curl -fsSL https://gist.githubusercontent.com/strund3r/8c89e7b2e7b82aad0683553a685ab929/raw/183c7f27ae6dc30415a42b4d6b19fa63566202de/client-configure.sh -o client-configure.sh && chmod +x client-configure.sh && ./client-configure.sh

client-configure.sh

#!/bin/bash

# Validar sistema operacional
CHECK=`cat /etc/debian_version`
if [ -z "$CHECK" ]
    then
        OS=centos
        GROUP=wheel
        LIB=libexec
    else
        OS=debian
        GROUP=sudo
        LIB=lib
fi

# Criar usuário de sincronização de chaves
adduser --system --home /var/local/keys-sync --shell /bin/sh keys-sync

# Mudar permissões e criar arquivo de chave
mkdir /var/local/keys-sync
chmod 711 /var/local/keys-sync
echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAgEAhqz/Cvx78uq3qCGQ0S/xbXpJl0nTYzwDbxhtc3Oqpi+mN+vWPfzBnz+sv+c1XegUh6NbJ/yCsaRDjRD13p2ymag5x9CqOO45AY5I4RQx5DB0xOv0MNz+IIae0IzOU+CIHbkbO7Mz3i/QwgruDqQIuCBrJJHdz3hWhiWvQRXetUgK9QlEeQTKSWUr9Or1xMAFZOG0pHyAYNek0qXCf+OGMnziLgw/jsD6uMH/UxxYECvA3zh/nFeqq8+EdxR8dUIVDqSsJiN5AHxjkPlVbj5jEB/1JglIZdXikv70YyZ0GUnarJrikKE4iu94I4gzDJDsL0/MzRnglJaQq27bqqiT44b/GxA30amO9TUapQ5wnfmuciTCLwR/i4hh8vTcr9h9aRHYpJKB2YzBYKt1pCeWHJsHfF5Bjt4UQObMnJvFNcMDVFrVYjjdgIInVHQQ0mAy1Zr/7QXzlR9DG0JHSN7UjddaPJznHWrrs1300tllcepmq0/0YhMXeINzFjr7PfJkB3oPeOQsR+eQWAxWd482B64EU7n7fZ5nvw3ZNYJ/yFmlKeJ4OYUsQPDSCRZotSbY4XAcXvqCwT494k/600zsju7C7NKtWFawhFjUYh/4tZ8OoQtjZ53P2XhB/hTSHX8SOYrkbTvBSBYve2DJsbTkR+spnpXktr2H1DC2TJrlYqE= ska-ssh-key-authority" > /var/local/keys-sync/keys-sync
chmod 644 /var/local/keys-sync/keys-sync
chown -R keys-sync. /var/local/keys-sync

# Verificar Selinux
SELINUX=`getenforce`
if [ "$SELINUX" = "Enforcing" ]
    then
        read -p "`echo -e 'Seu Selinux está configurada como "Enforcing".\nSerá necessário alterá-lo para "Permissive" para permitir o funcionamento correto da sincronização de chaves.\nGostaria de alterar? (Y/N)'`" yn
            case $yn in
                [Yy] ) echo "Alterando Selinux..."
                    setenforce permissive
                    echo "Mudando arquivo de configuração do Selinux..."
                    sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config;;
                [Nn] ) echo -e "A sincronização das chaves não funciona corretamente com o Selinux habilitado.\nParando script..."
                    exit;;
                * ) echo "Por favor digite "Y" ou "N", parando script..."
                    exit;;
            esac
fi

# Resetar Host Key Fingerprint
read -p "Vai ser necessário resetar chave (fingerprint) do host? (Y/N)" yn
    case $yn in
        [Yy] ) echo "Gerando nova chave..."
            mkdir /ssh-backup
            cp -p /etc/ssh/*key* /ssh-backup
            rm -f /etc/ssh/*key*
            ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
            ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
            ssh-keygen -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa
            systemctl restart sshd;;
        [Nn] ) echo "Pulando etapa de resetar chave..."
            echo "Continuando com o resto do script";;
        * ) echo "Por favor digite "Y" ou "N", parando script..."
            exit;;
    esac

# Alterar configuração do OpenSSH
echo "#       \$OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# The default requires explicit activation of protocol 1
#Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Ciphers and keying
#RekeyLimit default none

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
StrictModes no
MaxAuthTries 6
MaxSessions 10

RSAAuthentication yes
#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile      /var/local/keys-sync/%u # .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of \"PermitRootLogin without-password\".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
UsePrivilegeSeparation sandbox          # Default for new installations.
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

# override default of no subsystems
Subsystem       sftp    /usr/$LIB/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server" > /etc/ssh/sshd_config
systemctl restart sshd

# Criar script para criação automatizada de usuários
if [ "$OS" = "centos" ]
then
echo "#!/bin/bash

NEWUSERS=\`ls -l /var/local/keys-sync/ | awk '{print \$9}'\`
for i in \$NEWUSERS
    do
        /usr/sbin/adduser \$i 
        /usr/sbin/usermod -aG $GROUP \$i
    done" > /var/local/auto-create-user.sh
else
echo "#!/bin/bash

NEWUSERS=\`ls -l /var/local/keys-sync/ | awk '{print \$9}'\`
for i in \$NEWUSERS
    do
        /usr/sbin/adduser \$i --force-badname --disabled-password --gecos \"\"
        /usr/sbin/usermod -aG $GROUP \$i
    done" > /var/local/auto-create-user.sh
fi
chmod +x /var/local/auto-create-user.sh
crontab -l | \
        { cat; echo "*/15 * * * * /var/local/auto-create-user.sh > /var/local/auto-create-user.log"; } \
        | crontab -

# Mudar permissão do grupo wheel
sed -i "s/%$GROUP/#%$GROUP/g" /etc/sudoers
echo "%$GROUP ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

# Desabilitar usuário root
if [ "$OS" = "centos" ]
    then
        sed -i 's/root:x:0:0:root:\/root:\/bin\/bash/root:x:0:0:root:\/root:\/sbin\/nologin/g' /etc/passwd
    else
        sed -i 's/root:x:0:0:root:\/root:\/bin\/bash/root:x:0:0:root:\/root:\/usr\/sbin\/nologin/g' /etc/passwd
fi