# Example: Comprehensive Network Security Hardening
#!/bin/bash
# Advanced network security configuration script

echo "Starting comprehensive network security hardening..."

# 1. Disable Unnecessary Network Services
echo "Step 1: Disabling unnecessary network services..."
sudo systemctl disable telnet
sudo systemctl disable rsh
sudo systemctl disable rlogin
sudo systemctl disable ftp
sudo systemctl disable tftp
sudo systemctl disable rpcbind
sudo systemctl disable nfs-server

# 2. Secure SSH Configuration
echo "Step 2: Hardening SSH configuration..."
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# Create secure SSH configuration
sudo tee /etc/ssh/sshd_config > /dev/null << 'EOF'
# SSH Security Configuration
Port 2222
Protocol 2
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PermitEmptyPasswords no
MaxAuthTries 3
MaxSessions 2
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 60
AllowUsers your_username
DenyUsers root admin administrator
X11Forwarding no
AllowTcpForwarding no
GatewayPorts no
PermitTunnel no
ChrootDirectory /home/%u
ForceCommand internal-sftp
EOF

# Restart SSH service
sudo systemctl restart ssh

# 3. Configure Network Security Parameters
echo "Step 3: Configuring network security parameters..."
sudo tee -a /etc/sysctl.conf > /dev/null << 'EOF'

# Network Security Settings
# Disable IP forwarding
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Disable ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Log martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Ignore ICMP ping requests
net.ipv4.icmp_echo_ignore_all = 1

# Ignore ICMP ping requests to broadcast
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable TCP SYN cookies
net.ipv4.tcp_syncookies = 1

# Disable TCP timestamps
net.ipv4.tcp_timestamps = 0

# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable IPv6 if not needed
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
EOF

# Apply sysctl changes
sudo sysctl -p

# 4. Configure DNS Security
echo "Step 4: Configuring DNS security..."
sudo tee /etc/systemd/resolved.conf > /dev/null << 'EOF'
[Resolve]
DNS=8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1
FallbackDNS=9.9.9.9 149.112.112.112
DNSSEC=yes
DNSOverTLS=yes
Cache=yes
CacheFromLocalhost=no
EOF

sudo systemctl restart systemd-resolved

# 5. Install and Configure Network Security Tools
echo "Step 5: Installing network security tools..."
sudo apt update
sudo apt install -y ufw fail2ban rkhunter chkrootkit nmap tcpdump wireshark

# Configure UFW Firewall
echo "Step 6: Configuring UFW firewall..."
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw --force enable

# Configure fail2ban
echo "Step 7: Configuring fail2ban..."
sudo tee /etc/fail2ban/jail.local > /dev/null << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
backend = systemd

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

[apache]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/error.log
maxretry = 3

[nginx]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 3
EOF

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# 6. Create Network Monitoring Script
echo "Step 8: Creating network monitoring script..."
sudo tee /usr/local/bin/network-monitor.sh > /dev/null << 'EOF'
#!/bin/bash
# Network security monitoring script

LOG_FILE="/var/log/network-security.log"
DATE=$(date '+%Y-%m-%d %H:%M:%S')

echo "[$DATE] Starting network security monitoring..." >> $LOG_FILE

# Check for suspicious network connections
echo "[$DATE] Checking for suspicious connections..." >> $LOG_FILE
netstat -tuln | grep -E ':(22|23|21|25|53|80|443|993|995)' >> $LOG_FILE

# Check for failed SSH attempts
echo "[$DATE] Checking for failed SSH attempts..." >> $LOG_FILE
grep "Failed password" /var/log/auth.log | tail -10 >> $LOG_FILE

# Check for port scans
echo "[$DATE] Checking for port scans..." >> $LOG_FILE
grep "Port scan" /var/log/auth.log | tail -5 >> $LOG_FILE

# Check firewall status
echo "[$DATE] Checking firewall status..." >> $LOG_FILE
sudo ufw status >> $LOG_FILE

# Check fail2ban status
echo "[$DATE] Checking fail2ban status..." >> $LOG_FILE
sudo fail2ban-client status >> $LOG_FILE

echo "[$DATE] Network security monitoring completed" >> $LOG_FILE
EOF

sudo chmod +x /usr/local/bin/network-monitor.sh

# 7. Schedule Network Monitoring
echo "Step 9: Scheduling network monitoring..."
echo "0 */6 * * * /usr/local/bin/network-monitor.sh" | sudo crontab -

echo "Network security hardening completed successfully!"
echo "Features implemented:"
echo "- Disabled unnecessary network services"
echo "- Hardened SSH configuration"
echo "- Configured network security parameters"
echo "- Set up DNS security"
echo "- Installed and configured firewall (UFW)"
echo "- Configured fail2ban for intrusion prevention"
echo "- Set up network monitoring and logging"
echo ""
echo "Next steps:"
echo "1. Test SSH connection: ssh -p 2222 user@your-server"
echo "2. Check firewall status: sudo ufw status"
echo "3. Monitor logs: tail -f /var/log/network-security.log"
echo "4. Test fail2ban: sudo fail2ban-client status"

