# Example: Comprehensive Linux Security Hardening
#!/bin/bash
# Advanced Linux security configuration script

echo "Starting comprehensive Linux security hardening..."

# 1. System Updates and Package Management
echo "Step 1: Updating system packages..."
sudo apt update && sudo apt upgrade -y
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# 2. Firewall Configuration
echo "Step 2: Configuring firewall..."
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw enable

# 3. Disable Unnecessary Services
echo "Step 3: Disabling unnecessary services..."
sudo systemctl disable telnet
sudo systemctl disable ftp
sudo systemctl disable rsh
sudo systemctl disable rlogin
sudo systemctl disable nfs-server
sudo systemctl disable rpcbind

# 4. File System Security
echo "Step 4: Configuring file system security..."
sudo chmod 600 /etc/shadow
sudo chmod 644 /etc/passwd
sudo chmod 755 /home
sudo chmod 700 /root
sudo chown root:root /etc/shadow
sudo chown root:root /etc/passwd

# 5. SSH Security Hardening
echo "Step 5: Hardening SSH configuration..."
sudo sed -i 's/#Port 22/Port 2222/' /etc/ssh/sshd_config
sudo sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config
sudo systemctl restart ssh

# 6. Install and Configure Security Tools
echo "Step 6: Installing security tools..."
sudo apt install -y fail2ban ufw rkhunter chkrootkit

# Configure fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# 7. System Monitoring
echo "Step 7: Setting up system monitoring..."
sudo apt install -y htop iotop nethogs
sudo chmod +s /usr/bin/ping

# 8. Log Configuration
echo "Step 8: Configuring logging..."
sudo mkdir -p /var/log/security
sudo chmod 750 /var/log/security
sudo chown root:adm /var/log/security

# 9. Kernel Security Parameters
echo "Step 9: Setting kernel security parameters..."
cat << EOF | sudo tee -a /etc/sysctl.conf
# Network security
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.tcp_syncookies = 1

# Memory protection
kernel.exec-shield = 1
kernel.randomize_va_space = 2
EOF

sudo sysctl -p

echo "Linux security hardening completed successfully!"
echo "System is now more secure with:"
echo "- Updated packages and automatic security updates"
echo "- Configured firewall with restrictive rules"
echo "- Disabled unnecessary services"
echo "- Hardened file permissions"
echo "- Secured SSH configuration"
echo "- Installed security monitoring tools"
echo "- Configured kernel security parameters"

# Mini-Project: OS Security Assessment Tool
// Assess the security posture of your operating system

const osSecurityAssessment = {
    windows: {
        features: {
            windowsDefender: "Is Windows Defender enabled and updated?",
            uac: "Is User Account Control enabled?",
            bitlocker: "Is BitLocker encryption enabled?",
            firewall: "Is Windows Firewall enabled?",
            updates: "Are automatic updates enabled?",
            antivirus: "Is additional antivirus software installed?"
        },
        score: 0
    },
    linux: {
        features: {
            firewall: "Is a firewall configured and enabled?",
            updates: "Are system packages regularly updated?",
            ssh: "Is SSH properly configured with key authentication?",
            permissions: "Are file permissions properly set?",
            services: "Are unnecessary services disabled?",
            logging: "Is system logging properly configured?"
        },
        score: 0
    },
    macos: {
        features: {
            gatekeeper: "Is Gatekeeper enabled?",
            filevault: "Is FileVault encryption enabled?",
            sip: "Is System Integrity Protection enabled?",
            firewall: "Is the built-in firewall enabled?",
            updates: "Are automatic updates enabled?",
            privacy: "Are privacy settings properly configured?"
        },
        score: 0
    }
};

// Calculate security score for each OS
function calculateOSScore(osFeatures) {
    let score = 0;
    let totalFeatures = Object.keys(osFeatures).length;
    
    Object.values(osFeatures).forEach(feature => {
        // In real implementation, you'd check actual system status
        // For demo purposes, we'll simulate some features being enabled
        if (Math.random() > 0.3) { // 70% chance each feature is enabled
            score++;
        }
    });
    
    const percentage = (score / totalFeatures) * 100;
    return {
        score,
        totalFeatures,
        percentage,
        level: percentage >= 80 ? 'Excellent' : 
               percentage >= 60 ? 'Good' : 
               percentage >= 40 ? 'Fair' : 'Needs Improvement'
    };
}

// Assess each operating system
Object.keys(osSecurityAssessment).forEach(os => {
    if (os !== 'score') {
        const assessment = calculateOSScore(osSecurityAssessment[os].features);
        osSecurityAssessment[os].score = assessment;
        
        console.log(`${os.toUpperCase()} Security Assessment:`);
        console.log(`  Features enabled: ${assessment.score}/${assessment.totalFeatures}`);
        console.log(`  Security score: ${assessment.percentage}% - ${assessment.level}`);
        console.log('---');
    }
});

// Generate security recommendations
function generateRecommendations(os, score) {
    const recommendations = {
        windows: [
            "Enable Windows Defender and keep it updated",
            "Turn on User Account Control (UAC)",
            "Enable BitLocker for full disk encryption",
            "Configure Windows Firewall with appropriate rules",
            "Enable automatic updates for security patches",
            "Consider additional antivirus software for extra protection"
        ],
        linux: [
            "Configure and enable a firewall (ufw or iptables)",
            "Set up automatic security updates",
            "Secure SSH with key-based authentication",
            "Review and set proper file permissions",
            "Disable unnecessary services and daemons",
            "Configure comprehensive system logging"
        ],
        macos: [
            "Enable Gatekeeper to verify software authenticity",
            "Turn on FileVault for full disk encryption",
            "Keep System Integrity Protection (SIP) enabled",
            "Configure the built-in firewall",
            "Enable automatic security updates",
            "Review and configure privacy settings"
        ]
    };
    
    return recommendations[os] || ["General security recommendations apply"];
}

// Example usage
const myOS = 'windows'; // Change this to your actual OS
const myScore = osSecurityAssessment[myOS].score;
const myRecommendations = generateRecommendations(myOS, myScore);

console.log(`${myOS.toUpperCase()} Security Recommendations:`);
myRecommendations.forEach((rec, index) => {
    console.log(`${index + 1}. ${rec}`);
});