-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathreinstall.sh
1725 lines (1592 loc) · 109 KB
/
reinstall.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
sudo pacman -S slim --noconfirm --needed
sudo mv /etc/systemd/system/display-manager.service /etc/systemd/system/display-manager.service.bak
sudo systemctl enable slim.service
### On development: ### GUIDES:: https://www.archlinux.org/feeds/news/ https://wiki.archlinux.org/index.php/IRC_channel (add to weechat) https://www.archlinux.org/feeds/ https://security.archlinux.org/
#DNS (unbound resolv.conf dnssec dyndns) and Firewall
#emacs https://melpa.org/
#create encfs alias and add gui
#gdb vs strace vs perf trace vs reptyr vs sysdig vs dtrace
# http://www.brendangregg.com/overview.html
# http://www.brendangregg.com/perf.html
# http://www.brendangregg.com/blog/2015-07-08/choosing-a-linux-tracer.html
# https://www.slideshare.net/brendangregg/velocity-2015-linux-perf-tools/105
# https://kernelnewbies.org/KernelGlossary https://0xax.gitbooks.io/linux-insides/content/Booting/
# PEDA vs Radare2 https://github.com/longld/peda
# http://160592857366.free.fr/joe/ebooks/ShareData/Design%20of%20the%20Unix%20Operating%20System%20By%20Maurice%20Bach.pdf
#next4 snapper?
#https://wiki.archlinux.org/index.php/Trusted_Users#How_do_I_become_a_TU.3F
#customizerom
### Restoring Windows on Grub2 ###
sudo os-prober
GRUBPROBER=$(sudo os-prober)
if [ -n "$GRUBPROBER" ]
then
sudo grub-mkconfig -o /boot/grub/grub.cfg
else
echo "No Windows installed"
fi
### MAC ###
echo "Randomize MAC"
echo ''
echo '[connection-mac-randomization]' | sudo tee -a /etc/NetworkManager/NetworkManager.conf
echo '# Randomize MAC for every ethernet connection' | sudo tee -a /etc/NetworkManager/NetworkManager.conf
echo 'ethernet.cloned-mac-address=random' | sudo tee -a /etc/NetworkManager/NetworkManager.conf
echo '# Generate a random MAC for each WiFi and associate the two permanently.' | sudo tee -a /etc/NetworkManager/NetworkManager.conf
echo 'wifi.cloned-mac-address=stable' | sudo tee -a /etc/NetworkManager/NetworkManager.conf
### Optimize Pacman, Update, Upgrade, Snapshot ###
sudo pacman -Sc --noconfirm #Improving pacman database access speeds reduces the time taken in database-related tasks
sudo pacman-key --refresh-keys #keyring update
sudo pacman -Syu --noconfirm #update & upgrade
#sudo pacman -S snap-pac --noconfirm --needed #Installing snapper
#sudo snapper -c root create-config / #Create snapshot folder (no chsnap for ext4)
#snapper -c preupgrade create --description preupgrade -c number 1 #Make snapshot preupgrade (no chsnap for ext4)
### Tor ###
sudo pacman -S arch-install-scripts base arm --noconfirm --needed
sudo pacman -S tor torsocks --noconfirm --needed
# Configuration
# Being able to run tor as a non-root user, and use a port lower than 1024 you can use kernel capabilities. As any upgrade to the tor package will reset the permissions, consider using pacman#Hooks, to automatically set the permissions after upgrades.
sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/tor
echo "[Action]
Description = Ports lower than 1024 available for Tor
Exec = sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/tor" | sudo tee -a /usr/share/libalpm/hooks/tor.hook
export TORPORT=$(shuf -i 2000-65000 -n 1)
echo "TORPORT $TORPORT"
export TORCONTROLPORT=$(shuf -i 2000-65000 -n 1)
echo "TORCONTROLPORT $TORCONTROLPORT"
export TORHASH=$(echo -n $RANDOM | sha256sum)
sudo vim -c ":%s/#SocksPort 9050/SocksPort $TORPORT/g" -c ":wq" /etc/tor/torrc
sudo vim -c ":%s/#ControlPort 9051/#ControlPort $TORCONTROLPORT/g" -c ":wq" /etc/tor/torrc
sudo vim -c ":%s/#HashedControlPassword*$/#HashedControlPassword 16:${TORHASH:-2}/g" -c ":wq" /etc/tor/torrc
echo "StrictNodes 1" | sudo tee -a /etc/tor/torrc
echo "ExitNodes " | sudo tee -a /etc/tor/torrc
echo "ExcludeNodes {us},{uk},{ca},{se},{fr},{pt},{de},{dk},{es},{nl},{kr},{ee}" | sudo tee -a /etc/tor/torrc
if [ ! -f /etc/tor/torsocks.conf ];
then
sudo touch /etc/tor/torsocks.conf
echo "TorPort $TORPORT" | sudo tee -a /etc/tor/torsocks.conf
else
sudo vim /etc/tor/torsocks.conf -c ":%s/#TorPort 9050/TorPort $TORPORT/g" -c ":wq"
fi
# All DNS queries to Tor
export TORDNSPORT=$(shuf -i 2000-65000 -n 1)
echo "DNSPort $TORDNSPORT" | sudo tee -a /etc/tor/torrc
echo "AutomapHostsOnResolve 1" | sudo tee -a /etc/tor/torrc
echo "AutomapHostsSuffixes .exit,.onion" | sudo tee -a /etc/tor/torrc
sudo pacman -S dnsmasq --noconfirm --needed
sudo vim -c ":%s,#port=,port=$TORDNSPORT ,g" -c ":wq" /etc/dnsmasq.conf
sudo vim -c ":%s,#conf-file=/usr/share/dnsmasq/trust-anchors.conf,conf-file=/usr/share/dnsmasq/trust-anchors.conf,g" -c ":wq" /etc/dnsmasq.conf
sudo vim -c ":%s,#dnssec,dnssec,g" -c ":wq" /etc/dnsmasq.conf
sudo vim -c ":%s,#no-resolv,no-resolv,g" -c ":wq" /etc/dnsmasq.conf
sudo vim -c ":%s,#server=/localnet/192.168.0.1,server=127.0.0.1,g" -c ":wq" /etc/dnsmasq.conf
sudo vim -c ":%s,#listen-address=,listen-address=127.0.0.1,g" -c ":wq" /etc/dnsmasq.conf
sudo vim -c ":%s,#nohook resolv.conf,nohook resolv.conf,g" -c ":wq" /etc/dhcpcd.conf
# Pacman over Tor/
sudo cp /etc/pacman.conf /etc/pacmantor.conf
sudo vim -c ':%s.#XferCommand = /usr/bin/curl.#XferCommand = /usr/bin/curl --socks5-hostname localhost:$TORPORT -C - -f %u > %o" \n#XferCommand = /usr/bin/curl.g' -c ':wq' /etc/pacmantor.conf
#Create user
export TORUSER="tor"
sudo useradd -m $TORUSER
sudo passwd $TORUSER
# Run Tor as chroot
sudo find /var/lib/tor/ ! -user tor -exec chown tor:tor {} \;
sudo chown -R tor:tor /var/lib/tor/
sudo chmod -R 755 /var/lib/tor
sudo systemctl --system daemon-reload
export TORCHROOT=/opt/torchroot
sudo mkdir -p $TORCHROOT
sudo mkdir -p $TORCHROOT/etc/tor
sudo mkdir -p $TORCHROOT/dev
sudo mkdir -p $TORCHROOT/usr/bin
sudo mkdir -p $TORCHROOT/usr/lib
sudo mkdir -p $TORCHROOT/usr/share/tor
sudo mkdir -p $TORCHROOT/var/lib
sudo ln -s /usr/lib $TORCHROOT/lib
sudo cp -r /etc/hosts $TORCHROOT/etc/hosts
sudo cp /etc/host.conf $TORCHROOT/etc/host.conf
sudo cp -r /etc/localtime $TORCHROOT/etc/localtime
sudo cp /etc/nsswitch.conf $TORCHROOT/etc/nsswitch.conf
sudo cp /etc/resolv.conf $TORCHROOT/etc/resolv.conf
sudo cp -r /etc/tor $TORCHROOT/etc/tor #which contains torrc (and torsocks.conf despite not needed)
sudo mkdir $TORCHROOT/root
sudo mkdir $TORCHROOT/root/tor
sudo chown -R tor:tor $TORCHROOT/root/tor
sudo cp -r /usr/bin/tor $TORCHROOT/usr/bin/tor
sudo cp -r /lib/libnss* /lib/libnsl* /lib/ld-linux-*.so* /lib/libresolv* /lib/libgcc_s.so* $TORCHROOT/usr/lib/
for F in $(ldd -r /usr/bin/tor | awk '{print $3}'|grep --color=never "^/" | sed 's/^.*\(\/lib[0-9]*\/[a-z]*\).*/\/usr\1*/g'); do sudo cp -R -f ${F} $TORCHROOT/${F%/*}/. ; done
sudo cp -r /var/lib/tor $TORCHROOT/var/lib/
sudo chown -R tor:tor $TORCHROOT/var/lib/tor
sh -c "grep --color=never ^tor /etc/passwd | sudo tee -a $TORCHROOT/etc/passwd"
sh -c "grep --color=never ^tor /etc/group | sudo tee -a $TORCHROOT/etc/group"
sudo mknod -m 644 $TORCHROOT/dev/random c 1 8
sudo mknod -m 644 $TORCHROOT/dev/urandom c 1 9
sudo mknod -m 666 $TORCHROOT/dev/null c 1 3
if [[ "$(uname -m)" == "x86_64" ]]; then
sudo cp /usr/lib/ld-linux-x86-64.so* $TORCHROOT/usr/lib/.
