🔒 Scripts Sécurité — Audit — Scripts prêts à l'emploi

#!/bin/bash
# ─── Variables à modifier ───────────────────────────
NOUVEAU_PORT=2222         # Nouveau port SSH
AUTORISER_USERS="admin technicien"  # Utilisateurs SSH autorisés
MAX_AUTH_TRIES=3
# ────────────────────────────────────────────────────

SSHD_CONFIG="/etc/ssh/sshd_config"
BACKUP="/etc/ssh/sshd_config.backup.$(date +%Y%m%d)"

# Sauvegarde
cp "$SSHD_CONFIG" "$BACKUP"
echo "✅ Backup : $BACKUP"

# Fonction pour modifier ou ajouter un paramètre
set_sshd() {
    local PARAM=$1
    local VALEUR=$2
    if grep -q "^#*${PARAM}" "$SSHD_CONFIG"; then
        sed -i "s|^#*${PARAM}.*|${PARAM} ${VALEUR}|" "$SSHD_CONFIG"
    else
        echo "${PARAM} ${VALEUR}" >> "$SSHD_CONFIG"
    fi
    echo "  ✅ $PARAM $VALEUR"
}

echo "Application du durcissement SSH..."
set_sshd "Port" "$NOUVEAU_PORT"
set_sshd "PermitRootLogin" "no"
set_sshd "PasswordAuthentication" "no"
set_sshd "PermitEmptyPasswords" "no"
set_sshd "MaxAuthTries" "$MAX_AUTH_TRIES"
set_sshd "X11Forwarding" "no"
set_sshd "Protocol" "2"
set_sshd "LoginGraceTime" "30"
set_sshd "ClientAliveInterval" "300"
set_sshd "ClientAliveCountMax" "2"
set_sshd "AllowUsers" "$AUTORISER_USERS"

# Validation de la config avant redémarrage
if sshd -t 2>&1; then
    echo ""
    echo "✅ Configuration valide — redémarrage SSH..."
    systemctl restart ssh
    echo "⚠️  SSH maintenant sur le port $NOUVEAU_PORT"
    echo "⚠️  Ouvrir le port dans le firewall : ufw allow $NOUVEAU_PORT/tcp"
else
    echo "❌ Config invalide — rollback"
    cp "$BACKUP" "$SSHD_CONFIG"
fi

#!/bin/bash
# ─── Variables à modifier ───────────────────────────
EMAIL="admin@monsite.fr"
OUTPUT="/tmp/vuln_report_$(date +%Y%m%d).txt"
# ────────────────────────────────────────────────────

{
echo "=== RAPPORT VULNÉRABILITÉS — $(hostname) — $(date) ==="
echo ""

# Détection de la distribution
if command -v apt &>/dev/null; then
    echo "── Distribution : Debian/Ubuntu ──────────────"
    apt update -qq 2>/dev/null
    echo ""
    echo "Mises à jour de sécurité disponibles :"
    apt list --upgradable 2>/dev/null         | grep -i "security\|CVE"         | awk -F/ '{print "  •", $1}'

    NB_SECU=$(apt list --upgradable 2>/dev/null | grep -ic "security")
    NB_TOTAL=$(apt list --upgradable 2>/dev/null | grep -c "upgradable")
    echo ""
    echo "Total upgradable  : $NB_TOTAL"
    echo "Sécurité urgents  : $NB_SECU"

elif command -v yum &>/dev/null || command -v dnf &>/dev/null; then
    echo "── Distribution : RHEL/CentOS/AlmaLinux ──────"
    PKG=$(command -v dnf 2>/dev/null || command -v yum)
    echo "Mises à jour de sécurité :"
    $PKG check-update --security 2>/dev/null | grep -v "^$\|Loaded\|plugins"

fi

echo ""
echo "── Kernel actuel ────────────────────────────"
uname -r

echo ""
echo "── Derniers packages installés ──────────────"
if command -v dpkg &>/dev/null; then
    zcat /var/log/dpkg.log.* /var/log/dpkg.log 2>/dev/null         | grep "installed" | tail -10
fi

} | tee "$OUTPUT"

echo ""
echo "✅ Rapport : $OUTPUT"
# mail -s "Rapport vulnérabilités $(hostname)" "$EMAIL" < "$OUTPUT"

#!/bin/bash
SCORE=0
TOTAL=0
RAPPORT="/tmp/audit_securite_$(date +%Y%m%d).txt"

check() {
    local MSG=$1
    local CMD=$2
    local EXPECTED=$3
    TOTAL=$((TOTAL+1))
    RESULT=$(eval "$CMD" 2>/dev/null)
    if echo "$RESULT" | grep -q "$EXPECTED"; then
        echo "✅ $MSG" | tee -a "$RAPPORT"
        SCORE=$((SCORE+1))
    else
        echo "❌ $MSG" | tee -a "$RAPPORT"
        echo "   Actuel: $RESULT" | tee -a "$RAPPORT"
    fi
}

{
echo "=== AUDIT SÉCURITÉ CIS — $(hostname) — $(date) ==="
echo ""
echo "── Authentification ─────────────────────────"
check "Root SSH désactivé"         "grep '^PermitRootLogin' /etc/ssh/sshd_config" "no"
check "Auth par mot de passe SSH"  "grep '^PasswordAuthentication' /etc/ssh/sshd_config" "no"
check "SSH Protocol 2"             "grep '^Protocol' /etc/ssh/sshd_config" "2"
check "Firewall UFW actif"         "ufw status" "active"
check "Fail2ban actif"             "systemctl is-active fail2ban" "active"

echo ""
echo "── Système ──────────────────────────────────"
check "Mises à jour automatiques" "cat /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/null" "1"
check "Pas de services inutiles"  "systemctl list-units --state=running | wc -l" ""
check "Sysctl IP forwarding off"  "sysctl net.ipv4.ip_forward" "= 0"
check "Sysctl ICMP redirects off" "sysctl net.ipv4.conf.all.accept_redirects" "= 0"

echo ""
echo "── Comptes ──────────────────────────────────"
check "Pas de UID 0 hors root"    "awk -F: '($3==0){print $1}' /etc/passwd" "root"
check "umask restrictif"          "grep 'UMASK' /etc/login.defs" "027"

echo ""
echo "── Score : $SCORE / $TOTAL ──────────────────"
PCT=$((SCORE * 100 / TOTAL))
echo "Conformité : $PCT%"
} | tee "$RAPPORT"

echo ""
echo "✅ Rapport complet : $RAPPORT"