ubuntu_basic_setup_do.sh

# Note: This is for the Ubunutu 18.04.2 x64 image available on Digital Ocean
# and may not work for other images / OS versions.

# Warning: This script directy edits some configuration files that may
# render your OS unusable if there is an error. Use at your own risk.

apt-get update

read -p "Add new user 'deploy' (recommended) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	useradd deploy
	mkdir /home/deploy
	mkdir /home/deploy/.ssh
	chmod 700 /home/deploy/.ssh
	chown deploy:deploy /home/deploy -R
	chsh -s /bin/bash deploy
  
	echo "Set password for user 'deploy'"
	passwd deploy
  
	echo "Added user 'deploy'"
	echo
fi

read -p "Add 'deploy' to sudoers (required for 'deploy' user) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	cat << EOF > /etc/sudoers
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
root    ALL=(ALL:ALL) ALL
deploy  ALL=(ALL:ALL) ALL
EOF

	echo "Added user 'deploy' to sudoers"
	echo
fi

read -p "Copy ssh public key from 'root' to 'deploy' [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	/bin/cp -f /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys
	chmod 400 /home/deploy/.ssh/authorized_keys
	chown deploy:deploy /home/deploy -R
	echo "Copied ssh public key from 'root'"
	echo
fi

read -p "Copy shell config files from 'root' to 'deploy' [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	cp .bashrc /home/deploy
	cp .profile /home/deploy
	chown deploy:deploy /home/deploy -R
	echo -e '\nexport LC_ALL="en_US.UTF-8"' >> /home/deploy/.bashrc
  
	echo "Copied shell config files from 'root' to 'deploy'"
	echo
fi

read -p "Upgrade installed packages (recommended) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	apt-get upgrade -y
	echo "Upgraded installed packages"
	echo
fi

read -p "Install firewall (recommended) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	apt-get install ufw -y

	ufw allow 22
	ufw --force enable

	echo "Installed firewall"
	echo
fi

read -p "Install fail2ban (recommended) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	apt-get install fail2ban -y

	echo "Installed fail2ban"
	echo
fi

read -p "Enable unattended security upgrades (recommended) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then
	apt-get install unattended-upgrades -y

	cat << EOF > /etc/apt/apt.conf.d/10periodic
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "1";
EOF

	cat << EOF > /etc/apt/apt.conf.d/50unattended-upgrades 
Unattended-Upgrade::Allowed-Origins {
  "${distro_id}:${distro_codename}-security";
};
EOF

	echo "Enabled unattended upgrades"
	echo
fi

read -p "Make ssh config more secure (recommended) [yN] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]
then

	cat << EOF > /etc/ssh/sshd_config
Port 22
Protocol 2
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
UsePAM yes
EOF

	service ssh restart

fi