# Installation
sudo apt update
sudo apt install nginx mariadb-server php-fpm php-mysql -y
 
# MySQL absichern
sudo mysql_secure_installation
 
# Nginx-Konfiguration
sudo nano /etc/nginx/sites-available/testsite

server {
    listen 80;
    server_name testsite.local;
    root /var/www/testsite;
    index index.php index.html;
 
    location / {
        try_files $uri $uri/ =404;
    }
 
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
    }
}

# Virtual Host aktivieren
sudo ln -s /etc/nginx/sites-available/testsite /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
 
# Webroot erstellen
sudo mkdir -p /var/www/testsite
sudo chown -R www-data:www-data /var/www/testsite
 
# Test-PHP-Seite
sudo nano /var/www/testsite/index.php

<?php
phpinfo();
?>

# Testen
curl http://localhost

# UFW
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from 192.168.1.0/24 to any port 22
sudo ufw limit 22/tcp
sudo ufw enable
 
# iptables (Alternative)
sudo iptables -F
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT
 
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
 
# Speichern
sudo iptables-save > /etc/iptables/rules.v4

# Port-Forwarding
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 3000
 
# NAT für internes Netz
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf

# Status prüfen
sudo systemctl status nginx
 
# Logs prüfen
sudo journalctl -u nginx -n 50
sudo tail -f /var/log/nginx/error.log
 
# Konfiguration testen
sudo nginx -t
 
# Ports prüfen
sudo netstat -tuln | grep :80
sudo lsof -i :80
 
# Prozesse prüfen
ps aux | grep nginx
 
# Häufige Probleme:
# - Port bereits belegt
# - Syntax-Fehler in Config
# - Fehlende Berechtigungen
# - SSL-Zertifikat-Probleme

# CPU-Last prüfen
top
htop
 
# Prozess finden
ps aux --sort=-%cpu | head -10
 
# Details zum Prozess
sudo lsof -p [PID]
sudo strace -p [PID]
 
# Performance-Analyse
vmstat 1
iostat -x 1
 
# Lösung je nach Ursache:
# - Prozess beenden: kill [PID]
# - Priorität senken: renice +10 [PID]
# - Service neu starten

# Netzwerk-Interface prüfen
ip addr show
ip link show
 
# Routing prüfen
ip route show
route -n
 
# DNS prüfen
cat /etc/resolv.conf
nslookup google.com
dig google.com
 
# Connectivity testen
ping -c 4 8.8.8.8
ping -c 4 google.com
 
# Firewall prüfen
sudo iptables -L -v -n
sudo ufw status verbose
 
# NetworkManager/Netplan
sudo systemctl status NetworkManager
sudo netplan apply

# Boot-Analyse
systemd-analyze
systemd-analyze blame
systemd-analyze critical-chain
 
# Langsame Services finden
systemd-analyze blame | head -20
 
# Service-Dependencies anzeigen
systemctl list-dependencies
 
# Unnötige Services deaktivieren
sudo systemctl disable bluetooth.service
sudo systemctl disable cups.service
 
# Performance-Report
#!/bin/bash
echo "=== System Performance Report ===" > perf_report.txt
echo "Date: $(date)" >> perf_report.txt
echo "" >> perf_report.txt
 
echo "=== Boot Time ===" >> perf_report.txt
systemd-analyze >> perf_report.txt
echo "" >> perf_report.txt
 
echo "=== Slow Services ===" >> perf_report.txt
systemd-analyze blame | head -10 >> perf_report.txt
echo "" >> perf_report.txt
 
echo "=== CPU Load ===" >> perf_report.txt
uptime >> perf_report.txt
echo "" >> perf_report.txt
 
echo "=== Memory ===" >> perf_report.txt
free -h >> perf_report.txt
echo "" >> perf_report.txt
 
echo "=== Disk I/O ===" >> perf_report.txt
iostat >> perf_report.txt

#!/bin/bash
# Security Audit Script
 
REPORT="security_audit_$(date +%Y%m%d).txt"
 
echo "=== Security Audit Report ===" > $REPORT
echo "Date: $(date)" >> $REPORT
echo "" >> $REPORT
 
# Offene Ports
echo "=== Open Ports ===" >> $REPORT
sudo netstat -tuln >> $REPORT
echo "" >> $REPORT
 
# Laufende Services
echo "=== Running Services ===" >> $REPORT
systemctl list-units --type=service --state=running >> $REPORT
echo "" >> $REPORT
 
# Benutzer mit Login-Shell
echo "=== Users with Login Shell ===" >> $REPORT
grep -v '/nologin\|/false' /etc/passwd >> $REPORT
echo "" >> $REPORT
 
# Benutzer mit UID 0
echo "=== Users with UID 0 ===" >> $REPORT
awk -F: '$3 == 0 {print $1}' /etc/passwd >> $REPORT
echo "" >> $REPORT
 
# Sudo-Berechtigungen
echo "=== Sudo Configuration ===" >> $REPORT
sudo cat /etc/sudoers.d/* 2>/dev/null >> $REPORT
echo "" >> $REPORT
 
# SUID/SGID-Dateien
echo "=== SUID/SGID Files ===" >> $REPORT
find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} \; 2>/dev/null >> $REPORT
echo "" >> $REPORT
 
# Welt-beschreibbare Verzeichnisse
echo "=== World-Writable Directories ===" >> $REPORT
find / -type d -perm -002 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null >> $REPORT
 
cat $REPORT