Linux Automation

Setup a proxy server for apt

echo 'Acquire::http::Proxy "http://myserver.com.com:port";' > /etc/apt/apt.conf

• General Test

curl http://microsoft.com --proxy myserver.com.com:port

Update using apt

• Possible commands

apt-get -y upgrade 

apt-get -y  upgrade; logger "APT has been applied"

unattended-upgrade --dry-run -d

Create crontab automatically

~# echo 'MAILTO=""' > mycron
~# echo "00 05 * * * apt-get update && apt-get -y upgrade | logger 
~# sudo crontab mycron
~# rm mycron

Users and Groups

Configure sudo to gain root privileges for users

• /etc/sudoers (use visudo -f)

root    ALL=(ALL:ALL) ALL

• Add user joe to sudo

usermod -a -G sudo joe

• Add a system user (no shell)

useradd -M systemuser

• Prevent login

usermod -L systemuser

Clear History at logout

echo "history -c" | sudo tee /etc/bash.bash_logout

Time

• Configure /etc/systemd/timesyncd.conf

[Time]
NTP=ntp1.service.domain.com
FallbackNTP=ntp2.service.domain.com
RootDistanceMaxSec=5
PollIntervalMinSec=32
PollIntervalMaxSec=2048

• OR

NTP1='ntp1.service.domain.com'
NTP2='ntp2.service.domain.com'

echo "
[Time]
NTP=$NTP1
FallbackNTP=$NTP2
RootDistanceMaxSec=5
PollIntervalMinSec=32
PollIntervalMaxSec=2048" >> /etc/systemd/timesyncd.conf

• Status:

~# timedatectl status

• Reload

~# systemctl restart systemd-timesyncd

World writeable files

• Find

df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002

• Find and reset

mapfile -t ww_array < <(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002)
for i in "${my_array[@]}"
do
 echo "Reset World Writeble File: " $i
 chmod o-w $i
done
ww_array=()

Unattended Splunk Forwarder Install

See this: https://docs.splunk.com/Documentation/Splunk/7.1.0/Security/Secureyouradminaccount

• Get Binary

wget -q https://coolscript.org/download/splunk/splunkforwarder-8.1.0-f57c09e87251-linux-2.6-amd64.deb -O /tmp/splunkforwarder-8.1.0-f57c09e87251-linux-2.6-amd64.deb

• Install

dpkg -i /tmp/splunkforwarder-8.1.0-f57c09e87251-linux-2.6-amd64.deb

• Get the seed config

wget -q https://coolscript.org/download/splunk/user-seed.conf -O /opt/splunkforwarder/etc/system/local/user-seed.conf

• Start unattended the very first time

/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt 

• OR

/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt --gen-and-print-passwd

• Autostart at boot

/opt/splunkforwarder/bin/splunk enable boot-start

• OR see https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/RunSplunkassystemdservice

Add Splunk Receiver

• Edit /opt/splunkforwarder/etc/system/local/outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = x.x.x.x:9997

[tcpout-server://x.x.x.x:9997]

Include Auditd into splunk

• Install auditd

~# apt-get install auditd audispd-plugins

• Include into the Splunk Forwarder in /opt/splunkforwarder/etc/system/local/inputs.conf

[monitor://$SPLUNK_HOME//var/log/audit/audit.log]
index = _internal