secure-server.sh

#!/usr/bin/env bash

# Interactive dedicated server firewall hardening script.
# Uses iptables + ipset with ipsum scanner blocklist.
# Works on Debian, Ubuntu, RHEL, Rocky Linux, and AlmaLinux.

set -Eeuo pipefail
IFS=$'\n\t'

export DEBIAN_FRONTEND=noninteractive

die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
ask() { local label="$1" default="$2" value; read -r -p "$label [$default]: " value; printf '%s' "${value:-$default}"; }
required() { local label="$1" value; while :; do read -r -p "$label: " value; [[ -n "$value" ]] && { printf '%s' "$value"; return; }; done; }
confirm() { local label="$1"; read -r -p "$label [y/N]: " answer; [[ "$answer" =~ ^[Yy]$ ]]; }

detect_os() {
    if [[ -f /etc/os-release ]]; then
        . /etc/os-release
        OS_ID="$ID"
        OS_VERSION="$VERSION_ID"
        OS_FAMILY="$ID_LIKE"
    else
        die "Cannot detect operating system."
    fi
}

is_debian_family() { [[ "$OS_FAMILY" == *debian* || "$OS_ID" == debian || "$OS_ID" == ubuntu ]]; }
is_rhel_family() { [[ "$OS_FAMILY" == *rhel* || "$OS_ID" == rocky || "$OS_ID" == almalinux || "$OS_ID" == rhel ]]; }

pkg_install() {
    if is_debian_family; then
        apt-get install -y "$@"
    elif is_rhel_family; then
        dnf install -y "$@"
    else
        die "Unsupported operating system: $OS_ID"
    fi
}

svc_enable() { systemctl enable --now "$1" 2>/dev/null || true; }
svc_disable() { systemctl disable --now "$1" 2>/dev/null || true; }
valid_port() { [[ "$1" =~ ^[0-9]+$ ]] && (( 1 <= 10#$1 && 10#$1 <= 65535 )); }
valid_attempts() { [[ "$1" =~ ^[1-9][0-9]*$ ]] && (( 1 <= 10#$1 && 10#$1 <= 100 )); }
valid_ipv4_cidr() {
    local address prefix octet
    [[ "$1" =~ ^([0-9]{1,3}(\.[0-9]{1,3}){3})(/([0-9]{1,2}))?$ ]] || return 1
    address="${BASH_REMATCH[1]}"
    prefix="${BASH_REMATCH[5]:-32}"
    (( prefix <= 32 )) || return 1
    IFS=. read -r -a octets <<< "$address"
    for octet in "${octets[@]}"; do (( octet <= 255 )) || return 1; done
}
validate_ssh_config() {
    command -v sshd >/dev/null 2>&1 || die 'sshd is required to validate SSH configuration.'
    sshd -t -f "$1" || die 'SSH configuration is invalid; firewall was not changed.'
}
ssh_service() { systemctl cat ssh.service >/dev/null 2>&1 && printf '%s' ssh || printf '%s' sshd; }

[[ $EUID -eq 0 ]] || die 'Run this script as root.'
command -v curl >/dev/null 2>&1 || die 'curl is required.'
command -v python3 >/dev/null 2>&1 || die 'python3 is required.'

detect_os

printf '%s\n' '============================================'
printf '  Dedicated Server Firewall Hardening'
printf '%s\n' '============================================'
printf 'Detected OS: %s %s\n' "$OS_ID" "$OS_VERSION"
printf '\n'

# --- Step 1: Install firewall packages ---
printf '%s\n' '--- Step 1: Install firewall packages ---'
if is_debian_family; then
    pkg_install iptables ipset iptables-persistent
else
    pkg_install iptables ipset ipset-service
fi
if is_rhel_family; then
    pkg_install iptables-services
fi

# --- Step 2: Download ipsum blocklist ---
printf '\n--- Step 2: Ipsum scanner blocklist ---\n'
IPSUM_DIR="/etc/ipsum"
install -d -m 755 "$IPSUM_DIR"

IPSUM_SOURCE="$(ask 'Ipsum blocklist source' 'https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt')"
IPSUM_AUTO_UPDATE="$(ask 'Auto-update ipsum blocklist daily? 1 or 0' '1')"

printf 'Downloading ipsum blocklist...\n'
curl -fsSL "$IPSUM_SOURCE" -o "$IPSUM_DIR/ipsum.txt" || die 'Failed to download ipsum blocklist.'

