<commit_before>#!/bin/bash

# To download and run
# wget https://raw.githubusercontent.com/masline/scripts/master/root.sh && bash root.sh

# Setup persistent iptables to survive reboot
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
aptitude -R install -y -q iptables-persistent > /dev/null 2>&1

# Firewall rules
# First run, iptables should be clean, but Flush all rules anyway
iptables -F
iptables -X

# Running this first so I don't get kicked off from SSH
# Accepts all established inbound/outbound connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow connections only from business IP
iptables -I INPUT -s 172.16.17.32 -j ACCEPT

# Set default policy to DROP all packets
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allows all outbound traffic
iptables -A OUTPUT -j ACCEPT

# iptables-persistent takes the work out of maintaining the firewall
# between resets. Performing a save command will save these commands
# for all resets
invoke-rc.d iptables-persistent save > /dev/null 2>&1

############################
# Create users with SSH keys
############################
for user in $(curl -s https://raw.githubusercontent.com/masline/scripts/master/users); do
	# Add user
	useradd --create-home --groups sudo $user
	# Create .ssh directory and files for key-based authentication
	mkdir /home/$user/.ssh
	touch /home/$user/.ssh/authorized_keys
	# Fill in `authorized_keys` with users public key
	echo $(curl -s https://raw.githubusercontent.com/masline/scripts/master/$user.pub) > /home/$user/.ssh/authorized_keys
	# Take care of ownership and permissions for the specific user
	chmod 700 /home/$user/.ssh
	chmod 400 /home/$user/.ssh/authorized_keys
	chown $user:$user /home/$user/.ssh
	chown $user:$user /home/$user/.ssh/authorized_keys
	chattr +i /home/$user/.ssh/authorized_keys
	chattr +i /home/$user/.ssh
done

# /bin/sh sucks, replace all instances in /etc/passwd with /bin/bash
sed -i 's:/bin/sh:/bin/bash:' /etc/passwd

# Remove ! from /etc/shadow to allow local user to change password
sed -i 's/:!:/::/' /etc/shadow<commit_msg>Added users to `user` group<commit_after>#!/bin/bash

# To download and run
# wget https://raw.githubusercontent.com/masline/scripts/master/root.sh && bash root.sh

# Setup persistent iptables to survive reboot
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
aptitude -R install -y -q iptables-persistent > /dev/null 2>&1

# Firewall rules
# First run, iptables should be clean, but Flush all rules anyway
iptables -F
iptables -X

# Running this first so I don't get kicked off from SSH
# Accepts all established inbound/outbound connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow connections only from business IP
iptables -I INPUT -s 172.16.17.32 -j ACCEPT

# Set default policy to DROP all packets
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allows all outbound traffic
iptables -A OUTPUT -j ACCEPT

# iptables-persistent takes the work out of maintaining the firewall
# between resets. Performing a save command will save these commands
# for all resets
invoke-rc.d iptables-persistent save > /dev/null 2>&1

############################
# Create users with SSH keys
############################
for user in $(curl -s https://raw.githubusercontent.com/masline/scripts/master/users); do
	# Add user
	useradd --create-home --groups sudo,user $user
	# Create .ssh directory and files for key-based authentication
	mkdir /home/$user/.ssh
	touch /home/$user/.ssh/authorized_keys
	# Fill in `authorized_keys` with users public key
	echo $(curl -s https://raw.githubusercontent.com/masline/scripts/master/$user.pub) > /home/$user/.ssh/authorized_keys
	# Take care of ownership and permissions for the specific user
	chmod 700 /home/$user/.ssh
	chmod 400 /home/$user/.ssh/authorized_keys
	chown $user:$user /home/$user/.ssh
	chown $user:$user /home/$user/.ssh/authorized_keys
	chattr +i /home/$user/.ssh/authorized_keys
	chattr +i /home/$user/.ssh
done

# /bin/sh sucks, replace all instances in /etc/passwd with /bin/bash
sed -i 's:/bin/sh:/bin/bash:' /etc/passwd

# Remove ! from /etc/shadow to allow local user to change password
sed -i 's/:!:/::/' /etc/shadow
{'fraction_non_alphanumeric': 0.12602436323366556, 'fraction_numerical': 0.009302325581395349, 'mean_word_length': 4.114382785956965, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 13, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4947530', 'n_tokens_mistral': 1507, 'n_tokens_neox': 1422, 'n_words': 491}