# Mini-Project: Network Protocol Security Assessment
// Assess the security of different network protocols and services

const protocolSecurityAssessment = {
    protocols: {
        http: {
            name: "HTTP",
            port: 80,
            encryption: false,
            authentication: false,
            securityLevel: "Low",
            vulnerabilities: ["Eavesdropping", "Man-in-the-middle", "Data tampering"],
            recommendations: ["Use HTTPS instead", "Implement proper authentication", "Use VPN"]
        },
        https: {
            name: "HTTPS",
            port: 443,
            encryption: true,
            authentication: true,
            securityLevel: "High",
            vulnerabilities: ["Certificate issues", "Weak ciphers", "Protocol downgrade"],
            recommendations: ["Use strong ciphers", "Keep certificates updated", "Implement HSTS"]
        },
        ssh: {
            name: "SSH",
            port: 22,
            encryption: true,
            authentication: true,
            securityLevel: "High",
            vulnerabilities: ["Weak keys", "Default credentials", "Protocol version"],
            recommendations: ["Use key-based auth", "Disable root login", "Use strong ciphers"]
        },
        ftp: {
            name: "FTP",
            port: 21,
            encryption: false,
            authentication: true,
            securityLevel: "Low",
            vulnerabilities: ["Plaintext transmission", "Brute force", "Data interception"],
            recommendations: ["Use SFTP/FTPS", "Implement strong passwords", "Use VPN"]
        },
        smtp: {
            name: "SMTP",
            port: 25,
            encryption: false,
            authentication: false,
            securityLevel: "Low",
            vulnerabilities: ["Spam", "Spoofing", "Data interception"],
            recommendations: ["Use SMTP over TLS", "Implement SPF/DKIM", "Use authentication"]
        }
    }
};

// Calculate protocol security score
function calculateProtocolScore(protocol) {
    let score = 0;
    
    // Encryption (40 points)
    if (protocol.encryption) score += 40;
    
    // Authentication (30 points)
    if (protocol.authentication) score += 30;
    
    // Port security (20 points)
    if (protocol.port >= 1024) score += 20; // Non-privileged port
    else if (protocol.port >= 1) score += 10; // Privileged port
    
    // Vulnerability count (10 points)
    const vulnCount = protocol.vulnerabilities.length;
    if (vulnCount === 0) score += 10;
    else if (vulnCount <= 2) score += 5;
    else if (vulnCount <= 4) score += 2;
    
    return Math.min(score, 100);
}

// Assess each protocol
console.log("NETWORK PROTOCOL SECURITY ASSESSMENT");
console.log("====================================");

Object.keys(protocolSecurityAssessment.protocols).forEach(key => {
    const protocol = protocolSecurityAssessment.protocols[key];
    const score = calculateProtocolScore(protocol);
    
    console.log(`
${protocol.name.toUpperCase()} (Port ${protocol.port}):`);
    console.log(`  Encryption: ${protocol.encryption ? 'Yes' : 'No'}`);
    console.log(`  Authentication: ${protocol.authentication ? 'Yes' : 'No'}`);
    console.log(`  Security Level: ${protocol.securityLevel}`);
    console.log(`  Security Score: ${score}/100`);
    console.log(`  Vulnerabilities: ${protocol.vulnerabilities.join(', ')}`);
    console.log(`  Recommendations: ${protocol.recommendations.join(', ')}`);
});

// Generate security recommendations
function generateSecurityRecommendations() {
    const recommendations = [
        "Replace HTTP with HTTPS for all web traffic",
        "Use SFTP or FTPS instead of FTP for file transfers",
        "Implement SSH key-based authentication",
        "Use SMTP over TLS for email transmission",
        "Disable unnecessary network services",
        "Implement network segmentation",
        "Use VPN for remote access",
        "Regularly update and patch network services",
        "Monitor network traffic for anomalies",
        "Implement proper firewall rules"
    ];
    
    return recommendations;
}

console.log("
GENERAL SECURITY RECOMMENDATIONS:");
const recommendations = generateSecurityRecommendations();
recommendations.forEach((rec, index) => {
    console.log(`${index + 1}. ${rec}`);
});

// Network security checklist
const networkSecurityChecklist = {
    basic: [
        "All services use encrypted protocols",
        "Strong authentication is implemented",
        "Unnecessary services are disabled",
        "Firewall is properly configured",
        "Regular security updates are applied"
    ],
    advanced: [
        "Network segmentation is implemented",
        "Intrusion detection system is active",
        "Network monitoring and logging enabled",
        "VPN is used for remote access",
        "Security policies are documented and enforced"
    ]
};

console.log("
NETWORK SECURITY CHECKLIST:");
console.log("Basic Security:");
networkSecurityChecklist.basic.forEach((item, index) => {
    console.log(`${index + 1}. ${item}`);
});

console.log("
Advanced Security:");
networkSecurityChecklist.advanced.forEach((item, index) => {
    console.log(`${index + 1}. ${item}`);
});