IPSET_COUNT="$(wc -l < "$IPSUM_DIR/ipsum.txt" | tr -d ' ')"
printf 'Downloaded %s IP entries from ipsum.\n' "$IPSET_COUNT"

# --- Step 3: Configure allowed ports and IPs ---
printf '\n--- Step 3: Allowed ports and IPs ---\n'
printf 'Choose a port preset or add custom ports.\n'
printf '\nAvailable presets:\n'
printf '  1) Basic web (80, 443)\n'
printf '  2) Game servers (Minecraft 25565, Valheim 2456-2458, ARK 27015, Rust 28015, Source 27005-27020, DayZ 2302, 7D2D 26900-26903, Factorio 34197, Satisfactory 15777, Project Zomboid 16261-16262, FiveM 30120)\n'
printf '  3) Voice (TeamSpeak 9987/30033/10011, Mumble 64738)\n'
printf '  4) All of the above\n'
printf '  5) Custom (select ports manually)\n'

PRESET="$(ask 'Select preset (1-5)' '5')"
case "$PRESET" in
    1) ALLOWED_PORTS=(22 80 443) ;;
    2) ALLOWED_PORTS=(22 25565 2456 2457 2458 27015 28015 27005 27006 27016 27017 27018 27019 27020 2302 26900 26901 26902 26903 34197 15777 15800 15778 16261 16262 30120) ;;
    3) ALLOWED_PORTS=(22 9987 30033 10011 64738) ;;
    4) ALLOWED_PORTS=(22 80 443 25565 2456 2457 2458 27015 28015 27005 27006 27016 27017 27018 27019 27020 2302 26900 26901 26902 26903 34197 15777 15800 15778 16261 16262 30120 9987 30033 10011 64738) ;;
    5)
        ALLOWED_PORTS=(22)
        while :; do
            PORT="$(ask 'Port to open (or blank to finish)' '')"
            [[ -z "$PORT" ]] && break
            if valid_port "$PORT"; then
                if [[ "$PORT" == "22" ]]; then
                    printf 'Port 22 (SSH) is already included by default.\n'
                else
                    ALLOWED_PORTS+=("$PORT")
                    printf 'Added port %s\n' "$PORT"
                fi
            else
                printf 'Invalid port number: %s\n' "$PORT" >&2
            fi
        done
        ;;
    *) die 'Invalid preset selected.' ;;
esac

if [[ ${#ALLOWED_PORTS[@]} -eq 0 ]]; then
    die 'No ports defined. At minimum you need SSH (22) open.'
fi

printf '\nFor each port, specify source IPs that are allowed.\n'
printf 'Enter IPs one per line (CIDR allowed, e.g. 1.2.3.4/32). Enter blank line when done.\n'

declare -A PORT_IPS
for PORT in "${ALLOWED_PORTS[@]}"; do
    printf '\nSource IPs for port %s (blank when done):\n' "$PORT"
    PORT_IPS["$PORT"]=""
    while :; do
        IP="$(ask "IP for port $PORT (or blank to finish)" '')"
        [[ -z "$IP" ]] && break
        if valid_ipv4_cidr "$IP"; then
            if [[ -n "${PORT_IPS[$PORT]}" ]]; then
                PORT_IPS["$PORT"]="${PORT_IPS[$PORT]},$IP"
            else
                PORT_IPS["$PORT"]="$IP"
            fi
            printf 'Added %s for port %s\n' "$IP" "$PORT"
        else
            printf 'Invalid IP/CIDR: %s\n' "$IP" >&2
        fi
    done
    if [[ -z "${PORT_IPS[$PORT]}" ]]; then
        printf 'WARNING: Port %s has no allowed IPs - it will be open to all.\n' "$PORT"
    fi
done

