Kali (so mostly Debian) Hardening Script

harden-kali.sh

#!/bin/sh

UMASK=027
TIMEZONE='EST'

# set the timezone *before* creating a bunch of logs 🕛✅
timedatectl set-timezone $TIMEZONE

# update and fire up sshguard first 🔥
apt -y update
apt -y install sshguard
systemctl start sshguard
systemctl enable sshguard
apt -y full-upgrade
apt -y autoremove

install -D -m 644 -o root -g root /dev/null /etc/kali-motd/disable-all

sed -E /etc/login.defs \
    -e 's/^(CHFN_RESTRICT\s*.*)$/#\1/' \
    -e 's/^(DEFAULT_HOME\s+).*$/\1no/' \
    -e 's/^(ENCRYPT_METHOD\s+).*$/\1YESCRYPT/' \
    -e 's/^(LOG_OK_LOGINS\s+).*$/\1yes/' \
    -e "s/^(UMASK\s+).*$/\1${UMASK}/" \
    -i.bak

sed -E /etc/adduser.conf \
    -e 's/^(SYS_DIR_MODE\s+).*$/\10750/' \
    -e 's/^#(EXTRA_GROUPS="users")$/\1/' \
    -i.bak

echo 'PermitRootLogin no' >| /etc/ssh/sshd_config.d/10-no-permit-root-login.conf
# the change to login.defs does not affect ssh but this works on everything! ✨
echo "session optional\t\t\t pam_umask.so umask=${UMASK}" >> /etc/pam.d/common-session