forked from syntaxbullet/aurorabot
161 lines
5.9 KiB
Bash
161 lines
5.9 KiB
Bash
#!/bin/bash
|
|
# =============================================================================
|
|
# Server Setup Script for Aurora Production Deployment
|
|
# =============================================================================
|
|
# Run this script ONCE on a fresh server to configure security settings.
|
|
# Usage: sudo bash setup-server.sh
|
|
# =============================================================================
|
|
|
|
set -e
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
echo -e "${GREEN}╔══════════════════════════════════════════╗${NC}"
|
|
echo -e "${GREEN}║ Aurora Server Security Setup Script ║${NC}"
|
|
echo -e "${GREEN}╚══════════════════════════════════════════╝${NC}"
|
|
echo ""
|
|
|
|
# Check if running as root
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo -e "${RED}Error: Please run as root (sudo)${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# =============================================================================
|
|
# 1. Create Deploy User
|
|
# =============================================================================
|
|
echo -e "${YELLOW}[1/5] Creating deploy user...${NC}"
|
|
|
|
DEPLOY_USER="deploy"
|
|
|
|
if id "$DEPLOY_USER" &>/dev/null; then
|
|
echo -e " User '$DEPLOY_USER' already exists, skipping..."
|
|
else
|
|
adduser --disabled-password --gecos "" $DEPLOY_USER
|
|
echo -e " ${GREEN}✓${NC} Created user '$DEPLOY_USER'"
|
|
fi
|
|
|
|
# Add to docker group
|
|
usermod -aG docker $DEPLOY_USER 2>/dev/null || groupadd docker && usermod -aG docker $DEPLOY_USER
|
|
echo -e " ${GREEN}✓${NC} Added '$DEPLOY_USER' to docker group"
|
|
|
|
# Add to sudo group (optional - remove if you don't want sudo access)
|
|
usermod -aG sudo $DEPLOY_USER
|
|
echo -e " ${GREEN}✓${NC} Added '$DEPLOY_USER' to sudo group"
|
|
|
|
# Copy SSH keys from root to deploy user
|
|
if [ -d /root/.ssh ]; then
|
|
mkdir -p /home/$DEPLOY_USER/.ssh
|
|
cp /root/.ssh/authorized_keys /home/$DEPLOY_USER/.ssh/ 2>/dev/null || true
|
|
chown -R $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/.ssh
|
|
chmod 700 /home/$DEPLOY_USER/.ssh
|
|
chmod 600 /home/$DEPLOY_USER/.ssh/authorized_keys 2>/dev/null || true
|
|
echo -e " ${GREEN}✓${NC} Copied SSH keys to '$DEPLOY_USER'"
|
|
fi
|
|
|
|
# =============================================================================
|
|
# 2. Configure UFW Firewall
|
|
# =============================================================================
|
|
echo -e "${YELLOW}[2/5] Configuring UFW firewall...${NC}"
|
|
|
|
apt-get update -qq
|
|
apt-get install -y -qq ufw
|
|
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
ufw allow ssh
|
|
# Add more rules as needed:
|
|
# ufw allow 80/tcp # HTTP
|
|
# ufw allow 443/tcp # HTTPS
|
|
|
|
# Enable UFW (non-interactive)
|
|
echo "y" | ufw enable
|
|
echo -e " ${GREEN}✓${NC} UFW firewall enabled and configured"
|
|
|
|
# =============================================================================
|
|
# 3. Install and Configure Fail2ban
|
|
# =============================================================================
|
|
echo -e "${YELLOW}[3/5] Installing fail2ban...${NC}"
|
|
|
|
apt-get install -y -qq fail2ban
|
|
|
|
# Create local jail configuration
|
|
cat > /etc/fail2ban/jail.local << 'EOF'
|
|
[DEFAULT]
|
|
bantime = 1h
|
|
findtime = 10m
|
|
maxretry = 5
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
bantime = 24h
|
|
EOF
|
|
|
|
systemctl enable fail2ban
|
|
systemctl restart fail2ban
|
|
echo -e " ${GREEN}✓${NC} Fail2ban installed and configured"
|
|
|
|
# =============================================================================
|
|
# 4. Harden SSH Configuration
|
|
# =============================================================================
|
|
echo -e "${YELLOW}[4/5] Hardening SSH configuration...${NC}"
|
|
|
|
SSHD_CONFIG="/etc/ssh/sshd_config"
|
|
|
|
# Backup original config
|
|
cp $SSHD_CONFIG ${SSHD_CONFIG}.backup
|
|
|
|
# Apply hardening settings
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' $SSHD_CONFIG
|
|
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' $SSHD_CONFIG
|
|
sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' $SSHD_CONFIG
|
|
sed -i 's/^#\?X11Forwarding.*/X11Forwarding no/' $SSHD_CONFIG
|
|
sed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 3/' $SSHD_CONFIG
|
|
|
|
# Validate SSH config before restarting
|
|
if sshd -t; then
|
|
systemctl reload sshd
|
|
echo -e " ${GREEN}✓${NC} SSH hardened (root login disabled, password auth disabled)"
|
|
else
|
|
echo -e " ${RED}✗${NC} SSH config validation failed, restoring backup..."
|
|
cp ${SSHD_CONFIG}.backup $SSHD_CONFIG
|
|
fi
|
|
|
|
# =============================================================================
|
|
# 5. System Updates
|
|
# =============================================================================
|
|
echo -e "${YELLOW}[5/5] Installing system updates...${NC}"
|
|
|
|
apt-get upgrade -y -qq
|
|
apt-get autoremove -y -qq
|
|
echo -e " ${GREEN}✓${NC} System updated"
|
|
|
|
# =============================================================================
|
|
# Summary
|
|
# =============================================================================
|
|
echo ""
|
|
echo -e "${GREEN}╔══════════════════════════════════════════╗${NC}"
|
|
echo -e "${GREEN}║ Setup Complete! ║${NC}"
|
|
echo -e "${GREEN}╚══════════════════════════════════════════╝${NC}"
|
|
echo ""
|
|
echo -e "Next steps:"
|
|
echo -e " 1. Update your local .env file:"
|
|
echo -e " ${YELLOW}VPS_USER=deploy${NC}"
|
|
echo -e ""
|
|
echo -e " 2. Test SSH access with the new user:"
|
|
echo -e " ${YELLOW}ssh deploy@<your-server-ip>${NC}"
|
|
echo -e ""
|
|
echo -e " 3. Deploy the application:"
|
|
echo -e " ${YELLOW}cd /home/deploy/Aurora && docker compose -f docker-compose.prod.yml up -d${NC}"
|
|
echo ""
|
|
echo -e "${RED}⚠️ IMPORTANT: Test SSH access with 'deploy' user BEFORE logging out!${NC}"
|
|
echo -e "${RED} Keep this root session open until you confirm 'deploy' user works.${NC}"
|