#!/bin/bash
CONFG_FILE="/etc/ssh/sshd_config"

# check run as sudo
if [ "$(id -u)" != "0" ]; then
    echo "[!] : This script must be run as root" 1>&2
    exit 1
# check whether OS is based on ubuntu or not
if [ "$(lsb_release -i | cut -d: -f2 | sed s/'^\t'//)" != "ubuntu" ];then
    echo "[!] : This script service only offers to ubuntu based system" 1>&2
    exit 1
fi
# update system
echo "[*] : update system" 1>&2
apt-get update;apt-get upgrade -y;apt-get autoremove -y;apt-get autoclean

# install packages
echo "[*] : install packages" 1>&2
apt-get install gawk iptables-persistent vim iftop fail2ban openssl lshell

# disable lightdm
if [ "$DESKTOP_SESSION" == "lightdm-xsession" ];then
	systemctl disable lightdm.service
	echo "[+] disable lightdm session" 1>&2
fi

# setting up firewall
echo "[*] : setting up firewall policy" 1>&2
iptables-save > iptable_update.rules
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT  -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables-save > iptable_normal.rules
echo "alias updatemode='sudo iptables-restore < ~/iptable_update.rules' " >> ~/.bashrc
echo "alias protectmode='sudo iptables-restore < ~/iptable_normal.rules'" >> ~/.bashrc
echo "[+] : firewall policy setting finished." 1>&2

source ~/.bashrc
updatemode
echo "[*] : Installing shellinabox..." 1>&2
apt-get install shellinabox
protectmode
iptables -A INPUT  -p tcp --dport 4200 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 4200 -m state --state ESTABLISHED -j ACCEPT
iptables-save > iptable_firefoxmode.rules
echo "alias firefoxmode='sudo iptables-restore < ~/iptable_firefoxmode.rules'" >> ~/.bashrc
source ~/.bashrc
firefoxmode
netfilter-persistent save
service ipstables restart

# setting up ssh policy
echo "[*] : setting up openssh policy" 1>&2
sed -i s/'PermitRootLogin yes/PermitRootLogin no'/g $CONFG_FILE
sed -i s/'ServerKeyBits 1024/ServerKeyBits 4096'/g $CONFG_FILE
sed -i s/'LoginGraceTime 120/LoginGraceTime 30'/g $CONFG_FILE
sed -i s/'X11Forwarding yes/X11Forwarding no'/g $CONFG_FILE
sed -i s/'TCPKeepAlive yes/TCPKeepAlive no'/g $CONFG_FILE
sed -i s/'TCPKeepAlive yes/TCPKeepAlive no'/g $CONFG_FILE

if [ grep -q "ClientAliveInterval" $CONFG_FILE && echo $? != 0 ];then
	echo "ClientAliveInterval 300" >> $CONFG_FILE
else
	sed -i s/'ClientAliveInterval 300/ClientAliveInterval 30'/g $CONFG_FILE
fi

gawk -i inplace '{gsub("/usr/lib/openssh/sftp-server,"internal-sftp",$3);print}' $CONFG_FILE
echo "[+] : openssh policy setting has done. & restated ssh service" 1>&2

# network policy setting up
echo "[*] : setting up network policy" 1>&2
echo "
# IP Spoofing protection

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_echo_ignore_all = 1
" >>  /etc/sysctl.conf
sysctl -p
echo "[+] : netowork policy setting finished." 1>&2
echo "[*] : Finished initial setting for NAS system" 1>&2

# install webmin
read -p "[*] : Do you want to use webmin panel? [y/n]" yn
case $yn in
	[Yy]* )
		updatemode
		echo 'deb http://download.webmin.com/download/repository sarge contrib' >> /etc/apt/sources.list
		wget http://www.webmin.com/jcameron-key.asc
		apt-key add jcameron-key.asc
		apt-get update
		apt-get install webmin
		firefoxmode
		iptables -A INPUT  -p tcp --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -p tcp --sport 10000 -m state --state ESTABLISHED -j ACCEPT
		iptables-save > iptable_firefoxmode.rules
		service ipstables restart
		service webmin start
		echo "[+] : open webmin server. You can connect with https://$(hostname -I):10000 on your browser." 1>&2
	fi;;
	* )
		echo "Canceled." 1>&2
	;;
esac

# create sftp user account
read -p "[*] : Do you want to create a new SFTP user? [y/n]" yn
case $yn in
	[Yy]* )
		read -p 'Enter the new user name: ' USERNAME
		useradd -m $USERNAME
		passwd $USERNAME
		echo "
			Match User $USERNAME
				ChrootDirectory /home/$USERNAME
				ForceCommand internal-sftp
				x11Forwarding no
			" >> $CONFG_FILE
		chown root:$USERNAME /home/$USERNAME
		chmod 755 /home/$USERNAME
		mkdir /home/$USERNAME/workspace
		chown $USERNAME:$USERNAME/home/$USERNAME/workspace
		chmod 775 /home/$USERNAME/workspace
		echo "[+] : created a sftp login account" 1>&2
	fi;;
    * ) 
    	echo "Canceled."
    	;;
esac

# Transmission Setting
read -p "[*] : Do you want to use transmission service? [y/n]" yn
case $yn in
	[Yy]* )
		iptables -A INPUT  -p tcp --dport 6800 -j ACCEPT
		iptables -A INPUT  -p tcp --dport 6800 -j ACCEPT
		iptables-save > iptable_torrent.rules
		echo "alias torrentmode='sudo iptables-restore < ~/iptable_torrent.rules'" >> ~/.bashrc
		source ~/.bashrc
		updatemode
		apt install transmission-daemon
		torrentmode
		read -p 'Enter the new user name: ' USERNAME
		read -ps 'Enter the new password: ' PASSWORD
		read -p 'Enter the download path: ' DOWNLOAD
		transmission-daemon -u $USERNAME -v $PASSWORD -p 6800 -w $DOWNLOAD
		service transmission-daemon stop
		sed -i s/'"rpc-enabled": false/"rpc-enabled": true'/g  /etc/transmission-daemon/settings.json
		sed -i s/'"rpc-whitelist-enabled": true/"rpc-whitelist-enabled": false'/g  /etc/transmission-daemon/settings.json
		
		service ipstables restart
		service transmission-daemon start
		echo "[+] : open transmission server. You can connect with http://$(hostname -I):6800 on your browser." 1>&2
	fi;;
	* )
		echo "Canceled." 1>&2
	;;
esac

echo "[!] : Job finished. You probably need to do custom setting fail2ban and lshell. Your system needs to reboot.
and you can connect with https://$(hostname -I):4200 on your browser." 1>&2
netfilter-persistent save
service ssh restart
exit 0