e6dd8acffb
- Nový jednoduchý wizard: hostname, IP, resources, výber užívateľov - config/users.json: databáza užívateľov s SSH kľúčmi - Whiptail checkbox pre výber užívateľov pri inštalácii - Užívatelia sa vytvárajú s náhodným heslom a sudo NOPASSWD - SSH hardening: PermitRootLogin no, PasswordAuthentication no - Balíčky: mc, wget, git, curl, openssh-server - Defaults: 4 CPU, 4 GB RAM, 32 GB disk Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
94 lines
3.2 KiB
Bash
94 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Inštalačný skript pre Ubuntu 24.04 LXC kontajner
|
|
# Beží VNÚTRI kontajnera po jeho vytvorení
|
|
|
|
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
|
color
|
|
verb_ip6
|
|
catch_errors
|
|
setting_up_container
|
|
network_check
|
|
update_os
|
|
|
|
# =============================================================================
|
|
# Inštalácia balíčkov
|
|
# =============================================================================
|
|
msg_info "Inštalujem dodatočné balíčky"
|
|
$STD apt-get install -y mc wget git curl openssh-server
|
|
msg_ok "Balíčky nainštalované"
|
|
|
|
# =============================================================================
|
|
# Vytvorenie užívateľov z USERS_JSON + SELECTED_USERS
|
|
# =============================================================================
|
|
if [[ -n "${USERS_JSON:-}" && -n "${SELECTED_USERS:-}" ]]; then
|
|
msg_info "Vytváram užívateľov"
|
|
|
|
# Parsovanie SELECTED_USERS (whiptail vracia "user1" "user2" formát)
|
|
selected_list=$(echo "$SELECTED_USERS" | tr -d '"')
|
|
|
|
user_count=$(echo "$USERS_JSON" | jq length)
|
|
for i in $(seq 0 $((user_count - 1))); do
|
|
username=$(echo "$USERS_JSON" | jq -r ".[$i].username")
|
|
has_sudo=$(echo "$USERS_JSON" | jq -r ".[$i].sudo")
|
|
|
|
# Kontrola, či bol užívateľ vybraný
|
|
if ! echo "$selected_list" | grep -qw "$username"; then
|
|
continue
|
|
fi
|
|
|
|
# Vytvorenie užívateľa s náhodným heslom
|
|
random_pw=$(openssl rand -base64 16)
|
|
useradd -m -s /bin/bash "$username"
|
|
echo "${username}:${random_pw}" | chpasswd
|
|
|
|
# SSH kľúče
|
|
user_home="/home/${username}"
|
|
mkdir -p "${user_home}/.ssh"
|
|
chmod 700 "${user_home}/.ssh"
|
|
|
|
key_count=$(echo "$USERS_JSON" | jq ".[$i].ssh_keys | length")
|
|
for k in $(seq 0 $((key_count - 1))); do
|
|
key=$(echo "$USERS_JSON" | jq -r ".[$i].ssh_keys[$k]")
|
|
echo "$key" >> "${user_home}/.ssh/authorized_keys"
|
|
done
|
|
|
|
chmod 600 "${user_home}/.ssh/authorized_keys"
|
|
chown -R "${username}:${username}" "${user_home}/.ssh"
|
|
|
|
# Sudo bez hesla
|
|
if [[ "$has_sudo" == "true" ]]; then
|
|
echo "${username} ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${username}"
|
|
chmod 440 "/etc/sudoers.d/${username}"
|
|
fi
|
|
|
|
msg_ok "Užívateľ vytvorený: ${username}"
|
|
done
|
|
fi
|
|
|
|
# =============================================================================
|
|
# SSH Hardening
|
|
# =============================================================================
|
|
msg_info "Konfigurujem SSH"
|
|
|
|
# Záloha pôvodnej konfigurácie
|
|
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
|
|
|
# Zakázať root login a prihlásenie heslom
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
|
sed -i 's/^#\?ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
|
|
|
|
# Reštart SSH
|
|
systemctl enable ssh
|
|
systemctl restart ssh
|
|
|
|
msg_ok "SSH nakonfigurované (len kľúče, root zakázaný)"
|
|
|
|
# =============================================================================
|
|
# Štandardné dokončenie
|
|
# =============================================================================
|
|
motd_ssh
|
|
customize
|
|
cleanup_lxc
|