config.ini

START_SSHD
#       $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
#General
Port 20000
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#Authentication
Protocol 2
AllowUsers
AllowGroups
ChallengeResponseAuthentication yes
AuthenticationMethods keyboard-interactive
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
PubkeyAuthentication no
AuthorizedKeysFile      .ssh/authorized_keys
UsePAM yes
MaxAuthTries 3

# Ciphers and keying
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

# Logging
LogLevel VERBOSE

#Misc
UseDNS no
IgnoreRhosts yes
HostbasedAuthentication no
X11Forwarding no
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
AllowTcpForwarding no
Compression no
ClientAliveCountMax 0
ClientAliveInterval 300
MaxSessions 2
TCPKeepAlive no
AllowAgentForwarding no
Banner /etc/issue.net

#SFTP
Subsystem sftp  /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO

END_SSHD

START_PAM_SSHD
auth required pam_unix.so try_first_pass
auth required pam_google_authenticator.so echo_verification_code nullok
END_PAM_SSHD

START_F2B_SSH
[sshd]
enabled = true
banaction = ufw
port = ssh
filter = sshd
logpath = %(sshd_log)s
maxretry = 5
END_F2B_SSH

START_COREDUMP
* hard core 0
* soft core 0
END_COREDUMP

START_DEFBANNER
********************************************************************
*                                                                  *
* This system is for the use of authorized users only.  Usage of   *
* this system may be monitored and recorded by system personnel.   *
*                                                                  *
* Anyone using this system expressly consents to such monitoring   *
* and is advised that if such monitoring reveals possible          *
* evidence of criminal activity, system personnel may provide the  *
* evidence from such monitoring to law enforcement officials.      *
*                                                                  *
********************************************************************


END_DEFBANNER

START_HELP
This Script will install and configure some security options on your server! 
These Changes will be made: 
 -Secure SSHD Configuration 
 -Google 2-Factor Authentication 
 -Password Policy 
 -UFW Firewall 
 -Freshclam Anti-Virus 
 -AIDE File Integrity 
 -Fail2Ban Intrusion Detection 
 -Chrootkit Detection 
 -Secure PROC 
 -Debsums
 -Unattended Upgrades
END_HELP

START_UNATTENDED_UPGRADES
// Enable the update/upgrade script (0=disable)
APT::Periodic::Enable "1";

// Do "apt-get update" automatically every n-days (0=disable)
APT::Periodic::Update-Package-Lists "1";

// Do "apt-get upgrade --download-only" every n-days (0=disable)
APT::Periodic::Download-Upgradeable-Packages "1";

// Do "apt-get autoclean" every n-days (0=disable)
APT::Periodic::AutocleanInterval "7";

// Send report mail to root
//     0:  no report             (or null string)
//     1:  progress report       (actually any string)
//     2:  + command outputs     (remove -qq, remove 2>/dev/null, add -d)
//     3:  + trace on    APT::Periodic::Verbose "2";
APT::Periodic::Unattended-Upgrade "1";

// Automatically upgrade packages from these
Unattended-Upgrade::Origins-Pattern {
      "o=Debian,a=stable";
      "o=Debian,a=stable-updates";
      "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

// You can specify your own packages to NOT automatically upgrade here
Unattended-Upgrade::Package-Blacklist {
};

// Run dpkg --force-confold --configure -a if a unclean dpkg state is detected to true to ensure that updates get installed even when the system got interrupted during a previous run
Unattended-Upgrade::AutoFixInterruptedDpkg "true";

//Perform the upgrade when the machine is running because we wont be shutting our server down often
Unattended-Upgrade::InstallOnShutdown "false";

// Send an email to this address with information about the packages upgraded.
Unattended-Upgrade::Mail "root";

// Always send an e-mail
Unattended-Upgrade::MailOnlyOnError "false";

// Remove all unused dependencies after the upgrade has finished
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Remove any new unused dependencies after the upgrade has finished
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";

// Automatically reboot WITHOUT CONFIRMATION if the file /var/run/reboot-required is found after the upgrade.
Unattended-Upgrade::Automatic-Reboot "false";

// Automatically reboot even if users are logged in.
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

END_UNATTENDED_UPGRADES