# --- Step 4: SSH configuration ---
printf '\n--- Step 4: SSH configuration ---\n'
SSH_PORT="$(ask 'SSH port' '22')"
MAX_AUTH_TRIES="$(ask 'Max SSH authentication attempts' '3')"
valid_port "$SSH_PORT" || die 'SSH port must be an integer from 1 to 65535.'
valid_attempts "$MAX_AUTH_TRIES" || die 'Max SSH authentication attempts must be an integer from 1 to 100.'

# Remove port 22 from allowed ports if SSH is on a different port
if [[ "$SSH_PORT" != "22" ]]; then
    NEW_PORTS=()
    for P in "${ALLOWED_PORTS[@]}"; do
        [[ "$P" != "22" ]] && NEW_PORTS+=("$P")
    done
    ALLOWED_PORTS=("${NEW_PORTS[@]}")
fi

SSH_ALLOW_IPS="${PORT_IPS[$SSH_PORT]:-}"
if [[ -z "$SSH_ALLOW_IPS" ]]; then
    SSH_ALLOW_IPS="$(ask 'SSH allowed source IPs (comma-separated, or blank for any)' '')"
fi
if [[ -n "$SSH_ALLOW_IPS" ]]; then
    IFS=',' read -ra SSH_IP_LIST <<< "$SSH_ALLOW_IPS"
    for SSH_IP in "${SSH_IP_LIST[@]}"; do
        SSH_IP="${SSH_IP//[[:space:]]/}"
        valid_ipv4_cidr "$SSH_IP" || die "Invalid SSH source IP/CIDR: $SSH_IP"
    done
fi

if [[ -r /proc/sys/net/ipv6/conf/all/disable_ipv6 ]] && [[ "$(< /proc/sys/net/ipv6/conf/all/disable_ipv6)" != 1 ]]; then
    die 'IPv6 is enabled, but this script only configures IPv4. Disable IPv6 or use an IPv6-aware firewall before continuing.'
fi

# Validate the prospective SSH configuration before the destructive firewall flush.
SSHD_CONFIG="/etc/ssh/sshd_config"
[[ -f "$SSHD_CONFIG" ]] || die "${SSHD_CONFIG} not found; refusing to change firewall."
SSHD_CONFIG_PREVIEW="$(mktemp)"
trap 'rm -f "$SSHD_CONFIG_PREVIEW"' EXIT
cp -a "$SSHD_CONFIG" "$SSHD_CONFIG_PREVIEW"
sed -i "s/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/; s/^#\?PasswordAuthentication.*/PasswordAuthentication no/; s/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/; s/^#\?MaxAuthTries.*/MaxAuthTries $MAX_AUTH_TRIES/; s/^#\?Port.*/Port $SSH_PORT/; s/^#\?AuthenticationMethods.*/AuthenticationMethods publickey/" "$SSHD_CONFIG_PREVIEW"
grep -q '^PermitRootLogin' "$SSHD_CONFIG_PREVIEW" || printf '%s\n' 'PermitRootLogin prohibit-password' >> "$SSHD_CONFIG_PREVIEW"
grep -q '^PasswordAuthentication' "$SSHD_CONFIG_PREVIEW" || printf '%s\n' 'PasswordAuthentication no' >> "$SSHD_CONFIG_PREVIEW"
grep -q '^PubkeyAuthentication' "$SSHD_CONFIG_PREVIEW" || printf '%s\n' 'PubkeyAuthentication yes' >> "$SSHD_CONFIG_PREVIEW"
grep -q '^MaxAuthTries' "$SSHD_CONFIG_PREVIEW" || printf '%s\n' "MaxAuthTries $MAX_AUTH_TRIES" >> "$SSHD_CONFIG_PREVIEW"
grep -q '^Port ' "$SSHD_CONFIG_PREVIEW" || printf '%s\n' "Port $SSH_PORT" >> "$SSHD_CONFIG_PREVIEW"
grep -q '^AuthenticationMethods' "$SSHD_CONFIG_PREVIEW" || printf '%s\n' 'AuthenticationMethods publickey' >> "$SSHD_CONFIG_PREVIEW"
validate_ssh_config "$SSHD_CONFIG_PREVIEW"