sudo ln -sr /usr/lib64 $TORCHROOT/lib64
sudo ln -s $TORCHROOT/usr/lib ${TORCHROOT}/usr/lib64
fi
#echo 'alias chtor="sudo chroot --userspec=$TORUSER:$TORUSER /opt/torchroot /usr/bin/tor"' | tee -a .bashrc
# Checking conf
sudo cp -r $TORCHROOT/var/lib/tor /var/lib/tor
sudo chown -R tor:tor $TORCHROOT/var/lib/tor
sudo cp /etc/tor/ $TORCHROOT/etc/tor/
sudo cp /etc/dnsmasq.conf $TORCHROOT/etc/dnsmasq
sudo cp /etc/dhcpcd.conf $TORCHROOT/etc/dhcpcd.conf
sudo cp /etc/pacmantor.conf $TORCHROOT/etc/pacman.conf
# Running Tor in a systemd-nspawn container with a virtual network interface [which is more secure than chroot]
TORCONTAINER=tor-exit #creating container and systemd service
SRVCONTAINERS=/srv/container
VARCONTAINERS=/var/lib/container/
sudo mkdir $SRVCONTAINERS/$TORCONTAINER
sudo pacstrap -i -c -d $SRVCONTAINERS/$TORCONTAINER base tor arm --noconfirm --needed
sudo mkdir $VARCONTAINERS
sudo ln -s $SRVCONTAINERS/$TORCONTAINER $VARCONTAINERS/$TORCONTAINER
sudo mkdir /etc/systemd/system/systemd-nspawn@$TORCONTAINER.service.d
sudo ifconfig #adding container ad-hoc vlan
read -p "Choose your host network interface for creating a new VLAN (wlp1s0 by default): " INTERFACE
INTERFACE="${INTERFACE:=wlp1s0}"
VLANINTERFACE="${INTERFACE:0:2}.tor"
sudo ip link add link $INTERFACE name $VLANINTERFACE type vlan id $(((RANDOM%4094)+1))
sudo ip addr add 10.0.0.1/24 brd 10.0.0.255 dev $VLANINTERFACE
sudo sudo ip link set $VLANINTERFACE up
networkctl
printf "[Service]
ExecStart=
ExecStart=/usr/bin/systemd-nspawn --quiet --boot --keep-unit --link-journal=guest --network-macvlan=$VLANINTERFACE --private-network --directory=$VARCONTAINERS/$TORCONTAINER LimitNOFILE=32768" | sudo tee -a /etc/systemd/system/systemd-nspawn@$TORCONTAINER.service.d/$TORCONTAINER.conf #config file [yes, first empty ExecStart is required]. You can use --ephemeral instead of --keep-unit --link-journal=guest and then you can delete the machine
sudo systemctl daemon-reload
TERMINAL=$(tty)
TERM="${TERMINAL:5:4}0"
echo "$TERM" | sudo tee -a $SRVCONTAINERS/$TORCONTAINER/etc/securetty
TERM="${TERMINAL:5:4}1"
echo "$TERM" | sudo tee -a $SRVCONTAINERS/$TORCONTAINER/etc/securetty
TERM="${TERMINAL:5:4}2"
echo "$TERM" | sudo tee -a $SRVCONTAINERS/$TORCONTAINER/etc/securetty
TERM="${TERMINAL:5:4}3"
echo "$TERM" | sudo tee -a $SRVCONTAINERS/$TORCONTAINER/etc/securetty
TERM="${TERMINAL:5:4}4"
echo "$TERM" | sudo tee -a $SRVCONTAINERS/$TORCONTAINER/etc/securetty
TERM="${TERMINAL:5:4}5"
echo "$TERM" | sudo tee -a $SRVCONTAINERS/$TORCONTAINER/etc/securetty
# Checking conf
sudo cp -R $SRVCONTAINERS/$TORCONTAINER/var/lib/tor /var/lib/tor
sudo chown -R root:root $SRVCONTAINERS/$TORCONTAINER/var/lib/tor
sudo cp -R /etc/tor/ $SRVCONTAINERS/$TORCONTAINER/etc/tor/
sudo cp /etc/dnsmasq.conf $SRVCONTAINERS/$TORCONTAINER/etc/dnsmasq.conf
sudo cp /etc/dhcpcd.conf $SRVCONTAINERS/$TORCONTAINER/etc/dhcpcd.conf
sudo cp /etc/pacmantor.conf $SRVCONTAINERS/$TORCONTAINER/etc/pacman.conf
sudo systemctl daemon-reload
sudo systemd-nspawn --boot --directory=$SRVCONTAINERS/$TORCONTAINER
sudo systemctl list-machines
systemctl start systemd-nspawn@$TORCONTAINER.service
machinectl -a
echo "Login root without password. Set passwd. Bring VLAN up with ip link set mv-$VLANINTERFACE up. Add a user with useradd. Login user and set passwd. Use ctrl+shift+] to exit"
machinectl login $TORCONTAINER
networkctl
#machine enable $TORCONTAINER #enable at boot otherwise you need to start it every time
### Shadowsocks & GPG ###
sudo pacman -S shadowsocks-qt5 shadowsocks --noconfirm --needed
sudo pacman -S gnupg gnupg2 --noconfirm --needed
### Security ###
# Password management
#sudo authconfig --passalgo=sha512 --update #pass sha512 $6 by default
#sudo chage -d 0 tiwary #To force new password in next login, but unnecessary as we are going to renew it now
sudo pacman -S libpwquality --noconfirm --needed
##########Activate password requirements (Activate password required pam_cracklib.so retry=2 minlen=10 difok=6 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 and password required pam_unix.so use_authtok sha512 shadow and deactivate password required pam_unix.so sha512 shadow nullok)
#sudo vim -c ":%1,2s/#password/password" -c ":wq" /etc/pam.d/passwd
#sudo vim -c ":%3s/password/#password" -c ":wq" /etc/pam.d/passwd
echo "auth optional pam_faildelay.so delay=1" | sudo tee -a /etc/pam.d/system-login #Increase delay in case of failed password (in this case, decreased, time in ms)
echo "auth required pam_tally2.so deny=3 unlock_time=5 root_unlock_time=15 onerr=succeed" | sudo tee -a /etc/pam.d/system-login #Lockout user after three failed login attempts (pam_tally is deprecated and superseded by pam_tally2, time in ms
echo "account required pam_tally2.so" | sudo tee -a /etc/pam.d/system-login
sudo vim -c ":%s/auth required pam_tally.so/#auth required pam_tally.so/g" -c ":wq" /etc/pam.d/system-login
#echo "MENU MASTER PASSWD $syspass" | sudo tee -a syslinux.cfg #Syslinux bootloader security master password
# TAKE BETWEEN root: AND : FROM $(sudo cat /etc/shadow | grep root)
#https://wiki.archlinux.org/index.php/GRUB/Tips_and_tricks#Password_protection_of_GRUB_menu
sudo chage -M -1 365 "$USER" #force to change password every 90 days (-M, -W only for warning) but without password expiration (-1, -I will set a different days for password expiration, and -E a data where account will be locked)
sudo chage -W 90 "$USER" #Warning days for password changing
pwmake 512 #Create a secure 512 bits password
chage -l "$USER" #Change password
#BIOS lock down
echo " >>>>>> Please lock down your BIOS <<<<< "
# Avoid fork bombs
sudo vim -c ":%s/#@faculty soft nproc 20/@faculty soft nproc 1000/g" -c ":wq" /etc/security/limits.conf
sudo vim -c ":%s/#@faculty hard nproc 50/@faculty hard nproc 2000/g" -c ":wq" /etc/security/limits.conf
#Disable ICMP
echo "Check function disableremoteping"
# Prevent sudo from SFTP:
echo "auth required /lib/security/pam_listfile.so item=user sense=deny file=/etc/vsftpd.ftpusers onerr=succeed" | sudo tee -a /etc/pam.d/vsftpd
#Similar line can be added to the PAM configuration files, such as /etc/pam.d/pop and /etc/pam.d/imap for mail clients, or /etc/pam.d/sshd for SSH clients.
