PASS_MIN_DAYS	10/" /var/local/temp1.txt > /var/local/temp2.txt
    PASSWARN="$(grep -n 'PASS_WARN_AGE' /etc/login.defs | grep -v '#' | cut -f1 -d:)"
    sed -e "${PASSWARN}s/.*/PASS_WARN_AGE	7/" /var/local/temp2.txt > /var/local/temp3.txt
    mv /etc/login.defs /etc/login.defs.old
    mv /var/local/temp3.txt /etc/login.defs
    rm /var/local/temp1.txt /var/local/temp2.txt
  fi #PSAGE

  #Password Lockout
  if [ "$PSLOCKOUT" = true ]; then
    echo "Enabling account lockout"
    cp /etc/pam.d/common-auth /etc/pam.d/common-auth.old
    echo "auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800" >> /etc/pam.d/common-auth
  fi #PSLOCKOUT

  #SSH daemon config
  if [ "$DISABLE_ROOT_SSH" = true ]; then
    echo "disabling root login"

    #get the line number of the PermitRootLogin line
    PRL="$(grep -n 'PermitRootLogin' /etc/ssh/sshd_config | grep -v '#' | cut -f1 -d:)"
    sed -e "${PRL}s/.*/PermitRootLogin no/" /etc/ssh/sshd_config > /var/local/temp1.txt
    mv /etc/ssh/sshd_config /etc/ssh/sshd_config.old
    mv /var/local/temp1.txt /etc/ssh/sshd_config
  fi #DISABLE_ROOT_SSH

  #Disable the guest account
  if [ "$DISABLE_GUEST" = true ]; then
    echo "disabling guest account"
    cp /etc/lightdm/lightdm.conf /etc/lightdm/lightdm.conf.old
    echo "allow-guest=false" >> /etc/lightdm/lightdm.conf
  fi #DISABLE_GUEST

  #Find all video files
  if [ "$MEDIA_LOCATIONS" = true ]; then
    echo "Finding Media Files"
    echo "||||Video Files||||" >> /var/local/mediafiles.log
    locate *.mkv *.webm *.flv *.vob *.ogv *.drc *.gifv *.mng *.avi$ *.mov *.qt *.wmv *.yuv *.rm *.rmvb *.asf *.amv *.mp4$ *.m4v *.mp *.m?v *.svi *.3gp *.flv *.f4v >> /var/local/mediafiles.log
    echo "||||Audo Files||||" >> /var/local/mediafiles.log
    locate *.3ga *.aac *.aiff *.amr *.ape *.arf *.asf *.asx *.cda *.dvf *.flac *.gp4 *.gp5 *.gpx *.logic *.m4a *.m4b *.m4p *.midi *.mp3 *.pcm *.rec *.snd *.sng *.uax *.wav *.wma *.wpl *.zab >> /var/local/mediafiles.log
  fi #MEDIA_LOCATIONS

  #Lists all cronjobs & output to /var/local/cronjoblist.log
  if [ "$LOG_CRON" = true ]; then
    echo "Outputting cronjobs to /var/local/cronjoblist.log"
    crontab -l >> /var/local/cronjoblist.log
  fi #LOG_CRON

  #List all processes & output to /var/local/pslist.log
  if [ "$PS_LOG" = true ]; then
    echo "Outputting processes to /var/local/pslist.log"
    ps axk start_time -o start_time,pid,user,cmd >> /var/local/pslist.log
  fi #PS_LOG

  #List all connections, open or listening
  if [ "$LOG_NETSTAT" = true ]; then
    echo "finding open connections and outputting to /var/local/netstat.log"
    ss -an4 > /var/local/netstat.log
  fi #LOG_NETSTAT

  #Install clam antivirus
  if [ "$INSTALL_CLAM" = true ]; then
    echo "installing clam antivirus"
    apt-get install clamav -y
  fi #INSTALL_CLAM

  #Run clamav
  if [ "$CLAM_HOME" = true ]; then
    
   #Update clam signatures
    echo "updating clam signatures"
    freshclam

   #Run a full scan of the "/home" directory
    echo "running full scan of /home directory"
    clamscan -r /home
  fi #CLAM_HOME

elif [ -f Ubuntu.conf ]; then
  echo "The file 'Ubuntu.conf' exists but is not readable to the script"
else
  echo "The file 'Ubuntu.conf' is missing. Please download it before running the script"
fi #Ubuntu.conf