# Verify root SSH disabled
grep "^PermitRootLogin" /etc/ssh/sshd_config

# List all users with shell access
grep -E '/bin/bash|/bin/sh' /etc/passwd

# Review sudo users
cat /etc/sudoers | grep -v '^#' | grep -v '^$'

# Create groups
sudo groupadd web-admin
sudo groupadd db-admin
sudo groupadd mail-admin

# Add users to groups
sudo usermod -aG web-admin wez
sudo usermod -aG db-admin wez

# Create sudo rules file
sudo cat > /etc/sudoers.d/roles << 'EOF'
# Web administrators - can manage nginx and web services
%web-admin ALL=(ALL) /usr/bin/systemctl restart nginx
%web-admin ALL=(ALL) /usr/bin/systemctl restart stsgym-website
%web-admin ALL=(ALL) /usr/bin/docker restart *

# Database administrators - can manage postgres/redis
%db-admin ALL=(ALL) /usr/bin/docker exec * psql *
%db-admin ALL=(ALL) /usr/bin/systemctl restart postgresql

# Full admin - wez
wez ALL=(ALL) ALL
EOF

# Verify syntax
sudo visudo -c

# Verify auditd running
sudo systemctl status auditd

# List audit rules
sudo auditctl -l

# Search audit logs
sudo ausearch -ts today -m USER_LOGIN

# Generate audit report
sudo aureport --summary

# Check auth log format
sudo tail -5 /var/log/auth.log

# Configure log retention
sudo cat >> /etc/logrotate.conf << 'EOF'
/var/log/auth.log {
    weekly
    rotate 13
    compress
    delaycompress
    missingok
    notifempty
    create 0640 syslog adm
}
EOF

# Check log permissions
ls -la /var/log/auth.log /var/log/syslog

# Should show: -rw-r----- 1 syslog adm
# If not, fix:
sudo chmod 0640 /var/log/auth.log
sudo chown syslog:adm /var/log/auth.log

# Check SSH auth methods
grep -E "PasswordAuthentication|PubkeyAuthentication" /etc/ssh/sshd_config.d/*.conf

# Should show: PasswordAuthentication no
# If not, create override:
sudo cat > /etc/ssh/sshd_config.d/99-hardening.conf << 'EOF'
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
EOF

sudo systemctl restart ssh

# Verify password policy
grep -E "PASS_MAX|PASS_MIN|PASS_WARN" /etc/login.defs

# Should show:
# PASS_MAX_DAYS   90
# PASS_MIN_DAYS   0
# PASS_WARN_AGE   7

# Install password quality module
sudo apt install -y libpam-pwquality

# Configure complexity
sudo cat >> /etc/security/pwquality.conf << 'EOF'
minlen = 14
minclass = 4
maxrepeat = 2
maxsequence = 3
difok = 4
EOF

# Install MFA
sudo apt install -y libpam-google-authenticator

# Configure for SSH
sudo sed -i 's/^@include common-auth/@include common-auth\nauth required pam_google_authenticator.so/' /etc/pam.d/sshd

# Configure SSH to use MFA
sudo sed -i 's/^UsePAM yes/UsePAM yes\nAuthenticationMethods publickey,keyboard-interaction/' /etc/ssh/sshd_config

sudo systemctl restart ssh

# For each user:
google-authenticator

# Incident Response Plan

## Incident Types
1. Unauthorized access attempt
2. Malware detection
3. Data breach
4. Denial of service
5. Configuration change

## Response Procedures

### Unauthorized Access
1. Isolate affected account
2. Review audit logs
3. Block IP via fail2ban/UFW
4. Notify administrator
5. Document incident

### Malware Detection
1. Isolate affected system
2. Run ClamAV scan
3. Quarantine affected files
4. Review process list
5. Document and report

## Contact Information
- Primary: [Admin Name]
- Backup: [Backup Contact]
- Security: [Security Team]

# Set up automated backups
sudo apt install -y rsnapshot

# Configure backup retention
sudo cat > /etc/rsnapshot.conf << 'EOF'
config_version  1.2
snapshot_root   /backup/
no_create_root   1

cmd_cp          /bin/cp
cmd_rm          /bin/rm
cmd_rsync       /usr/bin/rsync
cmd_ssh /usr/bin/ssh
cmd_logger      /usr/bin/logger
cmd_du          /usr/bin/du
cmd_rsnapshot_diff      /usr/bin/rsnapshot-diff
cmd_preexec     /path/to/preexec/script
cmd_postexec    /path/to/postexec/script

retain  daily   7
retain  weekly  4
retain  monthly 3

backup  /home/           localhost/
backup  /etc/           localhost/
backup  /var/log/       localhost/
EOF

