Here’s an old script i created years ago and still using it right now whenever i install CentOS. i used Rodolfo Paiz’s guide to create this script.
fat-free script:
#!/bin/sh
# Script By: Mark Quitoriano(mark@quitoriano.org)
#
# Thanks to Rodolfo J. Paiz(rpaiz@simpaticus.com) for a beautiful howto.
# you can find it here:
# http://simpaticus.com/linux/barebones-server-howto.php
#
#
# Changelog:
# 0.3.2 - Added sftp support for ssh and remove yum rpm
# 0.3.1 - change the sequence on creating a user gpasswd doesn’t execute
# properly because there is no user on the sequence
# 0.3 - added delete option for the files been downloaded
# 0.2.1 - added adduser command to create user
#
#
LOAD_LOC=/opt/fat-free
# Start of the Script
mkdir $LOAD_LOC
cd $LOAD_LOC
wget ftp://ftp.nluug.nl/pub/os/Linux/distr/CentOS/4/extras/i386/RPMS/apt-0.5.15cnc6-4.centos4.i386.rpm
rpm -Uvh apt-0.5.15cnc6-4.centos4.i386.rpm
echo
echo
echo
echo ”
#########################
# Adding New Repository #
#########################
”
sleep 5
echo “# URL: http://www.centos.org
### CentOS-4 APT repository
rpm http://mirror.centos.org centos/4/apt/i386 os addons updates extras
rpm http://mirror.centos.org centos/4/apt/i386 contrib centosplus” > /etc/apt/sources.list.d/centos.list
apt-get update
apt-get remove binutils redhat-lsb comps specspo groff htmlview man man-pages pinfo isdn4k-utils netconfig redhat-menus sysreport system-config-mouse system-config-network-tui system-config-securitylevel-tui usermode vconfig cups cups-libs libwvstreams minicom ppp rp-pppoe wvdial authconfig bind-libs bind-utils dhcpv6_client finger jpackage-utils jwhois lftp libpcap mtr nscd telnet traceroute aspell aspell-en mkbootdisk syslinux irda-utils autofs diskdumputils dos2unix dosfstools dmraid eject glib lha lrzsz mdadm mtools unix2dos unzip zip ash pdksh tcsh libxslt xmlsec1 xmlsec1-openssl pcmcia-cs nfs-utils portmap ypbind yp-tools bluez-bluefw bluez-hcidump bluez-libs bluez-utils NetworkManager wireless-tools pam_ccreds pam_krb5 pam_passwdqc pam_smb mailcap xorg-x11-Mesa-libGL xorg-x11-libs sendmail yum –yes
apt-get upgrade –yes
cp -rf /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
echo “——————————————-”
echo “Adding User”
echo “——————————————-”
## Change this depends on your preference
adduser admin
(echo password; sleep 2; echo password) | passwd admin
echo
echo
echo ”
###########################
# Locking Down SSH #
###########################
”
echo
echo
echo “# $OpenBSD: sshd_config,v 1.69 2004/05/23 23:59:53 dtucker Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
#Port 22
#Protocol 2,1
Protocol 2
#ListenAddress 0.0.0.0
#ListenAddress ::
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768
# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don’t trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don’t read the user’s ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes
# Set this to ‘yes’ to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# “PermitRootLogin without-password”. If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
#UsePAM no
UsePAM yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding no
#X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression yes
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#ShowPatchLevel no
# no default banner path
#Banner /some/path
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
AllowUsers admin
” > /etc/ssh/sshd_config
echo Restarting SSHD
/etc/init.d/sshd restart
echo ”
###########################
# Locking down SU command #
###########################
”
gpasswd -a admin wheel
chown root.wheel /bin/su
chmod 4750 /bin/su
echo “# sudoers file.
#
# This file MUST be edited with the ‘visudo’ command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#
# Host alias specification
# User alias specification
# Cmnd alias specification
# Defaults specification
# User privilege specification
root ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
%wheel ALL=(ALL) ALL
# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now
” > /etc/sudoers
chmod 0440 /etc/sudoers
## Delete all evidences
rm -rf $LOAD_LOC
or you can also download it here
Im also making this script compatible with centos 5.x but it looks like too much work so i’ll just create another script just for 5.x i’ll be posting it soon as i finished it.