# TCP Wrappers
sudo mkdir -p /etc/banners
echo "Hello. All activity on this server is logged. Inappropriate uses and access will result in defensive counter-actions." | sudo tee -a /etc/banners/sshd
echo "ALL : ALL : spawn /bin/echo $date %c %d >> /var/log/intruder_alert" | sudo tee -a /etc/hosts.deny ##log any connection attempt from any IP and send the date to intruder_alert logfile
echo "in.telnetd : ALL : severity emerg" | sudo tee -a /etc/hosts.deny ##log any attempt to connect to in.telnetd posting emergency log messages directly to the console
# Encryption of filesystems (Encrypt disk to avoid init=/bin/sh)
sudo pacman -S encfs pam_encfs --noconfirm --needed #Check https://wiki.archlinux.org/index.php/Disk_encryption#Comparison_table
# Kernel hardening
sudo pacman -S linux-hardened --needed --noconfirm
echo "kernel.dmesg_restrict = 1" | sudo tee -a /etc/sysctl.d/50-dmesg-restrict.conf #Restricting access to kernel logs
echo "kernel.kptr_restrict = 1" | sudo tee -a /etc/sysctl.d/50-kptr-restrict.conf #Restricting access to kernel pointers in the proc filesystem
# Bluetooth
sudo vim -c ':%s,\#Autoenable=False,Autoenable=False,g' -c ':wq' /etc/bluetooth/main.conf
sudo rfkill block bluetooth
printf "[General]
Enable=Socket" | sudo tee -a /etc/bluetooth/audio.conf #A2DP
sudo vim -c ':%s.; enable-lfe-remixing = no.enable-lfe-remixing = yes.g' -c ':wq' /etc/pulse/daemon.conf
sudo vim -c "%s,\#load-module module-switch-on-connect,load-module module-switch-on-connect,g" -c ":wq" /etc/pulse/default.pa
sudo vim -c "%s,\#load-module module-suspend-on-idle,load-module module-suspend-on-idle,g" -c ":wq" /etc/pulse/default.pa
sudo vim -c 's, /usr/bin/pactl load-module module-x11-xsmp “display=$DISPLAY session_manager=$SESSION_MANAGER” > /dev/null,
\n /usr/bin/pactl load-module module-x11-xsmp "display=$DISPLAY session_manager=$SESSION_MANAGER" > /dev/null
\n /usr/bin/pactl load-module module-bluetooth-policy
\n /usr/bin/pactl load-module module-bluetooth-discover,g' -c "wq" /usr/bin/start-pulseaudio-x11 #automatic pavucontrol recognition
echo "load-module module-bluetooth-discover" | sudo tee -a "/etc/pulse/system.pa"
echo "load-module module-bluetooth-policy" | sudo tee -a "/etc/pulse/system.pa"
printf "[phonesim]
Driver=phonesim
Address=1.1.1.1
Port=12345" | sudo tee -a /etc/ofono
sudo useradd -g bluetooth pulse
pulseaudio -k
pulseaudio --start --daemon
sudo systemctl stop bluetooth.service
sudo pkill -9 /usr/lib/bluetooth/obexd
sudo pkill -9 /usr/lib/bluetooth/bluetoothd
sudo systemctl start bluetooth.service
#UDF DVDs
echo "/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto,exec,utf8 0 0" | sudo tee -a /etc/fstab
# USBGuard and USB readonly (previous checker -noexec and --rw included on alias monta)
#git clone https://aur.archlinux.org/usbguard.git
#cd usbguard
#git clone git://github.com/ClusterLabs/libqb.git #dependencies
#cd libqb
#./autogen.sh
#./configure
#make
#sudo make install
#sudo pacman -S libsodium libgcrypt asciidoctor protobuf libseccomp libcap-ng qt4 --noconfirm --needed
#cd ..
#gpg2 --keyserver hkp://pgp.mit.edu --recv-keys AA06120530AE0466
#makepkg -si --nodeps --noconfirm --needed
#gpg2 --delete-secret-and-public-keys --batch --yes AA06120530AE0466
#cd ..
#sudo rm -r usbguard
echo 'SUBSYSTEM=="block",ATTRS{removable}=="1",RUN{program}="/sbin/blockdev --setro %N"' | sudo tee -a /etc/udev/rules.d/80-readonly-removables.rules
sudo udevadm trigger
sudo udevadm control --reload
# Log out virtual /dev/tty consoles out after 10s inactivity and prevent sudo from X11
#echo "export TMOUT=\"\$(( 60*10 ))\"; #to exclude X11 from this rule, delete export word
#[ -z \"\$DISPLAY\" ] && export TMOUT;
#case \$( /usr/bin/tty ) in
# /dev/tty[0-9]*) export TMOUT;;
#esac" | sudo tee -a /etc/profile.d/shell-timeout.sh
#echo 'Section "ServerFlags"
# Option "DontVTSwitch" "True"
#EndSection' | sudo tee -a /usr/share/X11/xorg.conf.d/50-notsudo.conf
# Extra recommendations
echo ">>> Do not use rlogin, rsh, and telnet <<<"
echo ">>> Take care of securing sftp, auth, nfs, rpc, postfix, samba and sql https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Securing_Services.html <<<"
echo ">>> Take care of securing Docker https://wiki.archlinux.org/index.php/Docker#Insecure_registries https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html-single/getting_started_with_containers/ <<<"
### Network ###
# SSH
if [ ! -f /etc/ssh/sshd_config ];
then
echo "PermitRootLogin no" | sudo tee -a /etc/ssh/sshd_config
echo "Protocol 2" | sudo tee -a /etc/ssh/sshd_config
echo "MaxAuthTries 3" | sudo tee -a etc/ssh/sshd_config
else
sudo vim /etc/ssh/sshd_config -c ':%s/PermitRootLogin without password/PermitRootLogin no/g' -c ':wq'
sudo vim /etc/ssh/sshd_config -c ':%s/Protocol 2,1/Protocol 2/g' -c ':wq'
sudo vim /etc/ssh/sshd_config -c ":%s/MaxAuthTries 6/MaxAuthTries 3/g" -c ":wq"
fi
# SSHguard (prefered over Fail2ban)
sudo pacman -S sshguard --noconfirm --needed
sudo vim -c ":%s,BLACKLIST_FILE=120:/var/db/sshguard/blacklist.db,BLACKLIST_FILE=50:/var/db/sshguard/blacklist.db,g" -c ":wq" /etc/sshguard.conf #Danger level: 5 failed logins -> banned
sudo vim -c ":%s,THRESHOLD=30,THRESHOLD=10,g" -c ":wq" /etc/sshguard.conf
sudo systemctl enable --now sshguard.service
# OpenSSL and NSS
sudo pacman -S openssl nss --noconfirm --needed
cat "$(locate ca-certificates)" #check all certificates
#blacklist ssl symanteccertificate
wget https://crt.sh/?d=19538258
sudo mv index.html?d=19538258 /etc/ca-certificates/trust-source/blacklist/19538258-Symantec.crt #Blacklist Symantec SSL Cert
sudo update-ca-trust
# Suricata IDS/IPS (prefered over Snort https://www.aldeid.com/wiki/Suricata-vs-snort)
gpg2 --keyserver ha.pool.sks-keyservers.net --recv-keys 801C7171DAC74A6D3A61ED81F7F9B0A300C1B70D
git clone https://aur.archlinux.org/suricata.git
cd suricata
makepkg -si --noconfirm # --enable-profiling-locks
cd ..