# Update ClamAV signatures
sudo freshclam

# Schedule daily scan
sudo cat > /etc/cron.daily/clamscan << 'EOF'
#!/bin/bash
/usr/bin/clamscan -r /home /etc /var/www --quiet --log /var/log/clamav/daily.log
if [ $? -eq 1 ]; then
    mail -s "ClamAV: Malware Detected" root@localhost < /var/log/clamav/daily.log
fi
EOF
sudo chmod +x /etc/cron.daily/clamscan

# Install logwatch for daily reports
sudo apt install -y logwatch

# Configure daily email
sudo cat > /etc/cron.daily/logwatch-report << 'EOF'
#!/bin/bash
/usr/sbin/logwatch --output mail --mailto root@localhost
EOF
sudo chmod +x /etc/cron.daily/logwatch-report

# Install SpamAssassin
sudo apt install -y spamassassin spamc

# Configure Postfix
sudo postconf -e 'content_filter = spamassassin'
sudo postconf -e 'spamassassin_destination_recipient_limit = 1'

# Create spamassassin service
sudo cat > /etc/postfix/master.cf.d/spamassassin.cf << 'EOF'
spamassassin unix - n n - - pipe
  user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
EOF

# Check SSH configuration
grep -E "PermitRootLogin|PasswordAuthentication" /etc/ssh/sshd_config*

# Check audit status
sudo systemctl status auditd
sudo auditctl -l

# Check password policy
grep -E "PASS_MAX|PASS_MIN|PASS_WARN" /etc/login.defs

# Check ClamAV
clamscan --version
sudo systemctl status clamav-daemon

# Check firewall
sudo ufw status verbose

# Check fail2ban
sudo fail2ban-client status sshd

# Check open ports
ss -ltnup

# Check user accounts
grep -E '/bin/bash|/bin/sh' /etc/passwd

# Check audit logs
sudo aureport --summary

# Run on the server
wget https://raw.githubusercontent.com/.../security-hardening-mail.sh
chmod +x security-hardening-mail.sh
sudo ./security-hardening-mail.sh

# Access Control Policy

## Purpose
Define requirements for controlling access to organizational systems.

## Scope
Applies to all users of mail.stsgym.com and related services.

## Policy Statements
1. Access shall be granted based on least privilege
2. All access requests require approval from system administrator
3. Access shall be reviewed quarterly
4. Inactive accounts shall be disabled after 90 days
5. Privileged access requires additional authentication (MFA)

## Roles and Responsibilities
- System Administrator: Approve and manage accounts
- Users: Protect credentials, report incidents
- Management: Approve policy changes

## Enforcement
Violations may result in access revocation and disciplinary action.

# Incident Response Plan

## Incident Types
1. **Unauthorized Access**: Attempted or successful access by unauthorized user
2. **Malware**: Detection of malicious software
3. **Data Breach**: Unauthorized access to sensitive data
4. **Denial of Service**: Disruption of service availability
5. **Configuration Change**: Unauthorized modification of system configuration

## Response Procedures

### Unauthorized Access
1. Isolate affected account: `sudo usermod -L <username>`
2. Block IP: `sudo ufw deny from <IP>`
3. Review logs: `sudo journalctl -u sshd --since "1 hour ago"`
4. Document incident in security log
5. Notify administrator

### Malware Detection
1. Isolate system: Disconnect from network if severe
2. Run scan: `sudo clamscan -r /`
3. Quarantine files: `sudo mv <file> /quarantine/`
4. Document findings
5. Report to administrator

### Data Breach
1. Identify scope: Review audit logs
2. Preserve evidence: Do not modify logs
3. Contain: Revoke compromised credentials
4. Document: Record all findings
5. Notify: Report to affected parties

## Contact Information
- Primary Administrator: [Name, Email, Phone]
- Backup Administrator: [Name, Email, Phone]
- Security Team: [Contact]