@@ -0,0 +1,163 @@
#! /bin/bash
clear
clear
echo ' #'
echo ' # CentOS 6.3 LAMP Server Provisioning Script'
echo ' #'
echo ' # This script will guide you through the initial server provisioning for a standard CentOS 6.3 LAMP server.'
echo ' #'
echo ' # [x] iptables lockdown'
echo ' # [x] Change root password'
echo ' # [x] Add administrators group'
echo ' # [x] Add administrators group to sudoers'
echo ' # [x] Add admin user'
echo ' # [x] Disable root remote login'
echo ' # [x] Install common packages'
echo ' # [x] Update server'
echo ' # [ ] Configure SSH Keys and restrict SSH logins by key only'
echo ' # [ ] Configure MySQL'
echo ' # [ ] Configure Apache'
echo ' # [ ] Configure PHP'
echo ' # [ ] Configure git'
echo ' # [ ] Configure vimrc options'
echo ' #'
echo ' # @author brockhensley'
echo ' # @version 1.0.1'
echo ' # @date Last updated April 6th 2013'
echo ' # @link brockhensley.com'
echo ' #'
read -p " Press any key to begin provisioning or [CTRL]+[C] to quit."
clear
echo ' # iptables lockdown'
iptables -L -v -n
iptables -P INPUT ACCEPT
iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -L -v -n
/sbin/service iptables save
/sbin/service iptables restart
echo ' # Change root password'
echo ' Enter new password: '
passwd
echo ' # Add administrators group'
echo -n " Enter name for administrators group (Default: admins): "
read -e ADMINSGROUP
if [ -z " $ADMINSGROUP "
then
$ADMINSGROUP = ' admins'
fi
groupadd $ADMINSGROUP
echo ' # Add administrators group to sudoers'
tstmp=$( date +%F-%H-%M-%S )
cp /etc/sudoers /etc/sudoers.$tstmp .bak
echo " %$ADMINSGROUP ALL = (ALL) ALL" >> /etc/sudoers
echo ' # Add admin user'
echo -n " Enter name for administrator user: "
read -e ADMINUSER
useradd $ADMINUSER -G $ADMINSGROUP
echo -n " Enter new password for $ADMINUSER : "
passwd $ADMINUSER
echo ' # Disable root remote login'
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$tstmp .bak
sed -i ' s/# PermitRootLogin/PermitRootLogin/g'
sed -i ' s/PermitRootLogin yes/PermitRootLogin no/g'
echo " AllowGroups $ADMINGROUP " >> /etc/ssh/sshd_config
echo ' # Change SSH port'
echo -n ' Enter new SSH port: '
read -e SSHPORT
sed -i " s/Port 22/Port $SSHPORT /g"
/etc/init.d/sshd restart
echo ' # Install common packages'
sudo yum install -y wget telnet tar sudo perl python iptables man openssh openssl
echo ' # Update server'
sudo yum update
echo " # You will need to exit from SSH and log back into SSH (remember port $SSHPORT ) as the admin ($ADMINUSER ) from this point on"
echo ' # When you return, execute the script with the argument ADMIN to skip the completed steps'
echo ' # Example: provision_centos_server.sh ADMIN'
exit
# SSH server force SSH keys only
# (on workstation)
ssh-keygen -b 4096 -t rsa -f ~ /.ssh/id_rsa
ssh-copy-id -i ~ /.ssh/id_rsa.pub $ADMINUSER @< YOUR_SERVER_IP>
ssh-add
# (may need to logoff/logon workstation if get Agent sign error)
# (on server)
chown -R $ADMINUSER :$ADMINUSER ~ /.ssh
chmod 700 ~ /.ssh
chmod 600 ~ /.ssh/authorized_keys
restorecon -Rv ~ /.ssh
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$tstmp .bak
sudo sed -i ' s/PasswordAuthentication yes/PasswordAuthentication no/g'
# MySQL
sudo yum install -y mysql-server
sudo cp /etc/my.cnf /etc/my.cnf.$tstmp .bak
echo -n " Enter new MySQL port: "
read -e MYSQLPORT
sudo sed -i " s/port=3306/port=$MYSQLPORT /g"
sudo service mysqld restart
sudo /usr/bin/mysql_secure_installation
# Apache
sudo yum install -y httpd
sudo vi /etc/httpd/conf/httpd.conf
ServerName 127.0.0.1:80
sudo vi /etc/httpd/conf.d/vhosts.conf
NameVirtualHost * :80
< VirtualHost * :80>
ServerAdmin [email protected]
DocumentRoot /var/www/vhosts/domain.com/public_html
ServerName www.domain.com
ServerAlias domain.com
ErrorLog /var/www/vhosts/domain.com/logs/error_log
CustomLog /var/www/vhosts/domain.com/logs/access_log common
< Directory /var/www/vhosts/domain.com>
Options All
AllowOverride All
< /Directory>
< /VirtualHost>
# PHP
# lynx http://mirror.pnl.gov/epel/6/i386/repoview/epel-release.html
wget http://mirror.pnl.gov/epel/6/i386/epel-release-6-8.noarch.rpm
sudo rpm -Uvh epel-release-6-8.noarch.rpm
sudo yum install -y php php-common php-cli php-gd php-mbstring php-mcrypt php-mysql php-pdo php-pear php-pecl-apc php-pecl-xdebug php-soap php-tidy php-xml php-xmlrpc
sudo echo " xdebug.var_display_max_children=-1" >> /etc/php.d/xdebug.ini
sudo echo " xdebug.var_display_max_data=-1" >> /etc/php.d/xdebug.ini
sudo echo " xdebug.var_display_max_depth=-1" >> /etc/php.d/xdebug.ini
# git
sudo yum install -y git
cd /var/www/vhosts
git clone [email protected] :x/y.git
sudo usermod -a -G apache $ADMINUSER
sudo usermod -a -G $ADMINUSER apache
# logoff/logon
echo " umask 007" >> /etc/sysconfig/httpd
sudo chgrp -R $ADMINUSER /var/www/vhosts/domain.com
sudo chmod 2770 /var/www/vhosts/domain.com
# vimrc options
wget https://gist.github.com/dirte/5245083/raw/eed54c62294ee996816ac0481d03b7537f8bec35/.vimrc
# bash options
# alias
flacodirt revised this gist