# Ensure the key that key-only authentication will use exists before changing
# the firewall.
install -d -m 700 /root/.ssh
if [[ ! -f /root/.ssh/id_ed25519 ]]; then
    command -v ssh-keygen >/dev/null 2>&1 || die 'ssh-keygen is required before enabling key-only SSH.'
    ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N '' -C "root@$(hostname)" || die 'Failed to generate the root SSH key; firewall was not changed.'
fi
chmod 600 /root/.ssh/id_ed25519
chmod 644 /root/.ssh/id_ed25519.pub
touch /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
grep -qxF "$(< /root/.ssh/id_ed25519.pub)" /root/.ssh/authorized_keys || cat /root/.ssh/id_ed25519.pub >> /root/.ssh/authorized_keys

# --- Step 5: Apply firewall rules ---
printf '\n--- Step 5: Apply firewall rules ---\n'
read -r -p 'This will flush existing iptables rules and apply new ones. Continue? [y/N]: ' APPLY
[[ "$APPLY" =~ ^[Yy]$ ]] || die 'Aborted by user.'

# Flush existing rules
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X

# Set default policies (deny all)
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established and related connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Create ipsum ipset if it does not exist
if ! ipset list ipsum >/dev/null 2>&1; then
    ipset create ipsum hash:ip family inet hashsize 16384 maxelem 262144 timeout 0
fi

# Populate ipsum ipset from downloaded blocklist
ipset flush ipsum 2>/dev/null || true
while IFS= read -r ip; do
    [[ -z "$ip" ]] && continue
    [[ "$ip" =~ ^# ]] && continue
    valid_ipv4_cidr "$ip" && ipset add ipsum "$ip" 2>/dev/null || true
done < "$IPSUM_DIR/ipsum.txt"
printf 'Loaded %s entries into ipsum ipset.\n' "$(ipset save ipsum | grep -c '^add ipsum ' || true)"

# Apply ipsum blocklist
iptables -A INPUT -m set --match-set ipsum src -j DROP

# Allow SSH
IFS=',' read -ra SSH_IP_LIST <<< "$SSH_ALLOW_IPS"
for SSH_IP in "${SSH_IP_LIST[@]}"; do
    SSH_IP="$(echo "$SSH_IP" | xargs)"
    [[ -z "$SSH_IP" ]] && continue
    iptables -A INPUT -p tcp --dport "$SSH_PORT" -s "$SSH_IP" -j ACCEPT
done
if [[ -z "$SSH_ALLOW_IPS" ]]; then
    iptables -A INPUT -p tcp --dport "$SSH_PORT" -j ACCEPT
fi

# Allow other ports
for PORT in "${ALLOWED_PORTS[@]}"; do
    [[ "$PORT" == "$SSH_PORT" ]] && continue
    IPS="${PORT_IPS[$PORT]:-}"
    if [[ -n "$IPS" ]]; then
        IFS=',' read -ra IP_LIST <<< "$IPS"
        for IP in "${IP_LIST[@]}"; do
            IP="$(echo "$IP" | xargs)"
            iptables -A INPUT -p tcp --dport "$PORT" -s "$IP" -j ACCEPT
        done
    else
        iptables -A INPUT -p tcp --dport "$PORT" -j ACCEPT
    fi
done

