hardening-script.sh

#!/usr/bin/env bash

set -euo pipefail

SYSCTL_DROPIN="/etc/sysctl.d/99-hardening-baseline.conf"
MODPROBE_BLACKLIST="/etc/modprobe.d/hardening-blacklist.conf"
COREDUMP_LIMITS="/etc/security/limits.d/99-hardening-no-coredump.conf"
COREDUMP_SYSCTL="/etc/sysctl.d/99-hardening-coredump.conf"
COREDUMP_SYSTEMD="/etc/systemd/coredump.conf.d/hardening.conf"
SCRIPT_NAME="Turtlecute33/Hardening-linux-script"

SUMMARY=()
PM_FAMILY=""

require_root() {
  if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
    echo "This script must be run as root. Please use sudo or log in as the root user."
    exit 1
  fi
}

require_systemctl() {
  if ! command -v systemctl >/dev/null 2>&1; then
    echo "systemctl is required by this script for optional service management."
    exit 1
  fi
}

detect_package_manager() {
  if [[ -f /etc/debian_version ]]; then
    PM_FAMILY="apt"
  elif [[ -f /etc/redhat-release ]]; then
    PM_FAMILY="dnf"
  elif [[ -f /etc/arch-release ]]; then
    PM_FAMILY="pacman"
  else
    echo "Unsupported Linux distribution. Please install packages manually."
    exit 1
  fi
}

prompt_yes_no() {
  local prompt="$1"
  local default_answer="${2:-no}"
  local answer=""

  while true; do
    if [[ "$default_answer" == "yes" ]]; then
      read -r -p "${prompt} [Y/n]: " answer
      answer="${answer:-yes}"
    else
      read -r -p "${prompt} [y/N]: " answer
      answer="${answer:-no}"
    fi

    case "$answer" in
      [Yy]|[Yy][Ee][Ss])
        return 0
        ;;
      [Nn]|[Nn][Oo])
        return 1
        ;;
      *)
        echo "Please enter yes or no."
        ;;
    esac
  done
}

build_sysctl_content() {
  cat <<EOF
######################################################################
## Safe baseline hardening settings managed by ${SCRIPT_NAME}
## File: ${SYSCTL_DROPIN}
## This file is generated by the hardening script.

## Kernel and userspace hardening
kernel.kptr_restrict=2
kernel.dmesg_restrict=1
kernel.unprivileged_bpf_disabled=1
vm.unprivileged_userfaultfd=0
kernel.yama.ptrace_scope=1
fs.protected_hardlinks=1
fs.protected_symlinks=1
fs.protected_fifos=2
fs.protected_regular=2
fs.suid_dumpable=0

## Network hardening
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_rfc1337=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.secure_redirects=0
net.ipv4.conf.default.secure_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.default.accept_source_route=0
net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.default.accept_redirects=0
net.ipv6.conf.all.accept_source_route=0
net.ipv6.conf.default.accept_source_route=0
net.ipv4.conf.all.log_martians=1
net.ipv4.conf.default.log_martians=1
EOF
}

write_sysctl_dropin() {
  local dropin_dir
  local temp_file

  dropin_dir="$(dirname "$SYSCTL_DROPIN")"
  mkdir -p "$dropin_dir"
  temp_file="$(mktemp)"

  build_sysctl_content > "$temp_file"
  install -m 0644 "$temp_file" "$SYSCTL_DROPIN"
  rm -f "$temp_file"

  SUMMARY+=("Applied safe baseline sysctl settings in ${SYSCTL_DROPIN}.")
}

apply_sysctl_settings() {
  if command -v sysctl >/dev/null 2>&1; then
    if sysctl --system >/dev/null 2>&1; then
      SUMMARY+=("Reloaded sysctl settings with sysctl --system.")
      return
    fi

    if sysctl -p "$SYSCTL_DROPIN" >/dev/null 2>&1; then
      SUMMARY+=("Reloaded sysctl settings from ${SYSCTL_DROPIN}.")
      return
    fi
  fi

  SUMMARY+=("Warning: unable to reload sysctl settings automatically.")
}

remove_cups_packages() {
  local packages=()

  echo "Removing CUPS packages and disabling related services..."

