updated sshd config

assets/drupal-ssl-decoupled.nginxconf

@@ -89,7 +89,7 @@ server {
       #fastcgi_param DOCUMENT_ROOT /var/www/enfrancais.fr/api;
       # fastcgi_buffer_size 16k;
       # fastcgi_buffers 4 16k;
-      fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+      fastcgi_pass unix:/run/php/php8.2-fpm.sock;
     }
 
     location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {

assets/drupal-ssl.nginxconf

@@ -116,7 +116,7 @@ server {
     fastcgi_intercept_errors on;
     # fastcgi_buffer_size 16k;
     # fastcgi_buffers 4 16k;
-    fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
   }
   # Fighting with Styles? This little gem is amazing.
   # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6

assets/drupal.nginxconf

@@ -92,7 +92,7 @@ server {
     fastcgi_intercept_errors on;
     # fastcgi_buffer_size 16k;
     # fastcgi_buffers 4 16k;
-    fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
   }
   # Fighting with Styles? This little gem is amazing.
   # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6

assets/fail2ban/filter.d/nginx-badbots.conf

@@ -1,5 +1,5 @@
 [Definition]
 
-failregex = FastCGI sent in stderr: "Primary script unknown" .*, client: <HOST>
+failregex = FastCGI sent in stderr: "Primary script unknown" .*, client: <HOST>, server: .*
 
 ignoreregex =

assets/nginx-phpmyadmin.conf

@@ -22,7 +22,7 @@ server {
     }
 
     location ~ \.php$ {
-      fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+      fastcgi_pass unix:/run/php/php8.2-fpm.sock;
       fastcgi_index index.php;
       include fastcgi_params;
       fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

bin/gitbarrerepos.sh

@@ -111,12 +111,12 @@ if [ "$vh" = "yes" ]; then
   chmod +x post-receive # pre-receive
 
   # setup git repo on site folder
-  cd /home/"$user"/www/"$_domain"/app
+  chown -R "$user":"$user" /home/"$user"/www/"$_domain"/public_html
+  cd /home/"$user"/www/"$_domain"/public_html
   git init
   # link to the bare repo
   git remote add origin /home/"$user"/git-repositories/"$_domain".git
 
-  chown -R "$user":"$user" /home/"$user"/www/"$_domain"/app
 
   cd "$_cwd"
   # done

bin/lemp.sh

@@ -36,24 +36,34 @@ echo -e '\033[35m
  / ____/ __  / ____/
 /_/   /_/ /_/_/
 \033[0m'
-echo -e "\033[35;1mInstalling PHP 7.4 \033[0m"
+
+echo -e "\033[35;1mInstalling SURY \033[0m"
 sleep 3
 
+apt-get --yes install ca-certificates apt-transport-https software-properties-common curl lsb-release
+curl -sSL https://packages.sury.org/php/README.txt | bash -x
+apt-get update && apt-get upgrade
+
+echo -e "\033[35;1mInstalling PHP \033[0m"
+sleep 3
+
+
+
 # mv: cannot stat '/etc/php/7.0/fpm/php.ini': No such file or directory
 # cp: cannot create regular file '/etc/php/7.0/fpm/php.ini': No such file or directory
 # Configuring PHP
 # Failed to enable unit: Unit file php7.0-fpm.service does not exist.
 # Failed to start php7.0-fpm.service: Unit php7.0-fpm.service not found.
 
-apt-get --yes install php7.4-fpm php7.4-mysql php7.4-opcache php7.4-curl php7.4-mbstring php7.4-zip php7.4-xml php7.4-gd php-memcached php7.4-imagick php7.4-apcu
+# apt-get --yes install php7.4-fpm php7.4-mysql php7.4-opcache php7.4-curl php7.4-mbstring php7.4-zip php7.4-xml php7.4-gd php-memcached php7.4-imagick php7.4-apcu
 # php7.4-mcrypt  ??
 
 apt-get --yes install php8.1-fpm php8.1-mysql php8.1-opcache php8.1-curl php8.1-mbstring php8.1-zip php8.1-xml php8.1-gd php-memcached php8.1-imagick php8.1-apcu php8.1-redis php8.1-bz2 php8.1-bcmath
 
 # apt-get --yes install php8.2-fpm php8.2-mysql php8.2-opcache php8.2-curl php8.2-mbstring php8.2-zip php8.2-xml php8.2-gd php-memcached php8.2-imagick php8.2-apcu php8.2-redis php8.2-bz2 php8.2-bcmath
 
-mv /etc/php/7.4/fpm/php.ini /etc/php/7.4/fpm/php.ini.back
+mv /etc/php/8.1/fpm/php.ini /etc/php/8.1/fpm/php.ini.back
-cp "$_assets"/php7.4-fpm.ini /etc/php/7.4/fpm/php.ini
+cp "$_assets"/php8.1-fpm.ini /etc/php/8.1/fpm/php.ini
 
 echo "Configuring PHP"
 
@@ -61,8 +71,8 @@ mkdir /var/log/php
 chown www-data /var/log/php
 cp "$_assets"/logrotate-php /etc/logrotate.d/php
 
-systemctl enable php7.4-fpm
+systemctl enable php8.1-fpm
-systemctl start php7.4-fpm
+systemctl start php8.1-fpm
 
 # echo "Installing memecached"
 # replaced by redis
@@ -172,7 +182,7 @@ echo -e '\033[35m
 \033[0m'
 echo -e "\033[35;1mInstalling Redis \033[0m"
 sleep 3
-apt-get --yes install redis-server php-redis
+apt-get --yes install redis-server php8.1-redis
 