sudo rm -r suricata
gpg2 --delete-secret-and-public-keys --batch --yes 801C7171DAC74A6D3A61ED81F7F9B0A300C1B70D
#basic conf
sudo rm /etc/suricata/suricata.yaml #delete conf file by default to create a new one
if [ ! -f /etc/suricata/suricata.yaml ]; then
sudo touch /etc/suricata/suricata.yaml #using echo instead of printf by reason of %
echo '%YAML 1.1
---
# - dyre_sslipblacklist_aggressive.rules # available in suricata sources under rules dir
default-log-dir: /var/log/suricata/ # where you want to store log files
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config
HOME-NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,127.0.0.1/8]" # HOME_NET is deprecated
magic-file: /usr/share/file/misc/magic.mgc
stats:
enabled: yes
interval: 10
filename: stats.log
totals: yes # stats for all threads merged together
threads: yes # per thread stats
null-values: yes # print counters that have value 0
host-mode: auto #If set to auto, the variable is internally switch to router in IPS mode and sniffer-only in IDS mode.
outputs:
fast:
enabled: yes
filename: fast.log
append: yes
filetype: regular #regular, unix_stream or unix_dgram
eve-log:
enabled: no
alert-debug:
enabled: yes
filename: alert-debug.log
append: yes
filetype: regular #regular, unix_stream or unix_dgram
drop:
enabled: yes
filename: drop.log
append: yes
filetype: regular #regular, unix_stream or unix_dgram
alerts: yes # log alerts that caused drops
flows: all # start or all: 'start' logs only a single drop
logging:
default-log-level: debug
coredump:
max-dump: unlimited
host-mode: auto
runmode: workers
default-packet-size: 9014
legacy:
uricontent: enabled
engine-analysis: # enables printing reports for fast-pattern for every rule.
rules-fast-pattern: yes # enables printing reports for each rule
rules: yes #recursion and match limits for PCRE where supported
pcre:
match-limit: 3500
match-limit-recursion: 1500
vlan:
use-for-tracking: true
#reputation-categories-file: /usr/local/etc/suricata/iprep/categories.txt
#default-reputation-path: /usr/local/etc/suricata/iprep
default-rule-path: /etc/suricata/rules/' | sudo tee -a /etc/suricata/suricata.yaml #continue below activating rules
else
sudo vim -c ":%s,# -,-,g" -c ":wq" /etc/suricata/suricata.yaml #when file exists
fi
#Activating rules
suricatasslrule(){
url=$SSLRULES".rules"
agurl=$SSLRULES"_aggressive.rules"
wget "https://sslbl.abuse.ch/blacklist/$url"
sudo mv "$url" "/etc/suricata/rules/$url"
wget "https://sslbl.abuse.ch/blacklist/$agurl"
sudo mv "$agurl" "/etc/suricata/rules/$agurl"
echo " - $url # available in suricata sources under rules dir" | sudo tee /etc/suricata/suricata.yaml #activate ssl blacklist rules
echo "# - $agurl # available in suricata sources under rules dir" | sudo tee /etc/suricata/suricata.yaml #activate ssl aggressive blacklist
}
SSLRULES=sslblacklist
suricatasslrule
SSLRULES=dyre_sslipblacklist
suricatasslrule
#other confs
wget https://raw.githubusercontent.com/OISF/suricata/master/suricata.yaml.in
echo "## FULL EXPLANATION https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml ##" | tee -a suricata.yaml.in
sudo mv suricata.yaml.in /etc/suricata/suricata-defaultOISFexample.yaml
wget https://redmine.openinfosecfoundation.org/attachments/download/1340/suricata.yaml
vim -c "%s/ - drop:/ - drop:\r alerts: yes # log alerts that caused drops\r flows: all # start or all: 'start' logs only a single drop\n/g" -c ":wq" suricata.yaml #using /r instead of /n in vim because /n is null
sudo mv suricata.yaml /etc/suricata/suricata-specificNOSERVexample.yaml
#restarting suricata
if [ ! -f /var/run/suricata.pid ];
then
sudo pkill -9 suricata
sudo killall suricata
sudo rm /var/run/suricata.pid
fi
sudo suricata -c /etc/suricata/suricata.yaml -i $INTERFACE -D #start suricata and enable interfaces, the -s allows specific rules
#enable at boot
echo "[Unit]
Description=Suricata Intrusion Detection Service listening on '%I'
After=network.target
[Service]
Type=forking
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i %i -D
ExecReload=/bin/kill -HUP \$MAINPID
[Install]
WantedBy=multi-user.target" | sudo tee -a /usr/lib/systemd/system/suricata@$INTERFACE.service
sudo systemctl enable --now suricata@$INTERFACE.service
echo "[Unit]
Description=Suricata Intrusion Detection Service listening on '%I'
After=network.target
[Service]
Type=forking
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i %i -D
ExecReload=/bin/kill -HUP \$MAINPID
[Install]
WantedBy=multi-user.target" | sudo tee -a /usr/lib/systemd/system/suricata@$VLANINTERFACE.service
sudo systemctl enable --now suricata@$VLANINTERFACE.service
# Ports
read -p "At this point you should decide what ports you want to open to incoming connections, which are handled by the TCP and UDP chains. For example to open connections for a web server add, without commas: 80 web, 443 https, 22 ssh, 5353 chrome, $TORPORT tor... by default 443 and all of them udp and tcp): " ports
nameofvar="ports"
ports="${ports:=443}"
# Iptables
sudo pacman -S iptables gufw --noconfirm --needed
sudo iptables -F
sudo iptables -A INPUT -i lo -j ACCEPT
for i in $ipports; do
sudo iptables -A INPUT -p tcp --dport $i
done
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT ##If you are a server change this to DROP OUTPUT connections by default too
#iptables -t filter -I OUTPUT 1 -m state --state NEW -j LOG --log-level warning --log-prefix 'Attempted to initiate a connection from a local process' --log-uid #block all with log
#iptables -t filter -I OUTPUT 1 -p udp -m multiport --ports 80,443 -j ACCEPT #filter exception
sudo iptables -P FORWARD DROP
# Avahi daemon
#sudo service avahi-daemon stop #avahi-daemon
# No cups
sudo cupsctl -E --no-remote-any
sudo service cups-browsed stop
sudo systemctl cupsd
sudo systemctl disable org.cups.cupsd
# Nftables
sudo pacman -S nftables --noconfirm --needed
nftports=$(echo "$ports" | tr '\n' ' ' | sed -e 's/[^0-9]/ /g' -e 's/^ *//g' -e 's/ *$//g' | tr -s ' ' | sed 's/ /\n/g')
for i in $nftports; do
nft add rule inet filter TCP tcp dport $i accept
done
printf "flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
# accept any localhost traffic
iif lo accept
# accept traffic originated from us
ct state established,related accept
# activate the following line to accept common local services
#tcp dport { 22, 80, 443 } ct state new accept
# accept neighbour discovery otherwise IPv6 connectivity breaks.
ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
# count and drop any other traffic
counter drop
}
}" | sudo tee -a /etc/nftables.conf #other examples https://wiki.archlinux.org/index.php/Nftables#Examples
sudo nft flush ruleset #Flush the current ruleset:
sudo nft add table inet filter #Add a table:
#Add the input, forward, and output base chains. The policy for input and forward will be to drop. The policy for output will be to accept.
