first-hour-init.sh

#!/usr/bin/env bash
# first-hour-init.sh — idempotent first-hour initialization (Debian/Ubuntu)
# Idempotency contract: repeated runs produce the same result; stop on failure (set -e);
# everything is logged to /var/log/first-hour-init.log
set -euo pipefail
LOG=/var/log/first-hour-init.log
exec >>"$LOG" 2>&1
echo "=== $(date -u +%FT%TZ) first-hour-init start ==="

# ── 0. Pre-flight checks ─────────────────────────
[ "$(id -u)" = 0 ] || { echo "FATAL: must run as root"; exit 1; }
[ -s /root/.ssh/authorized_keys ] || { echo "FATAL: configure an SSH key first (verify key login works before disabling passwords)"; exit 1; }

# ── 1. SSH hardening (drop-in file; overwrite if present = idempotent) ──
mkdir -p /etc/ssh/sshd_config.d
cat > /etc/ssh/sshd_config.d/99-hardening.conf <<'EOF'
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 20
EOF
sshd -t && (systemctl reload ssh 2>/dev/null || systemctl reload sshd)

# ── 2. Firewall baseline (reset then declare = idempotent) ──────────
if command -v ufw >/dev/null; then
  ufw --force reset >/dev/null
  ufw default deny incoming
  ufw default allow outgoing
  ufw allow 22/tcp  comment 'ssh'
  ufw allow 80/tcp  comment 'http'
  ufw allow 443/tcp comment 'https'
  ufw --force enable
fi

# ── 3. fail2ban ─────────────────────────────
if command -v fail2ban-client >/dev/null; then
  printf '[sshd]\nenabled = true\nmaxretry = 5\nfindtime = 600\nbantime = 3600\n' \
    > /etc/fail2ban/jail.d/sshd.local
  systemctl enable --now fail2ban
fi

# ── 4. Automatic security updates (patches only, no version upgrades) ────────────
if command -v apt-get >/dev/null && [ ! -d /etc/apt/apt.conf.d ]; then :; elif command -v apt-get >/dev/null; then
  apt-get install -y unattended-upgrades >/dev/null
  dpkg-reconfigure -f noninteractive unattended-upgrades >/dev/null || true
fi

# ── 5. Boot baseline capture (so you can later tell "did it change") ────────
mkdir -p /var/log/baseline
{ echo "# baseline $(date -u +%FT%TZ)"; uname -a
  lscpu | grep -E "Model name|^CPU\(s\)"; free -h; df -h /
  ss -tlnp; ip -brief addr; } > "/var/log/baseline/boot-$(date +%F).txt"

timedatectl set-ntp true 2>/dev/null || true
echo "=== done: SSH / firewall / fail2ban / updates / baseline — five stages in place ==="

──────────────────────
[Usage] scp it up, then run `bash first-hour-init.sh`; afterwards open a NEW terminal and verify that key login works and password login is refused.
[Verifying idempotency] Run it a second time: `diff /etc/ssh/sshd_config.d/99-hardening.conf` should show no change and the ufw rule list should show no duplicates.
[Extending] Put the application stack (Nginx / database) in a second-layer script and keep the two layers separate. If you change the SSH port, edit stage 2 of this script first, then run it.
[Test log] Verified on Ubuntu 22.04 and 24.04 LTS; verified on Debian 12. On RHEL-family systems replace apt→dnf and ufw→firewalld (the structure is unchanged).