  case "$PM_FAMILY" in
    apt)
      mapfile -t packages < <(dpkg -l | awk '/^ii/ {print $2}' | grep '^cups' | grep -Ev '^(cups-pk-helper|libcups2)$' || true)
      if ((${#packages[@]})); then
        apt-get purge -y "${packages[@]}" >/dev/null 2>&1
      fi
      ;;
    dnf)
      mapfile -t packages < <(rpm -qa | grep '^cups' | grep -Ev '^(cups-pk-helper|libcups2)' || true)
      if ((${#packages[@]})); then
        dnf remove -y "${packages[@]}" >/dev/null 2>&1
      fi
      ;;
    pacman)
      mapfile -t packages < <(pacman -Qq | grep '^cups' | grep -Ev '^(cups-pk-helper|libcups2)$' || true)
      if ((${#packages[@]})); then
        pacman -Rns --noconfirm "${packages[@]}" >/dev/null 2>&1
      fi
      ;;
  esac

  systemctl stop cups.service cups-browsed.service 2>/dev/null || true
  systemctl disable cups.service cups-browsed.service 2>/dev/null || true

  if ((${#packages[@]})); then
    SUMMARY+=("Removed ${#packages[@]} CUPS package(s) and disabled related services.")
  else
    SUMMARY+=("No removable CUPS packages found; related services were disabled if present.")
  fi
}

disable_bluetooth() {
  echo "Disabling Bluetooth services..."
  systemctl stop bluetooth.service 2>/dev/null || true
  systemctl disable bluetooth.service 2>/dev/null || true
  SUMMARY+=("Disabled Bluetooth services if present.")
}

write_module_blacklist() {
  local blacklist_modules="$1"
  local blacklist_usb="$2"
  local temp_file

  if [[ "$blacklist_modules" == "no" && "$blacklist_usb" == "no" ]]; then
    return
  fi

  temp_file="$(mktemp)"

  {
    echo "## Managed by ${SCRIPT_NAME}"
    echo "## File: ${MODPROBE_BLACKLIST}"
    if [[ "$blacklist_modules" == "yes" ]]; then
      echo ""
      echo "## Disable unused filesystem modules"
      echo "install cramfs /bin/true"
      echo "install freevxfs /bin/true"
      echo "install jffs2 /bin/true"
      echo "install hfs /bin/true"
      echo "install hfsplus /bin/true"
      echo "install udf /bin/true"
    fi
    if [[ "$blacklist_usb" == "yes" ]]; then
      echo ""
      echo "## Disable USB storage"
      echo "install usb-storage /bin/true"
    fi
  } > "$temp_file"

  mkdir -p "$(dirname "$MODPROBE_BLACKLIST")"
  install -m 0644 "$temp_file" "$MODPROBE_BLACKLIST"
  rm -f "$temp_file"

  if [[ "$blacklist_modules" == "yes" ]]; then
    SUMMARY+=("Blacklisted unused kernel modules (cramfs, freevxfs, jffs2, hfs, hfsplus, udf).")
  fi
  if [[ "$blacklist_usb" == "yes" ]]; then
    SUMMARY+=("Blacklisted USB storage module.")
  fi
}

blacklist_kernel_modules() {
  write_module_blacklist "yes" "${1:-no}"
}

disable_usb_storage() {
  write_module_blacklist "${1:-no}" "yes"
}

restrict_core_dumps() {
  local temp_file

  echo "Restricting core dumps..."

  # limits.conf
  temp_file="$(mktemp)"
  cat > "$temp_file" <<'EOF'
## Managed by Turtlecute33/Hardening-linux-script
* hard core 0
EOF
  mkdir -p "$(dirname "$COREDUMP_LIMITS")"
  install -m 0644 "$temp_file" "$COREDUMP_LIMITS"
  rm -f "$temp_file"

  # sysctl
  temp_file="$(mktemp)"
  cat > "$temp_file" <<'EOF'
## Managed by Turtlecute33/Hardening-linux-script
## Core dump restrictions
kernel.core_pattern=/dev/null
EOF
  mkdir -p "$(dirname "$COREDUMP_SYSCTL")"
  install -m 0644 "$temp_file" "$COREDUMP_SYSCTL"
  rm -f "$temp_file"

  if command -v sysctl >/dev/null 2>&1; then
    sysctl -p "$COREDUMP_SYSCTL" >/dev/null 2>&1 || true
  fi