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
sudo nft add chain inet filter forward { type filter hook forward priority 0 \; policy drop \; }
sudo nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }
#Add two regular chains that will be associated with tcp and udp:
sudo nft add chain inet filter TCP
sudo nft add chain inet filter UDP
sudo nft add rule inet filter input ct state related,established accept #Related and established traffic will be accepted:
sudo nft add rule inet filter input iif lo accept #All loopback interface traffic will be accepted:
sudo nft add rule inet filter input ct state invalid drop #Drop any invalid traffic:
sudo nft add rule inet filter input ip protocol icmp icmp type echo-request ct state new accept #New echo requests (pings) will be accepted:
sudo nft add rule inet filter input ip protocol udp ct state new jump UDP #New upd traffic will jump to the UDP chain:
sudo nft add rule inet filter input ip protocol tcp tcp flags \& \(fin\|syn\|rst\|ack\) == syn ct state new jump TCP #New tcp traffic will jump to the TCP chain:
#Reject all traffic that was not processed by other rules:
sudo nft add rule inet filter input ip protocol udp reject
sudo nft add rule inet filter input ip protocol tcp reject with tcp reset
sudo nft add rule inet filter input counter reject with icmp type prot-unreachable
# Rootkit checking and Audits (see at the EOF)
# Antivirus and Cleaners
sudo pacman -S clamav bleachbit --noconfirm --needed
### Tweaks ###
# .bashrc
mv ~/.bashrc ~/.previous-bashrc
wget https://raw.githubusercontent.com/abueesp/Scriptnstall/master/.bashrc
sudo pacman -S onboard --noconfirm --needed #Virtual keyboard
# Snapshots configuration (no chsnap for ext4)
#snapper -c original create --description original #Make snapshot original
#printf 'TIMELINE_MIN_AGE="1800"
#TIMELINE_LIMIT_HOURLY="0"
#TIMELINE_LIMIT_DAILY="0"
#TIMELINE_LIMIT_WEEKLY="0"
#TIMELINE_LIMIT_MONTHLY="6"
#TIMELINE_LIMIT_YEARLY="0"' >> /etc/snapper/configs/mysnapshots
#git clone https://aur.archlinux.org/grub-btrfs.git #Snapshots on grub
#cd grub-btrfs
#makepkg -si --noconfirm
#cd ..
#sudo rm -r grub-btrfs
#git clone https://aur.archlinux.org/packages/snap-pac-grub/
#cd snap-pac-grub
#gpg2 --keyserver hkp://keys.gnupg.net --recv EB4F9E5A60D32232BB52150C12C87A28FEAC6B20
#makepkg -si --noconfirm
#gpg2 --batch --delete-key EB4F9E5A60D32232BB52150C12C87A28FEAC6B20
#cd ..
#sudo rm -r snap-pac-grub
# Pacman tools
sudo pacman -S arch-audit pacgraph pacutils --noconfirm --needed #personal aliases prefered over pacman-contrib
# PKGtools
sudo pacman -S pkgdiff --noconfirm --needed
git clone https://github.com/graysky2/lostfiles #Script that identifies files not owned and not created by any Arch Linux package.
cd lostfiles
make && sudo make install
cd ..
sudo rm -r lostfiles
git clone https://github.com/Daenyth/pkgtools #newpkg - spec2arch - pkgconflict - whoneeds - pkgclean - maintpkg - pip2arch
cd pkgtools/scripts/pip2arch
wget https://raw.githubusercontent.com/lclarkmichalek/pip2arch/master/pip2arch.py
cd ..
cd ..
sudo make install
cd ..
sudo rm -r pkgtools
bupkgs(){
for i in $( pacman -Qq ); do
bacman $i
done
}
#alias kalifyarch='printf "[archstrike] \n Server = https://mirror.archstrike.org/\$arch/\$repo/ " | sudo tee -a /etc/pacman.conf && sudo pacman-key --recv-keys 9D5F1C051D146843CDA4858BDE64825E7CBC0D51 && sudo pacman-key --finger 9D5F1C051D146843CDA4858BDE64825E7CBC0D51 && sudo pacman-key --lsign-key 9D5F1C051D146843CDA4858BDE64825E7CBC0D51'
#alias haskellfyarch='printf "[haskell-core] \n Server = http://xsounds.org/~haskell/core/\$arch " | sudo tee -a /etc/pacman.conf && sudo pacman-key --recv-keys F3104992EBF24EB872B97B9C32B0B4534209170B && sudo pacman-key --finger F3104992EBF24EB872B97B9C32B0B4534209170B && sudo pacman-key --lsign-key F3104992EBF24EB872B97B9C32B0B4534209170B && Haskwell WAIs: Yesod Framework brings Wrap Server. It is better than Happstack. For small projects try Scotty that also comes with Wrap, or maybe Snaps snaplets"'
#alias rubifyarch='printf "[quarry] \n Server = https://pkgbuild.com/~anatolik/quarry/x86_64/ " | sudo tee -a /etc/pacman.conf && echo "This repo has not key!"'
# AUR-helpers and repositories https://wiki.archlinux.org/index.php/AUR_helpers
git clone https://aur.archlinux.org/aurman.git #Aurman
cd aurman
makepkg -si --noconfirm --needed
cd ..
sudo rm -r aurman
#Deb packages
wget https://raw.githubusercontent.com/helixarch/debtap/master/debtap
echo "d9d40c88a401a33239880280ec9ec11e737cbbdc66e7830143c3b363fa8527fa8168ad708fba87bba0664fdda281a786fdf5a66e9f1e15be29ebb4d8bb157352 debtap" > debtap.txt
sha512sum -c debtap.txt 2>&1 | grep 'OK\|coincide'
if [ $? -eq 0 ] then
echo "GOOD SHA 512"
sudo chmod +x debtap
sudo mv debtap /bin/debtap
else
echo "BAD SHA 512"
exit
fi
#Fixing wall
sudo rm /usr/bin/wall
sudo touch /usr/bin/wall
printf "echo 'Active receivers'
sudo ls /dev/pts/
read -p 'Introduce receivers separated by commas. Write nothing for everyone: ' ptslist
ptsnumbers=\$(echo \$ptslist | sed 's/,/ /g')
if [ -z \$ptsnumbers ]; then
read -p 'Introduce text message or message path to send to everyone: ' ptsmessage
if [ ! -f \$ptsmessage ]; then
for pts in \$(ls /dev/pts/); do
ptspath='/dev/pts/'\$pts
echo \$ptsmessage > \$ptspath
done
else
for pts in \$(ls /dev/pts/); do
ptspath='/dev/pts/'\$pts
echo \$ptsmessage > \$ptspath
done
fi
else
read -p 'Introduce text message or message path to send to '\$ptsnumbers' :' ptsmessage
if [ ! -f \$ptsmessage ]; then
for pts in \$ptsnumbers; do
ptspath='/dev/pts/'\$pts
echo \$ptsmessage > \$ptspath
done
else
for pts in \$ptsnumbers; do
ptspath='/dev/pts/'\$pts
cat \$ptsmessage > \$ptspath
done
fi
fi" | sudo tee -a /usr/bin/wall
sudo chmod +x /usr/bin/wall
# Search tools
gpg2 --keyserver ha.pool.sks-keyservers.net --recv-keys 465022E743D71E39 #for mlocate
sudo pacman -S mlocate recoll the_silver_searcher --noconfirm --needed #find locate
aurman -S tag-ag --noconfirm
printf 'tag() {
command tag "$@"
source /tmp/tag_aliases}
alias ag=tag' | tee -a ~/.bashrc
if [ ! -f /home/$USER/.recoll/recoll.conf ]; then
mkdir /home/$USER/.recoll
cp /usr/share/recoll/examples/recoll.conf /home/$USER/.recoll/recoll.conf
fi
vim -c ":%s.topdirs = / ~.topdirs = / ~.g" -c ":wq" /home/$USER/.recoll/recoll.conf
sudo updatedb
# Dock conf
dconf write /com/deepin/dde/dock/docked-apps "['/S@deepin-toggle-desktop', '/S@dde-file-manager', '/S@deepin-music', '/S@chromium', '/S@deepin-screen-recorder', '/S@deepin-voice-recorder', '/S@deepin-system-monitor', '/S@gnome-calculator', '/S@recoll']"
# Deepin conf
dconf write /com/deepin/dde/touchpad/horiz-scroll-enabled "false"
dconf write /com/deepin/dde/mouse/locate-pointer "false"
dconf write /com/deepin/dde/desktop/show-computer-icon "true"
dconf write /com/deepin/dde/desktop/show-home-icon "true"
dconf write /com/deepin/dde/desktop/show-trash-icon "true"
dconf write /com/deepin/dde/daemon/calltrace "true"
dconf write /com/deepin/dde/daemon/debug "true"
dconf write /com/deepin/dde/audio/auto-switch-port "true"
dconf write /com/deepin/dde/sound-effect/camera-shutter "false" #Less sounds
dconf write /com/deepin/dde/sound-effect/desktop-login "false"
dconf write /com/deepin/dde/sound-effect/enabled "false"
dconf write /com/deepin/dde/sound-effect/dialog-error "false"
dconf write /com/deepin/dde/sound-effect/dialog-error-serious "false"
dconf write /com/deepin/dde/sound-effect/dialog-error-critical "false"
dconf write /com/deepin/dde/sound-effect/suspend-resume "false"
# Sound
aurman -S indicator-sound-switcher --noconfirm --needed --noedit
amixer sset Master unmute
amixer cset numid=11,iface=MIXER,name='Capture Switch' off
alsactl store
# Fixing bugs
# sudo pacman -S deepin-api --noconfirm -needed
# Sandboxing tools
# Namespaces tools: It limits what the app can see using pid, net, mnt, uts, ipc and user spaces. (alike cgroups, which limits how much can use, using memory, cpu, network, i/o, and other resources)
#Firejail
sudo pacman -S firejail --noconfirm --needed #Firejail is a SUID program that restricts the running environment of applications using Linux namespaces and seccomp-bpf.
