unitoo/configurations
1
0
Fork 2
Code Issues 3 Pull requests Projects Releases Packages Wiki Activity

Merge pull request 'merge master' (#1) from Unitoo/dot-files:master into master

Browse source 
Reviewed-on: https://gitea.it/claudiomaradonna/dot-files/pulls/1
This commit is contained in:
Claudio Maradonna 2022-04-24 11:28:31 +02:00
commit 58512ac416
5 changed files with 10962 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
etc/systemd/system/certbot-renewal.service Normal file
View file

@ -0,0 +1,6 @@
[Unit]
Description=Automatically renews SSL certificates obtained with certbot
[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew -q --post-hook /usr/local/bin/certbot-restart-nginx

10
etc/systemd/system/certbot-renewal.timer Normal file
View file

@ -0,0 +1,10 @@
[Unit]
Description=This is the timer schedule Automatic renewals of SSL certificates obtained with certbot
[Timer]
OnCalendar=daily
RandomizedDelaySec=6hours
Persistent=true
[Install]
WantedBy=timers.target

10892
grafana/dashboards/synapse.json Normal file
View file

File diff suppressed because it is too large Load diff

73
ssh/etc/ssh/sshd_config
View file

@ -1,27 +1,52 @@
HostKey /etc/ssh/ssh_host_rsa_key Protocol 2 # Protocol 1 is fundamentally broken
HostKey /etc/ssh/ssh_host_ecdsa_key StrictModes yes # Protects from misconfiguration
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTHPRIV #ListenAddress [ip-here] # Listening address
Port 22 # Listening port. Normal 22
AllowGroups sshlogin AuthenticationMethods publickey # Only public key authentication allowed
PermitRootLogin WITHOUT-PASSWORD
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys
IgnoreRhosts yes PubkeyAuthentication yes # Allow public key authentication
MaxSessions 4 HostKey /etc/ssh/ssh_host_ed25519_key # Only allow ECDSA pubic key authentication
MaxAuthTries 4 HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519 # Host keys the client should accepts
ClientAliveCountMax 2 KexAlgorithms curve25519-sha256 # Specifies the available KEX (Key Exchange) algorithms
LogLevel VERBOSE Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com # Specifies the ciphers allowed
PasswordAuthentication no MACs hmac-sha2-512-etm@openssh.com # Specifies the available MAC alg.
ChallengeResponseAuthentication no
GSSAPIAuthentication no #Only allow incoming ECDSA and ed25519 sessions:
UsePAM yes HostbasedAcceptedKeyTypes ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
PrintMotd no PubkeyAcceptedKeyTypes sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,ssh-ed25519
X11Forwarding no #CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT PermitRootLogin WITHOUT-PASSWORD # Enable/disable root login
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE #AllowUsers [username] # Authorized SSH users are inside the admin group
AcceptEnv XMODIFIERS MaxAuthTries 5 # Maximum allowed authentication attempts
Subsystem sftp /usr/lib/openssh/sftp-server MaxSessions 2 # Maximum allowed sessions by the user
PasswordAuthentication no # No username password authentication
PermitEmptyPasswords no # No empty password authentcation allowed
IgnoreRhosts yes # Dont read users rhost files
HostbasedAuthentication no # Disable host-based authentication
ChallengeResponseAuthentication no # Unused authentication scheme
X11Forwarding no # Disable X11 forwarding
LogLevel VERBOSE # Fingerprint details of failed login attempts
SyslogFacility AUTH # Logging authentication and authorization related commands
UseDNS no # Client from a location without proper DNS generate a warning in the logs
PermitTunnel no # Only SSH connection and nothing else
AllowTcpForwarding no # Disablow tunneling out via SSH
AllowStreamLocalForwarding no # Disablow tunneling out via SSH
GatewayPorts no # Disablow tunneling out via SSH
AllowAgentForwarding no # Do not allow agent forwarding
#Banner /etc/issue.net # Show legal login banner
PrintLastLog yes # Show last login
ClientAliveInterval 900 # Client timeout (15 minutes)
ClientAliveCountMax 0 # This way enforces timeouts on the server side
LoginGraceTime 30 # Authenticatin must happen within 30 seconds
MaxStartups 2 # Max concurrent SSH sessions
TCPKeepAlive yes # Do not use TCP keep-alive
AcceptEnv LANG LC_* # Allow client to pass locale environment variables

5
usr/local/bin/certbot-restart-nginx Normal file
View file

@ -0,0 +1,5 @@
#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
nginx -tq && systemctl restart nginx