Basic setup for EC2 instance running Ubuntu 18.04LTS

ubuntu_server_setup.sh

# add PHP+Certbot repo
add-apt-repository ppa:certbot/certbot -y
apt-add-repository ppa:ondrej/php -y
# update + upgrade
DEBIAN_FRONTEND=noninteractive apt-get -yq update && apt-get -yq upgrade
# set time + locale
timedatectl set-timezone Europe/Budapest
locale-gen en_US en_US.UTF-8
update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
# enable auto-update
apt-get install unattended-upgrades -y
sudo su -c 'cat > /etc/apt/apt.conf.d/50unattended-upgrades <<EOL
Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
        "${distro_id}ESM:${distro_codename}";
        "${distro_id}:${distro_codename}-updates";
};
Unattended-Upgrade::Package-Blacklist {
        "vim";
        "libc6";
        "libc6-dev";
        "libc6-i686";
};
Unattended-Upgrade::DevRelease "false";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Acquire::http::Dl-Limit "200";
Unattended-Upgrade::SyslogEnable "true";
EOL'
sudo su -c 'cat > /etc/apt/apt.conf.d/20auto-upgrades <<EOL
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "2";
APT::Periodic::Unattended-Upgrade "1";
EOL'
# do a dry-run
unattended-upgrades --dry-run --debug
# secure shared-memory
sudo su -c 'echo "tmpfs     /dev/shm     tmpfs     defaults,noexec,nosuid     0     0" >> /etc/fstab'
# harden network
sudo su -c 'cat > /etc/sysctl.conf <<EOL
# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0 
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1
EOL'
# install LogWatch
apt-get install -yq logwatch libdate-manip-perl
logwatch --mailto admin@mail.com --output mail --format html --range 'between -7 days and today'

need a sudo reboot for the shared memory fix + network hardening to take effect