sudo pacman -S xorg-server-xephyr --noconfirm --needed #Nested X11 better than Xnest
sudo vim -c ":%s/\# force-nonewprivs no/force-nonewprivs yes/g" -c ":wq" /etc/firejail/firejail.config #no setuid
RESOLUTION=$(xdpyinfo | awk '/dimensions/{print $2}')
sudo vim -c ":%s/\# xephyr-screen 640x480/xephyr-screen $RESOLUTION/g" -c ":wq" /etc/firejail/firejail.config #size
sudo vim -c ":%s/\# xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev/xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev -resizeable -audit 5/g" -c ":wq" /etc/firejail/firejail.config #ephyr keyboard audit
echo "if [ -z '$1' ]"| tee -a ix
echo " then"| tee -a ix
echo " ljail=2"| tee -a ix
echo "else"| tee -a ix
echo " ljail=$(echo '2*$1' | bc)"| tee -a ix
echo "fi"| tee -a ix
echo "X2=$(firemon --x11 | awk -v ljail=$ljail 'FNR==$ljail{print \$0}' | awk '{print \$2}')" | tee -a ix
echo 'xclip -selection clip -o -display :0 | xclip -selection clip -i -display "$X2"' | tee -a ix
sudo chmod +x ix
sudo mv ix /bin/ix
echo "if [ -z '$1' ]"| tee -a ox
echo " then"| tee -a ox
echo " ljail=2"| tee -a ox
echo "else"| tee -a ox
echo " ljail=$(echo '2*$1' | bc)"| tee -a ox
echo "fi"| tee -a ox
echo "X2=$(firemon --x11 | awk -v ljail=$ljail 'FNR==$ljail{print \$0}' | awk '{print \$2}')" | tee -a ox
echo 'xclip -selection clip -o -display "$X2" | xclip -selection clip -i -display :0' | tee -a ox
sudo chmod +x ox
sudo mv ox /bin/ox
sudo pacman -S xclip xbindkeys --noconfirm --needed
xbindkeys --defaults > ~/.xbindkeysrc
vim -c ":%s/\# set directly keycode (here control + f with my keyboard)/\# xclip input/g" -c ":wq" ~/.xbindkeysrc #introducing ix over xterm
vim -c ":45,47s/xterm/ix/" -c ":wq" ~/.xbindkeysrc
vim -c ":%s/c:41 + m:0x4/alt + i/g" -c ":wq" ~/.xbindkeysrc
vim -c ":%s/\# specify a mouse button/\# xclip output/g" -c ":wq" ~/.xbindkeysrc #introducing ox over xterm
vim -c ":49,51s/xterm/ox/" -c ":wq" ~/.xbindkeysrc
vim -c ":%s/control + b:2/alt + o/g" -c ":wq" ~/.xbindkeysrc
#Bubblewrap
sudo pacman -S bubblewrap --noconfirm --needed #bubblewrap works by creating a new, completely empty, mount namespace where the root is on a tmpfs that is invisible from the host, and will be automatically cleaned up when the last process exits.
wget https://raw.githubusercontent.com/projectatomic/bubblewrap/master/demos/bubblewrap-shell.sh
sudo chmod +x bubblewrap-shell.sh
sudo mv bubblewrap-shell.sh bwrapsh
# Containerization tools: less secure as they share kernel and hardware (not a real virtual machine), faster, more portable
#Chroot/Proot/Fakeroot: A chroot is an operation that changes the apparent root directory for the current running process and their children. A program that is run in such a modified environment cannot access files and commands outside that environmental directory tree. This modified environment is called a chroot jail. Proot may be used to change the apparent root directory (all files are owned by the user on the host) and use mount --bind without root privileges (used for running programs built for a different CPU architecture). Fakeroot can be used to simulate a chroot as a regular user.
sudo pacman -S fakeroot --noconfirm --needed
#Spawn: systemd-nspawn is like the chroot command, but it is a chroot on steroids: it fully virtualizes the file system hierarchy, the process tree, various IPC subsystems and the host and domain name. systemd-nspawn limits access to various kernel interfaces in the container to read-only, such as /sys, /proc/sys or /sys/fs/selinux.
#ZeroVM is a scalable and portable container based on Google Native Client useful when you are having massive and parallel data inputs that need to be statically verified to be "safe" before used.
#LXC unpriviledged containerization provides kernel namespaces that has its own CPU, memory, block I/O, network, etc. under the resource control mechanism of kernel (cgroups). Seccomp included, apparmor and SElinux compatible.
sudo pacman -S lxc arch-install-scripts --noconfirm --needed
#LXD, a container system making use of LXC containers made by Canonical and specialized in deploying Linux distros.
#Docker a container system making written in Go that use LXC containers (among others) by Docker Inc (but the Community Version may be fully open source) and specialized in deploying apps (one in each container, including the one with the distro base image). It adds syntatic sugar, enabling image management, and providing deployment services, specially through third party apps. It also has tools to set up virtual container hosts (Machine), orchestrate multiple services in containers linked together in a single stack (Compose yaml file), and orchestate your containers|tasks as a cluster (Swarm).
aurman docker https://docs.docker.com/engine/security/ https://wiki.archlinux.org/index.php/docker
#Kubernetes is a container orchestration system for Docker (containers are called services here, aggruped in nodes) made by Google but today managed by the Linux Foundation (but may be fully open source) that is more extensible than Docker Swarm. It uses pods, which have 1 or more containers, and uses Elasticsearch/Kibana (ELK) for logs within the container, Heapster/Grafana/Influx for monitoring in the container and Sysdig cloud integration.
aurman -S kubernetes --noconfirm --needed
#FreeBSD Jails (only with Pacbsd but discontinued 2017). FreeBSD's LXC with zfs compatibility, network isolation, daemon included in the kernel, and better default policies.
#Clear containers. It uses Intel VT-x. One container per Clear Linux VM wrapped with a specially-optimized copy of the Linux OS. Compatible with KVM and Docker with VT if using VMCS shadowing as a technology that accelerates nested virtualization of VMMs.
#Linux-VServer. It is a VPS implementation by adding virtualization capabilities to the Linux kernel (host).
https://wiki.archlinux.org/index.php/Arch_Linux_VPS
#UML UserMode Linux (only for Linux)
https://wiki.archlinux.org/index.php/User-mode_Linux
# Emulation tools: Enables one host computer system to behave like another guest computer system
sudo pacman -S qemu qemu-arch-extra --noconfirm --needed
# Virtualization tools: governed by a hypervisor, enforce data isolation in hardware HVM, most secure, slower, less portable
#VMWare is the VM from Dell. Fully closed source and does not allow OSX outside Mac.