 # TODO set maxmemory=2gb
 # TODO set maxmemory-policy=volatile-lru
@@ -186,7 +196,7 @@ apt-get --yes install redis-server php-redis
 
 systemctl enable redis-server
 systemctl restart redis-server
-systemctl restart php7.4-fpm
+systemctl restart php8.1-fpm
 echo -e "\033[92;1mRedis installed\033[Om"
 
 echo -e '\033[35m

bin/ssh.sh

@@ -14,8 +14,13 @@ if [ "$EUID" -ne 0 ]; then
   exit
 fi
 
-sed -i 's/PermitRootLogin\ yes/PermitRootLogin no/g' /etc/ssh/sshd_config
+# sed -i 's/PermitRootLogin\ yes/PermitRootLogin no/g' /etc/ssh/sshd_config
-sed -i 's/PermitEmptyPasswords\ yes/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
+# sed -i 's/PermitEmptyPasswords\ yes/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
-sed -i 's/Protocol\ [0-9]/Protocol 2/g' /etc/ssh/sshd_config
+# sed -i 's/Protocol\ [0-9]/Protocol 2/g' /etc/ssh/sshd_config
+
+touch /etc/ssh/sshd_config.d/custom.conf
+echo "PermitRootLogin no" >> /etc/ssh/sshd_config.d/custom.conf
+echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config.d/custom.conf
+
 systemctl reload ssh
 echo -e "\033[92;1mSSH secured\033[Om"

bin/urbackup.sh

@@ -40,15 +40,17 @@ apt install build-essential "g++" "libcrypto++-dev" libz-dev -y
 # Download the UrBackup client source files and extract them
 # wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
 # wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.11/urbackup-client-2.4.11.0.tar.gz
-wget -P /tmp/ https://hndl.urbackup.org/Client/2.5.20/urbackup-client-2.5.20.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/2.5.20/urbackup-client-2.5.20.0.tar.gz
+wget -P /tmp/ https://hndl.urbackup.org/Client/2.5.20/urbackup-client-2.5.24.0.tar.gz
 
 cd /tmp
 # tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
-tar xzf /tmp/urbackup-client-2.5.20.0.tar.gz
+# tar xzf /tmp/urbackup-client-2.5.20.0.tar.gz
+tar xzf /tmp/urbackup-client-2.5.24.0.tar.gz
 
 # Build the UrBackup client and install it
 # cd /tmp/urbackup-client-2.3.4.0
-cd /tmp/urbackup-client-2.5.20.0
+cd /tmp/urbackup-client-2.5.24.0
 ./configure --enable-headless
 make -j4
 make install

bin/zabbix.sh

@@ -26,12 +26,9 @@ if [ ! -d "$_assets" ]; then
   fi
 fi
 
-# not necessary anymore zabbix-agent 4 is in apt
-# https://packages.debian.org/fr/buster/zabbix-agent
-# TODO downgrade zabbix-agent to 3.4
 
-wget -P /tmp/ http://repo.zabbix.com/zabbix/3.4/debian/pool/main/z/zabbix-release/zabbix-release_3.4-1+stretch_all.deb
+wget -P /tmp/ wget https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
-dpkg -i /tmp/zabbix-release_3.4-1+stretch_all.deb
+dpkg -i /tmp/zabbix-release_6.4-1+debian12_all.deb
 
 apt-get update -y
 
@@ -57,6 +54,10 @@ sed -i "s#Server=127.0.0.1#Server=$_ip#g" /etc/zabbix/zabbix_agentd.conf
 sed -i "s#ServerActive=127.0.0.1#ServerActive=$_ip#g" /etc/zabbix/zabbix_agentd.conf
 sed -i "s#Hostname=Zabbix server#Hostname=$_host_name#g" /etc/zabbix/zabbix_agentd.conf
 
+
+# todo ask if LXC container, if yes install this script
+# https://github.com/kvaps/zabbix-linux-container-template
+
 # APT
 # check for debian security updates
 # not working : https://www.osso.nl/blog/zabbix-counting-security-updates

raw.githubusercontent.com_kvaps_zabbix-linux-container-template_master_zabbix_container.conf.txt

@@ -0,0 +1,4 @@
+UserParameter=ct.memory.size[*],free -b | awk 'NR==2 {total=$ 2; used=($ 3+$ 5); pused=(($ 3+$ 5)*100/$ 2); free=$ 4; pfree=($ 4*100/$ 2); shared=$ 5; buffers=$ 6; cached=$ 6; available=$ 7; pavailable=($ 7*100/$ 2); if("$1" == "") {printf("%.0f", total )} else {printf("%.0f", $1 "" )} }'
+UserParameter=ct.swap.size[*],free -b | awk 'NR==3 {total=$ 2; used=$ 3; free=$ 4; pfree=($ 4*100/$ 2); pused=($ 3*100/$ 2); if("$1" == "") {printf("%.0f", free )} else {printf("%.0f", $1 "" )} }'
+UserParameter=ct.cpu.load[*],cut -d" " -f1-3 /proc/loadavg | awk -F'[, ]+' '{avg1=$(NF-2); avg5=$(NF-1); avg15=$(NF)}{print $2/'$(nproc)'}'
+UserParameter=ct.uptime,cut -d"." -f1 /proc/uptime

readme.md

@@ -1,4 +1,4 @@
-# Install LEMP web server and secure it on debian 10
+# Install LEMP web server and secure it on debian 12
 
 Fail2ban, Ufw, Proftpd, Knockd, Nginx, Mariadb, php7.0-fpm, redis, vhosts, git barre repos, zabbix-agent, dotfiles and more