Setting up a VPS

### © Aaron (Iso) Pescasio / www.apescasio.fr ###

### 1. Script to prepare and secure a VPS ###

### Prerequisites: -Linux VPS, -SSH connection, -'root' access ###

### After connecting to the VPS with SSH, I log in as 'root': 'sudo su' ###

### Update the package list ###

apt update

### Update the packages themselves ###

apt upgrade -y

### Install all packages needed to secure my VPS and host my website ###

apt install -y wget ufw fail2ban nginx ### (fail2ban, I keep the default config) ###

### Create the fail2ban log file ###

touch /var/log/auth_fail2ban.log

### Create a specific jail for SSH ###

cat <<EOL > /etc/fail2ban/jail.local
[sshd]
enabled = true
port = ssh
logpath = /var/log/auth_fail2ban.log
maxretry = 5
bantime = 3600
EOL

### Restart the fail2ban service ###

systemctl enable fail2ban && systemctl restart fail2ban

### Change the password for the 'root' account ###

echo "Enter a new password for the 'root' account"
passwd

### Update the VPS timezone ###

timedatectl set-timezone Europe/Paris

### Update my .bashrc (what I added: my shortcuts, changes to the history command to display the date next to executed commands) ###

#cd ~
#mv /etc/bash.bashrc /etc/bash.bashrc.backup
#wget -O /etc/bash.bashrc https://raw.githubusercontent.com/ApecioU/configfiles/main/bash.bashrc
#source /etc/bash.bashrc

### Change the default SSH listening port ###

while true; do
    read -p "Enter a number between 49152 and 65535: " port
    if [[ "$port" -ge 49152 && "$port" -le 65535 ]]; then ### For added security, use a number between 49152 and 65535. ###
        echo "Valid port: $port"
        break
    else
        echo "Invalid port. Please enter a number between 49152 and 65535."
    fi
done

sed -i "s/^#Port 22/Port $port/" /etc/ssh/sshd_config

### Note that you will need to specify the new port for every SSH connection to your server, e.g.: ###
### ssh username@VPS_IPv4 -p NewPort ###

### Disable 'root' login in the SSH config ###

sed -i 's/^#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config

### Disconnect the user after 120s of inactivity ###

sed -i 's/^#ClientAliveInterval 0/ClientAliveInterval 120/' /etc/ssh/sshd_config

### Define a variable for creating a personal account ###

read -p "Enter a username for creating a personal account: " perso

### Modify the SSH config to specify the usernames allowed to use SSH; all other users are blocked ###

echo "AllowUsers $perso" | sudo tee -a /etc/ssh/sshd_config

### Restart the service to apply changes ###

systemctl restart sshd

### Before enabling the ufw firewall, allow SSH connections on the selected port ###

ufw allow $port/tcp && ufw allow 'Nginx Full'  ### This command allows SSH and HTTP+S connections on the selected ports; all other ports are blocked :) ###

### Fix the 'Invalid argument' issue with NGINX on first installation ###

mkdir /etc/systemd/system/nginx.service.d
printf "[Service]\nExecStartPost=/bin/sleep 0.1\n" > /etc/systemd/system/nginx.service.d/override.conf
systemctl daemon-reload
systemctl restart nginx

### Now we can enable the firewall after allowing the new SSH port ###

ufw enable

### Create a personal account and add it to the 'sudo' group ###

sudo useradd -m -s /bin/bash -G sudo $perso && echo "Enter a password for $perso" && passwd $perso && sudo usermod -c "$perso" $perso

### Log in with the personal account ###

su $perso