#Lguest: Linux kernel paravirtualization hypervisor. Lguest32 was introduced in kernel version 2.6.23 in 2007 and removed in kernel version 4.14 in 2017). 10x faster than basic qemu, and 100x faster than a real boot. Lguest64 was introduced on 2007 https://lwn.net/Articles/248189/ but most advanced still https://github.com/psomas/lguest64
#Xen: #Full and paravirtualization
#Virtualbox + Vagrant: Most compatible (except for Xen, which allows paravirtualization). It's from Oracle and has closed USB drivers.
pacman -Si linux
sudo pacman -S linux-headers --noconfirm --needed
sudo pacman -S virtualbox-host-modules-arch qt4 virtualbox virtualbox-guest-iso --noconfirm --needed
sudo modprobe -a vboxdrv vboxnetflt vboxpci vboxnetadp
sudo /sbin/rcvboxdrv -h
sudo gpasswd -a $USER vboxusers
echo "vboxdrv" | sudo tee -a /etc/modules-load.d/virtualbox.conf
echo "vboxnetadp" | sudo tee -a /etc/modules-load.d/virtualbox.conf
echo "vboxnetflt" | sudo tee -a /etc/modules-load.d/virtualbox.conf
echo "vboxpci" | sudo tee -a /etc/modules-load.d/virtualbox.conf
version=$(vboxmanage -v)
echo $version
var1=$(echo $version | cut -d 'r' -f 1)
echo $var1
var2=$(echo $version | cut -d 'r' -f 2)
echo $var2
file="Oracle_VM_VirtualBox_Extension_Pack-$var1.vbox-extpack"
echo $file
wget http://download.virtualbox.org/virtualbox/$var1/$file -O $file
sudo VBoxManage extpack install $file --replace
sudo rm $file
sudo pacman -S dkms vagrant --noconfirm --needed
vagrant plugin install vagrant-vbguest
wget http://download.virtualbox.org/virtualbox/$var1/VBoxGuestAdditions_$var1.iso
sudo mv VBoxGuestAdditions_$var1.iso /usr/share/VBoxGuestAdditions_$var1.iso
echo "To insert iso additions, install a vm named 'myvm' and move the .iso to your user folder"
virtualbox
vboxmanage storageattach myvm --storagectl IDE --port 0 --device 0 --type dvddrive --medium "/usr/share/VBoxGuestAdditions_$var1.iso"
#KVM, Qemu Kernel VM. Most secure. Mandatory Access Control and SELinux. It requires that the processor support Intel-VT or AMD-VT extensions, and that those extensions are enabled in the BIOS.
echo "Enable kvm to virtualize"
### Emacs ###
sudo pacman -S emacs --noconfirm --needed
sudo pacman -S git --noconfirm --needed
git clone https://github.com/syl20bnr/spacemacs ~/.emacs.d
cd ~/.emacs.d
git clone https://github.com/EnigmaCurry/emacs/find/ancient-history
wget https://github.com/ethereum/emacs-solidity/blob/master/solidity-mode.el
wget https://melpa.org/packages/vyper-mode-20180707.1235.el
echo 'Carga los elementos de emacs con (add-to-list load-path "~/.emacs.d/") + (load "myplugin.el")' >> README
cd ..
### Vim ###
sudo pacman -S vim --noconfirm --needed
sudo pacman -S ctags cscope --noconfirm --needed
sudo pacman -S git --noconfirm --needed
git clone --depth=1 https://github.com/amix/vimrc.git ~/.vim_runtime
sh ~/.vim_runtime/install_awesome_vimrc.sh
if [ -e "/home/$USER/.vim_runtime/vimrcs/basic.vim" ];
then
VIMRC=/home/$USER/.vim_runtime/vimrcs/basic.vim
else
VIMRC=.vimrc
fi
echo "VIMRC=$VIMRC" | tee -a ~/.bashrc
echo ' ' | tee -a "$VIMRC"
echo '\" => Commands' | tee -a "$VIMRC"
echo ":command! Vb exe \"norm! \\<C-V>" | tee -a "$VIMRC" #Visual column
echo "nnoremap <C-UP> :<c-u>execute 'move -1-'. v:count1<cr>" | tee -a "$VIMRC" #Quickly move current line up
echo "nnoremap <C-DOWN> :<c-u>execute 'move +'. v:count1<cr>" | tee -a "$VIMRC" #Quickly move current line down
echo "nnoremap <C-space> :<c-u>put =repeat(nr2char(10), v:count1)<cr>" | tee -a "$VIMRC" #Quickly add blank line, better than ":nnoremap <C-O> o<Esc>"
echo "nnoremap <C-q> :<c-u><c-r><c-r>='let @'. v:register .' = '. string(getreg(v:register))<cr><c-f><left>" | tee -a "$VIMRC" #Quickly edit macro
echo "nnoremap <C-a> :%y+" | tee -a "$VIMRC" #Quickly select all, better than "nnoremap <C-a> gg"+yG"
echo "set autoindent" | tee -a "$VIMRC"
echo "set paste" | tee -a "$VIMRC"
echo "set mouse=a" | tee -a "$VIMRC"
echo "set undofile" | tee -a "$VIMRC"
echo "set clipboard=unnamedplus" | tee -a "$VIMRC"
echo ' ' | tee -a "$VIMRC"
echo '\" => Reticle' | tee -a "$VIMRC"
echo ":set cursorcolumn" | tee -a "$VIMRC"
echo ":set cursorline" | tee -a "$VIMRC"
echo ":set relativenumber" | tee -a "$VIMRC"
echo ' ' | tee -a "$VIMRC"
echo '\" => Ctags' | tee -a "$VIMRC"
echo "set tags+=~/.vim/ctags/c" | tee -a "$VIMRC"
echo "set tags+=~/.vim/ctags/c++" | tee -a "$VIMRC"
echo ' ' | tee -a "$VIMRC"
echo '\" => Arrow keys' | tee -a "$VIMRC"
echo "nnoremap <silent> <ESC>OA <UP>" | tee -a "$VIMRC"
echo "nnoremap <silent> <ESC>OB <DOWN>" | tee -a "$VIMRC"
echo "nnoremap <silent> <ESC>OC <RIGHT>" | tee -a "$VIMRC"
echo "nnoremap <silent> <ESC>OD <LEFT>" | tee -a "$VIMRC"
echo "inoremap <silent> <ESC>OA <UP>" | tee -a "$VIMRC"
echo "inoremap <silent> <ESC>OB <DOWN>" | tee -a "$VIMRC"
echo "inoremap <silent> <ESC>OC <RIGHT>" | tee -a "$VIMRC"
echo "inoremap <silent> <ESC>OD <LEFT>" | tee -a "$VIMRC"
echo ' ' | tee -a "$VIMRC"
echo '\" => Ctrl+Shift+c/p to copy/paste outside vim' | tee -a "$VIMRC"
echo "nnoremap <C-S-c> +y" | tee -a "$VIMRC"
echo "vnoremap <C-S-c> +y" | tee -a "$VIMRC"
echo "nnoremap <C-S-p> +gP" | tee -a "$VIMRC"
echo "vnoremap <C-S-p> +gP" | tee -a "$VIMRC"
echo ' ' | tee -a "$VIMRC"
echo '\" => Macros' | tee -a "$VIMRC"
function sendtovimrc(){
echo "let @$key='$VIMINSTRUCTION'" | tee -a "$VIMRC"
#please note the double set of quotes
}
key="p"
VIMINSTRUCTION="isudo pacman -S --noconfirm --needed\<esc>4bhi"
sendtovimrc
key="y"
VIMINSTRUCTION="iaurman -S --noconfirm --needed\<esc>4bhi"
sendtovimrc
key="a"
VIMINSTRUCTION="iaurman -S --noconfirm --needed\<esc>4bhi"
sendtovimrc
#ag on Ack plugin
printf "if executable('ag')
let g:ackprg = 'ag --vimgrep'
:cnoreabbrev ag Ack
endif" | tee -a "$VIMRC"
#PATHOGENFOLDER="~/.vim/build"
if [ -e "/home/$USER/.vim_runtime/sources_forked" ];
then
PATHOGENFOLDER="~/.vim_runtime/sources_forked"
elif [ -e "/home/$USER/.vim/sources_forked" ];
else
PATHOGENFOLDER="~/.vim/sources_forked"
else
echo "No pathogen folder found"
fi
echo "PATHOGENFOLDER=$PATHOGENFOLDER" | tee -a ~/.bashrc
