Ubuntu 14.04 post-install script

post-install.sh

#!/bin/bash

# language
apt-get install -y language-pack-ru aptitude
echo "LANG=\"ru_RU.UTF-8\"
LC_ALL=\"ru_RU.UTF-8\"" > /etc/default/locale

# timezone
echo "Europe/Moscow" > /etc/timezone
dpkg-reconfigure -f noninteractive tzdata

# common utils
aptitude install -y mc git tig htop pydf ncdu atop byobu vnstat speedometer software-properties-common fail2ban bash-completion
add-apt-repository -y multiverse

# webserver
add-apt-repository -y ppa:ondrej/php5-5.6
add-apt-repository -y ppa:nginx/stable
aptitude update
aptitude upgrade -y
aptitude install -y php5-cli php5-fpm php5-sqlite php5-mysql php5-gd php5-json php5-curl nginx

# composer
php -r "readfile('https://getcomposer.org/installer');" | php -- --install-dir=/usr/local/bin
ln -s /usr/local/bin/composer{.phar,}

# harden networking
echo "# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0 
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings (in case you need it)
# net.ipv4.icmp_echo_ignore_all = 1" > /etc/sysctl.d/99-network-security.conf
service procps start

# cleanup
aptitude remove --purge -y apport apport-symptoms whoopsie
apt-get clean
apt-get autoremove -y

echo "



IMPORTANT:

1. Change SSH Port address

   # shuf -i 2000-65535 -n 10 # generate some port numbers
   # sed -i /etc/ssh/sshd_config -re 's/^Port 22/Port YOURNUMBER/' # change port in sshd config
   # service ssh reload # reload ssh config

   Then add selected port to your ~/.ssh/config and test connection withot disconnecting from this one.

2. Then forbid password login (in case you have already set up and tested key authentication):

   # sed -i /etc/ssh/sshd_config -re 's/^#(PasswordAuthentication) yes/\1 no/'
   # service ssh reload

   Then test connection again in separate terminal without disconnecting from this one.

3. In order to enable bash completion uncomment corresponding block in /etc/bash.rc

4. Reboot"