#!/bin/bash
##Created by Steve Hajek @ LiquidwareLabs - Updated 7/30/2015
echo "Setting login message for SSH and console..."
cat << EOF > /etc/issue
You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
EOF

###BEGIN Additions - 8/10/2015
echo "Setting secure permissions on logs and updating system files..."
chmod 640 /var/log/rpmpkg*
sed -i 's/\/bin\/chmod 0644 \/var\/log\/rpmpkgs/\/bin\/chmod 0640 \/var\/log\/rpmpkgs/' /etc/cron.daily/rpm
echo "umask 0027" >>/etc/sysconfig/sysstat
chmod 640 /var/log/sa/*
/sbin/service sysstat restart
chmod 640 /var/log/sa/*
chmod 600 /etc/cron.deny
chmod 644 /etc/profile.d/*
chmod 640 /etc/ntp.conf
echo "maxpoll 10" >>/etc/ntp.conf
/sbin/service ntpd restart
/usr/sbin/authconfig --passalgo=sha512 --update
sed -i 's/crypt_style = md5/crypt_style = sha512/' /etc/libuser.conf
sed -i 's/MD5_CRYPT_ENAB no/MD5_CRYPT_ENAB yes/' /etc/login.defs
sed -i 's/NETWORKING_IPV6=yes/NETWORKING_IPV6=no/' /etc/sysconfig/network
echo "install ipv6 /bin/true" >>/etc/modprobe.conf
/sbin/depmod
echo "IPV6INIT=no" >>/etc/sysconfig/network-scripts/ifcfg-lo
sed -i 's/IPV6INIT=yes/IPV6INIT=no/' /etc/sysconfig/network-scripts/ifcfg-eth0
/sbin/service network restart
echo -n "Do you want to set a remote syslog server now? (Y/N) "      
        read choice
        if [ "$choice" == "y" ] || [ "$choice" == "Y" ]; then
                echo -n "Enter remote syslog server name or IP (Use servernameOrIp:port if using non-standard port.): "
				read server
				echo "*.* @"$server >>/etc/rsyslog.conf
        fi
###END Additions - 8/10/2015

echo "Stopping and disabling kdump..."
/sbin/service kdump stop
/sbin/chkconfig kdump off

echo "Removing tcpdump, wireshark and tnt-cap..."
rpm -e tcpdump wireshark tnt-cap

echo "Setting password complexity and expirations for all local accounts..."
rm -f /etc/pam.d/system-auth
ln -sf /etc/pam.d/system-auth-lwl-rhel /etc/pam.d/system-auth
touch /etc/security/opasswd
chown root:root /etc/security/opasswd
chmod 0600 /etc/security/opasswd
grep -E '^\w+\:\$' /etc/shadow | cut -d: -f 1 | while read user; do passwd -x 60 -n 1 $user; done

echo "Enabling auditd daemon and setting daily log rotation..."
/sbin/service auditd start
/sbin/chkconfig auditd on
sed -i -e 's/endscript/endscript\n\tdaily/' /etc/logrotate.d/syslog
kill -HUP `cat /var/run/syslogd.pid 2> /dev/null`
kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null`

echo "All changes complete."
echo "You can now change the passwords for the ssconsole, friend and root users so they have complex passwords going forward."
for user in ssconsole friend root; do
        echo -n "Change password for $user? (Y/N) "      
        read choice
        if [ "$choice" == "y" ] || [ "$choice" == "Y" ]; then
                passwd $user
        fi
done
echo "Done."
echo -n "A reboot is required for some changes to take effect, reboot now? (Y/N) "
        read choice
        if [ "$choice" == "y" ] || [ "$choice" == "Y" ]; then
			/usr/bin/reboot
        fi