From 6e7d4f99bce53eb53712bace02d1358e09f369de Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Mon, 31 Jul 2023 18:15:26 +0200
Subject: [PATCH] Added cloud config for basic SSH hardening

---
 cloud-init-scripts/basic-ssh-hardening.yaml | 27 +++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 cloud-init-scripts/basic-ssh-hardening.yaml

diff --git a/cloud-init-scripts/basic-ssh-hardening.yaml b/cloud-init-scripts/basic-ssh-hardening.yaml
new file mode 100644
index 0000000..c2c51f5
--- /dev/null
+++ b/cloud-init-scripts/basic-ssh-hardening.yaml
@@ -0,0 +1,27 @@
+#cloud-config
+users:
+  - name: holu
+    groups: users, admin
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - <public_ssh_key>
+packages:
+  - fail2ban
+  - ufw
+package_update: true
+package_upgrade: true
+runcmd:
+  - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
+  - systemctl enable fail2ban
+  - ufw allow OpenSSH
+  - ufw enable
+  - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
+  - sed -i '$a AllowUsers holu' /etc/ssh/sshd_config
+  - reboot
\ No newline at end of file