# Allow ICMP (ping) with rate limiting
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 10/minute --limit-burst 5 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

# Drop invalid packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# Log dropped packets (rate-limited to avoid log flooding)
iptables -A INPUT -m limit --limit 5/minute --limit-burst 10 -j LOG --log-prefix "FW-DROP: " --log-level 4

printf 'Firewall rules applied.\n'

# --- Step 6: SSH hardening ---
printf '\n--- Step 6: SSH hardening ---\n'
SSHD_CONFIG="/etc/ssh/sshd_config"
if [[ -f "$SSHD_CONFIG" ]]; then
    cp -a "$SSHD_CONFIG" "$SSHD_CONFIG.before-hardening.$(date +%Y%m%d%H%M%S)"

    sed -i "s/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/" "$SSHD_CONFIG"
    sed -i "s/^#\?PasswordAuthentication.*/PasswordAuthentication no/" "$SSHD_CONFIG"
    sed -i "s/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/" "$SSHD_CONFIG"
    sed -i "s/^#\?MaxAuthTries.*/MaxAuthTries $MAX_AUTH_TRIES/" "$SSHD_CONFIG"
    sed -i "s/^#\?Port.*/Port $SSH_PORT/" "$SSHD_CONFIG"
    sed -i "s/^#\?AuthenticationMethods.*/AuthenticationMethods publickey/" "$SSHD_CONFIG"

    grep -q "^PermitRootLogin" "$SSHD_CONFIG" || echo "PermitRootLogin prohibit-password" >> "$SSHD_CONFIG"
    grep -q "^PasswordAuthentication" "$SSHD_CONFIG" || echo "PasswordAuthentication no" >> "$SSHD_CONFIG"
    grep -q "^PubkeyAuthentication" "$SSHD_CONFIG" || echo "PubkeyAuthentication yes" >> "$SSHD_CONFIG"
    grep -q "^MaxAuthTries" "$SSHD_CONFIG" || echo "MaxAuthTries $MAX_AUTH_TRIES" >> "$SSHD_CONFIG"
    grep -q "^Port " "$SSHD_CONFIG" || echo "Port $SSH_PORT" >> "$SSHD_CONFIG"
    grep -q "^AuthenticationMethods" "$SSHD_CONFIG" || echo "AuthenticationMethods publickey" >> "$SSHD_CONFIG"

    printf 'Root public key authorized for key-only SSH:\n'
    cat /root/.ssh/id_ed25519.pub

    validate_ssh_config "$SSHD_CONFIG"
    SSH_SERVICE="$(ssh_service)"
    systemctl enable "$SSH_SERVICE" >/dev/null || die 'Failed to enable SSH service.'
    systemctl restart "$SSH_SERVICE" || die 'Failed to restart SSH service; review configuration before relying on remote access.'
    printf 'SSH configuration hardened: key-only auth; root password login prohibited.\n'
else
    printf 'WARNING: %s not found. SSH hardening skipped.\n' "$SSHD_CONFIG"
fi

# --- Step 7: Save rules persistently ---
printf '\n--- Step 7: Persist firewall rules ---\n'

if is_debian_family; then
    install -d -m 755 /etc/iptables
    iptables-save > /etc/iptables/rules.v4
    ipset save > /etc/iptables/ipset.conf
    install -d -m 755 /etc/systemd/system/netfilter-persistent.service.d
    cat >/etc/systemd/system/netfilter-persistent.service.d/ipset.conf <<'UNIT'
[Service]
ExecStartPre=/bin/sh -c 'command -v ipset >/dev/null && ipset restore < /etc/iptables/ipset.conf || true'
UNIT
    systemctl daemon-reload
    svc_enable netfilter-persistent
elif is_rhel_family; then
    service iptables save 2>/dev/null || iptables-save > /etc/sysconfig/iptables
    install -d -m 755 /etc/sysconfig
    ipset save > /etc/sysconfig/ipset
    svc_enable ipset
    svc_enable iptables
fi