echo "alias pathogen=\"read -p 'Name of the plugin:' PLUGINNAME && read -p 'Plugin Git link:' PLUGINGIT && git clone $PLUGINGIT $PATHOGENFOLDER/$PLUGINNAME\"" | tee -a ~/.bashrc
echo 'alias viminstallplugin="pathogen"' | tee -a ~/.bashrc
wget http://cscope.sourceforge.net/cscope_maps.vim
echo "set timeoutlen=4000" | tee -a cscope_maps.vim
echo "set ttimeout" | tee -a cscope_maps.vim
echo "#sudo find / -type f -print | grep -E '\.c(pp)?|h)$' > cscope.files && cscope -bq" | tee -a cscope_maps.vim
git clone https://github.com/tpope/vim-sensible "$PATHOGENFOLDER"/vim-sensible
git clone https://github.com/ocaml/merlin "$PATHOGENFOLDER"/merlin
git clone https://github.com/OmniSharp/omnisharp-vim $PATHOGENFOLDER/omnisharp-vim && cd "$PATHOGENFOLDER"/omnisharp-vim && git submodule update --init --recursive && cd server && xbuild && cd
#git clone https://github.com/rhysd/vim-crystal/ "$PATHOGENFOLDER"/vim-crystal
#git clone https://github.com/venantius/vim-eastwood.git "$PATHOGENFOLDER"/vim-eastwood
git clone https://github.com/rust-lang/rust.vim "$PATHOGENFOLDER"/rust
git clone https://github.com/kballard/vim-swift.git "$PATHOGENFOLDER"/swift
git clone --recursive https://github.com/python-mode/python-mode "$PATHOGENFOLDER"/python-mode
git clone https://github.com/eagletmt/ghcmod-vim "$PATHOGENFOLDER"/ghcmod-vim
git clone https://github.com/eagletmt/neco-ghc "$PATHOGENFOLDER"/neco-ghc
git clone https://github.com/ahw/vim-hooks "$PATHOGENFOLDER"/vim-hooks
echo ":nnoremap gh :StartExecutingHooks<cr>:ExecuteHookFiles BufWritePost<cr>:StopExecutingHooks<cr>" | sudo tee -a /usr/share/vim/vimrc
echo ":noremap ghl :StartExecutingHooks<cr>:ExecuteHookFiles VimLeave<cr>:StopExecutingHooks<cr>" | sudo tee -a /usr/share/vim/vimrc
git clone https://github.com/sheerun/vim-polyglot "$PATHOGENFOLDER"/vim-polyglot
echo "syntax on" | sudo tee -a /usr/share/vim/vimrc
git clone https://github.com/scrooloose/nerdcommenter "$PATHOGENFOLDER"/nerdcommenter
git clone https://github.com/sjl/gundo.vim "$PATHOGENFOLDER"/gundo
echo " " | tee -a "$VIMRC"
echo "nnoremap <F5> :GundoToggle<CR>" | tee -a "$VIMRC"
git clone https://github.com/Shougo/neocomplcache.vim "$PATHOGENFOLDER"/neocomplcache
echo "let g:neocomplcache_enable_at_startup = 1" | tee -a "$VIMRC"
git clone https://github.com/easymotion/vim-easymotion "$PATHOGENFOLDER"/vim-easymotion
git clone https://github.com/spf13/PIV "$PATHOGENFOLDER"/PIV
git clone https://github.com/tpope/vim-surround "$PATHOGENFOLDER"/vim-surround
wget https://raw.githubusercontent.com/xuhdev/vim-latex-live-preview/master/plugin/latexlivepreview.vim -O "$PATHOGENFOLDER"/latexlivepreview.vim
git clone https://github.com/vim-latex/vim-latex "$PATHOGENFOLDER"/vim-latex
git clone https://github.com/tomtom/tlib_vim.git "$PATHOGENFOLDER"/tlib_vim
git clone https://github.com/MarcWeber/vim-addon-mw-utils.git "$PATHOGENFOLDER"/vim-addon-mw-utils
git clone https://github.com/garbas/vim-snipmate.git "$PATHOGENFOLDER"/vim-snipmate
git clone https://github.com/honza/vim-snippets.git "$PATHOGENFOLDER"/vim-snippets
echo " " | tee -a "$VIMRC"
echo "nnoremap <C-R><C-T> <Plug>snipMateTrigger" | tee -a "$VIMRC"
echo "nnoremap <C-R><C-G> <Plug>snipMateNextOrTrigger" | tee -a "$VIMRC"
mkdir -p "$PATHOGENFOLDER"/vim-snippets/snippets
cd "$PATHOGENFOLDER"/vim-snippets/snippets
git clone https://github.com/Chalarangelo/30-seconds-of-code/
mv 30-seconds-of-code/test 30secJavaScript
sudo rm -r 30-seconds-of-code
cd 30secJavaScript
find . -iname "*js*" -exec rename .js .snippet '{}' \;
cd ..
git clone https://github.com/kriadmin/30-seconds-of-python-code
mv 30-seconds-of-python-code/test 30secPython3
sudo rm -r 30-seconds-of-python-code
cd 30secPython3
find . -iname "*py*" -exec rename .py .snippet '{}' \;
cd ..
cd
git clone https://github.com/maralla/completor.vim "$PATHOGENFOLDER"/completor
sudo -H pip install jedi #completor for python
echo "let g:completor_python_binary = '/usr/lib/python*/site-packages/jedi'" | tee -a "$VIMRC"
git clone https://github.com/ternjs/tern_for_vim "$PATHOGENFOLDER"/tern_for_vim
echo "let g:completor_node_binary = '/usr/bin/node'" | tee -a "$VIMRC"
echo "let g:completor_clang_binary = '/usr/bin/clang'" | tee -a "$VIMRC" #c++
git clone https://github.com/nsf/gocode "$PATHOGENFOLDER"/completor #go
echo "let g:completor_gocode_binary = '$PATHOGENFOLDER/gocode'"
git clone https://github.com/maralla/completor-swift "$PATHOGENFOLDER"/completor-swift #swift
cd "$PATHOGENFOLDER"/completor-swift
make
cd
echo "let g:completor_swift_binary = '$PATHOGENFOLDER/completor-swift'" | tee -a "$VIMRC"
#Vim portability for ssh (sshrc)
wget https://raw.githubusercontent.com/Russell91/sshrc/master/sshrc && sudo chmod -R 600 sshrc && chmod +x sshrc && sudo mv sshrc /usr/local/bin
vimfunctions(){
echo "### Tools ###"
echo "cscope: Browsing tool similar to ctags, Ctrl+\ "
echo "ack: Search tool, :grep=:ack=:ag :grepadd=:ackadd, :lgrep=LAck, and :lgrepadd=:LAckAdd (see all options with :ack ?)"
echo "bufexplorer: See and manage the current buffers(,o)"
echo "mru: Recently open files (,f)"
echo "ctrlp: Find file or a buffer(,j or c-f)"
echo "Nerdtree and openfile under cursor: Treemaps (,nn toggle and ,nb bookmark and ,nf find, gf go open file under cursor)"
echo "Goyo.vim and vim-zenroom2: Removes all the distractions (,z)"
echo ":w (,w)"
echo "vim-easymotion: go to (<leader><leader> or //)"
echo "vim-yankstack: Maintains a history of previous yanks :yanks :registers (meta-p, meta-shift-p)"
echo "vim-multiple-cursors: Select multiple cursors (c-n next and c-p previous and c-x skip)"
echo "vim-fugitive: Git wrapper (:Gbrowse and :Gstatus and - for reset and p for patch and :Gcommit and :Gedit and :Gslipt and :Gvslipt and :Gtabedit and :Gdiff and :Gmove and :Ggrep and :Glog and :Gdelete and :Gread and :Gwrite)"
echo "vim-expand-region: (+ to expand the visual selection and _ to shrink it)"
echo "commentary-vim: Comments management (gcc for a line and gcap for a paragraph and gc in visual mode and :7,17Commentary)"
echo "pathogen: Install plugins and manage your vim runtimepath (use 'installvimplugin' or 'git clone https://github.com/yourplugin ~/.vim_runtime/sources_non_forked/nameofplugin' for example"