  # systemd-coredump override (binary lives at /usr/lib/systemd/, not in PATH)
  if [[ -x /usr/lib/systemd/systemd-coredump ]]; then
    temp_file="$(mktemp)"
    cat > "$temp_file" <<'EOF'
[Coredump]
Storage=none
ProcessSizeMax=0
EOF
    mkdir -p "$(dirname "$COREDUMP_SYSTEMD")"
    install -m 0644 "$temp_file" "$COREDUMP_SYSTEMD"
    rm -f "$temp_file"
    SUMMARY+=("Restricted core dumps (limits.conf, sysctl, systemd-coredump).")
  else
    SUMMARY+=("Restricted core dumps (limits.conf, sysctl).")
  fi
}

setup_auto_updates() {
  local temp_file

  echo "Setting up automatic security updates..."

  case "$PM_FAMILY" in
    apt)
      apt-get install -y unattended-upgrades >/dev/null 2>&1
      temp_file="$(mktemp)"
      cat > "$temp_file" <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
      install -m 0644 "$temp_file" /etc/apt/apt.conf.d/20auto-upgrades
      rm -f "$temp_file"
      SUMMARY+=("Installed and configured unattended-upgrades.")
      ;;
    dnf)
      dnf install -y dnf-automatic >/dev/null 2>&1
      if [[ -f /etc/dnf/automatic.conf ]]; then
        sed -i 's/^apply_updates.*=.*/apply_updates = yes/' /etc/dnf/automatic.conf
      fi
      systemctl enable dnf-automatic.timer 2>/dev/null || true
      systemctl start dnf-automatic.timer 2>/dev/null || true
      SUMMARY+=("Installed and enabled dnf-automatic with apply_updates = yes.")
      ;;
    pacman)
      echo "Note: Automatic updates are not recommended on Arch Linux (rolling release)."
      echo "Please manage updates manually with: pacman -Syu"
      SUMMARY+=("Skipped automatic updates (Arch Linux — not recommended).")
      ;;
  esac
}

install_fail2ban() {
  echo "Installing and enabling fail2ban..."

  case "$PM_FAMILY" in
    apt)
      apt-get install -y fail2ban >/dev/null 2>&1
      ;;
    dnf)
      dnf install -y fail2ban >/dev/null 2>&1
      ;;
    pacman)
      pacman -S --noconfirm fail2ban >/dev/null 2>&1
      ;;
  esac

  systemctl enable fail2ban.service 2>/dev/null || true
  systemctl start fail2ban.service 2>/dev/null || true

  SUMMARY+=("Installed and enabled fail2ban.")
}

print_summary() {
  local item

  echo
  echo "Hardening completed."
  for item in "${SUMMARY[@]}"; do
    echo "- $item"
  done
}

main() {
  require_root
  require_systemctl
  detect_package_manager
  write_sysctl_dropin
  apply_sysctl_settings

  if prompt_yes_no "Do you want to remove printer services (CUPS)?"; then
    remove_cups_packages
  else
    SUMMARY+=("Skipped CUPS removal.")
  fi

  if prompt_yes_no "Do you want to disable Bluetooth services?"; then
    disable_bluetooth
  else
    SUMMARY+=("Skipped Bluetooth changes.")
  fi

  local do_blacklist_modules="no"
  local do_blacklist_usb="no"

  if prompt_yes_no "Do you want to blacklist unused kernel modules (cramfs, freevxfs, jffs2, hfs, hfsplus, udf)?" "yes"; then
    do_blacklist_modules="yes"
  else
    SUMMARY+=("Skipped kernel module blacklisting.")
  fi

  if prompt_yes_no "Do you want to disable USB storage?" "no"; then
    do_blacklist_usb="yes"
  else
    SUMMARY+=("Skipped USB storage disable.")
  fi

  write_module_blacklist "$do_blacklist_modules" "$do_blacklist_usb"

  if prompt_yes_no "Do you want to restrict core dumps?" "yes"; then
    restrict_core_dumps
  else
    SUMMARY+=("Skipped core dump restrictions.")
  fi

  if prompt_yes_no "Do you want to enable automatic security updates?" "yes"; then
    setup_auto_updates
  else
    SUMMARY+=("Skipped automatic security updates.")
  fi

  if prompt_yes_no "Do you want to install fail2ban for brute-force protection?" "yes"; then
    install_fail2ban
  else
    SUMMARY+=("Skipped fail2ban installation.")
  fi

  print_summary
}

if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
  main "$@"
fi