# --- Step 8: Setup ipsum auto-update ---
if [[ "$IPSUM_AUTO_UPDATE" == 1 ]]; then
    printf '\n--- Step 8: Ipsum auto-update ---\n'
    cat >/etc/cron.daily/ipsum-update <<'CRON'
#!/bin/bash
curl -fsSL "https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt" -o /etc/ipsum/ipsum.txt.new
if diff -q /etc/ipsum/ipsum.txt /etc/ipsum/ipsum.txt.new >/dev/null 2>&1; then
    rm -f /etc/ipsum/ipsum.txt.new
else
    mv /etc/ipsum/ipsum.txt.new /etc/ipsum/ipsum.txt
    ipset flush ipsum 2>/dev/null || true
    while IFS= read -r ip; do
        [[ -z "$ip" ]] && continue
        [[ "$ip" =~ ^# ]] && continue
        [[ "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/[0-9]+)?$ ]] && ipset add ipsum "$ip" 2>/dev/null || true
    done < /etc/ipsum/ipsum.txt
fi
CRON
    chmod 755 /etc/cron.daily/ipsum-update
    printf 'Ipsum auto-update configured (daily cron).\n'
fi

# --- Step 9: Additional hardening ---
printf '\n--- Step 9: Additional hardening ---\n'

# Disable unused kernel modules (prevent loading)
cat > /etc/modprobe.d/disable-unused.conf <<'EOF'
install cramfs /bin/false
install freevxfs /bin/false
install jffs2 /bin/false
install hfs /bin/false
install hfsplus /bin/false
install squashfs /bin/false
install udf /bin/false
install dccp /bin/false
install sctp /bin/false
install rds /bin/false
install tipc /bin/false
install net-pf-31 /bin/false
install bluetooth /bin/false
install infrared-l2 /bin/false
install ircomm-tty /bin/false
install irda /bin/false
install nfc /bin/false
install joydev /bin/false
install pcspkr /bin/false
install soundcore /bin/false
EOF

# Enable reverse path filtering
cat > /etc/sysctl.d/99-firewall-hardening.conf <<'EOF'
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.all.secure_redirects=0
net.ipv4.conf.default.secure_redirects=0
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_rfc1337=1
net.ipv4.ip_forward=0
net.ipv4.conf.all.forwarding=0
net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.default.accept_redirects=0
net.ipv6.conf.all.accept_source_route=0
net.ipv6.conf.default.accept_source_route=0
EOF
sysctl --system 2>/dev/null || true

# --- Step 10: Summary ---
printf '\n============================================\n'
printf '  Firewall Hardening Complete\n'
printf '============================================\n'
printf '\n'
printf 'Firewall rules:\n'
iptables -L -n -v | grep -E 'Chain|DROP|ACCEPT' | head -20
printf '\n'
printf 'Ipsum blocklist entries: %s\n' "$(ipset save ipsum 2>/dev/null | grep -c '^add ipsum ' || true)"
printf 'SSH hardening:           key-only auth, root password login prohibited, max tries %s\n' "$MAX_AUTH_TRIES"
printf 'Ipsum auto-update:       %s\n' "$IPSUM_AUTO_UPDATE"
printf '\n'
printf 'IPset save location:     /etc/iptables/ipset.conf\n'
printf 'Ipsum blocklist:         %s/ipsum.txt\n' "$IPSUM_DIR"
printf 'Sysctl hardening:        /etc/sysctl.d/99-firewall-hardening.conf\n'
printf 'Disabled kernel modules: /etc/modprobe.d/disable-unused.conf\n'
printf '\n'
printf 'To inspect current rules: iptables -L -n -v\n'
printf 'To test SSH connectivity: ssh -p %s user@<server>\n' "$SSH_PORT"
printf '\n'
printf 'WARNING: Ensure you have a backup access method before locking yourself out.\n'