apache2-server-setup/setup.sh at master · aaangeletakis/apache2-server-setup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#!/bin/bash
apt-get update -y;
add-apt-repository ppa:certbot/certbot -y;
apt-get update -y;
apt-get install curl php7.0-cli git python-certbot-apache software-properties-common -y;
apt-get update -y;
curl -sS https://getcomposer.org/installer | sudo php -- --install-dir=/usr/local/bin --filename=composer;
#goto endOfFireWallInstallationAndSetup # uncommment if you have a firewall
apt-get install iptables -y;
/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP;
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP;
/sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP;
/sbin/iptables -t mangle -A PREROUTING -f -j DROP;
/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set;
/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP;
/sbin/iptables -N port-scanning;
/sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN;
/sbin/iptables -A port-scanning -j DROP;
/sbin/iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack;
/sbin/iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460;
/sbin/iptables -A INPUT -m conntrack --ctstate INVALID -j DROP;
:endOfFireWallInstallationAndSetup
echo "Then, when you're ready, do:";
echo "     certbot --apache certonly               (sets up https)";
echo "     certbot renew --dry-run                 (sets up certificate auto renewal)";
echo "     composer require defuse/php-encryption";
echo "     composer require respect/validation";
apt-get upgrade -y;
apt-get update -y;
echo "Done. :)";