~sinfallas/+junk/sinfallas-base

#!/usr/bin/env bash
# Made by Sinfallas <sinfallas@yahoo.com>
# Licence: GPL-2
LC_ALL=C
mylog="/var/log/$(basename "$0").log"
LOCKFILE="/tmp/$(basename $0)_$(whoami)"
source /usr/bin/mivariable

function calcmem() {
	mb=$(( memor * 1024 ))
	mf=$(( memor * 3/100 ))
	fm=$(( mb * 256 / 4194304 ))
	mt=$(( fm * 2 ))
	page_size=$(getconf PAGE_SIZE)
	phys_pages=$(getconf _PHYS_PAGES)
	shmall=$(( phys_pages / 2 ))
	shmmax=$(( shmall * page_size ))
	echo "kernel.shmmax = $shmmax" > "$name"
	echo "kernel.shmall = $shmall" >> "$name"
	echo "vm.min_free_kbytes = $mf" >> "$name"
	echo "fs.file-max = $fm" >> "$name"
	echo "net.ipv4.tcp_max_tw_buckets = $mt" >> "$name"
	if (( memor < 1024000 )); then
	        echo "vm.dirty_ratio = 30" >> "$name"
	        echo "vm.dirty_background_ratio = 3" >> "$name"
	        echo "vm.dirty_expire_centisecs = 750" >> "$name"
	        echo "vm.dirty_writeback_centisecs = 125" >> "$name"
	else
	        if (( memor > 4096000 )); then
	            echo "vm.swappiness = 10" >> "$name"
	            echo "vm.vfs_cache_pressure = 50" >> "$name"
	        fi
	        if (( memor < 8192000 )); then
	            echo "vm.dirty_ratio = 25" >> "$name"
	            echo "vm.dirty_background_ratio = 4" >> "$name"
	            echo "vm.dirty_expire_centisecs = 1500" >> "$name"
	            echo "vm.dirty_writeback_centisecs = 250" >> "$name"
	        else
	            echo "vm.dirty_ratio = 20" >> "$name"
	            echo "vm.dirty_background_ratio = 5" >> "$name"
	            echo "vm.dirty_expire_centisecs = 3000" >> "$name"
	            echo "vm.dirty_writeback_centisecs = 500" >> "$name"
	        fi
	fi
}
function clean_1() {
	rm -f /run/$(basename "$0").pid
	rm -rf /tmp/*
	rm -rf /var/tmp/*
	rm -f "$LOCKFILE"
}
trap "clean_1; exit" 0 1 2 3 15
siroot
focal
echo "$BASHPID" > /run/$(basename "$0").pid
exec 2>>"$mylog"
echo "Iniciando optimizacion."
if ! [[ -d /etc/sysctl.d ]]; then
	mkdir -p /etc/sysctl.d
fi
## fstab
if ! [[ -f $miroot/fs.custom ]]; then
	if [[ -z $(grep -i 'devtmpfs /dev devtmpfs' $fst) ]]; then
		echo "devtmpfs /dev devtmpfs mode=0755,nosuid,noexec,rw,relatime,inode64 0 0" >> "$fst"
	else
		sed -i '/devtmpfs \/dev devtmpfs/d' "$fst"
		echo "devtmpfs /dev devtmpfs mode=0755,nosuid,noexec,rw,relatime,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /tmp tmpfs' $fst) ]]; then
		echo "tmpfs /tmp tmpfs rw,nodev,noatime,nosuid,noexec,mode=666,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/tmp tmpfs/d' "$fst"
		echo "tmpfs /tmp tmpfs rw,nodev,noatime,nosuid,noexec,mode=666,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /var/cache/samba tmpfs' $fst) ]]; then
		echo "tmpfs /var/cache/samba tmpfs rw,noatime,nodev,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/var\/cache\/samba tmpfs/d' "$fst"
		echo "tmpfs /var/cache/samba tmpfs rw,noatime,nodev,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /var/cache/apt/archives tmpfs' $fst) ]]; then
		echo "tmpfs /var/cache/apt/archives tmpfs rw,noatime,nodev,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/var\/cache\/apt\/archives tmpfs/d' "$fst"
		echo "tmpfs /var/cache/apt/archives tmpfs rw,noatime,nodev,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /var/cache/apt/apt-fast tmpfs' $fst) ]]; then
		echo "tmpfs /var/cache/apt/apt-fast tmpfs rw,noatime,nodev,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/var\/cache\/apt\/apt-fast tmpfs/d' "$fst"
		echo "tmpfs /var/cache/apt/apt-fast tmpfs rw,noatime,nodev,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /var/tmp tmpfs' $fst) ]]; then
		echo "tmpfs /var/tmp tmpfs rw,noexec,nodev,noatime,nosuid,mode=1666,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/var\/tmp tmpfs/d' "$fst"
		echo "tmpfs /var/tmp tmpfs rw,noexec,nodev,noatime,nosuid,mode=1666,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /run tmpfs' $fst) ]]; then
		echo "tmpfs /run tmpfs rw,nosuid,noexec,nodev,noatime,mode=655,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/run tmpfs/d' "$fst"
		echo "tmpfs /run tmpfs rw,nosuid,noexec,nodev,noatime,mode=655,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /dev/shm tmpfs' $fst) ]]; then
		echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/dev\/shm tmpfs/d' "$fst"
		echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec,inode64 0 0" >> "$fst"
	fi
	if [[ -z $(grep -i 'tmpfs /run/shm tmpfs' $fst) ]]; then
		echo "tmpfs /run/shm tmpfs ro,noexec,nosuid,noatime,nodev,mode=666,inode64 0 0" >> "$fst"
	else
		sed -i '/tmpfs \/run\/shm tmpfs/d' "$fst"
		echo "tmpfs /run/shm tmpfs ro,noexec,nosuid,noatime,nodev,mode=666,inode64 0 0" >> "$fst"
	fi
	for j in ${quienh[@]}; do
		miid=$(id -u $j)
		if (( memor > 4096000 )); then
			if [[ -z $(grep -i "tmpfs /home/$j/" $fst) ]]; then
				echo "tmpfs /home/$j/.cache tmpfs noatime,noexec,nosuid,nodev,rw,mode=700,uid=$miid,gid=$miid,inode64 0 0" >> "$fst"
			else
				sed -i "/tmpfs \/home\/$j\/.cache/d" "$fst"
				echo "tmpfs /home/$j/.cache tmpfs noatime,noexec,nosuid,nodev,rw,mode=700,uid=$miid,gid=$miid,inode64 0 0" >> "$fst"
			fi
		fi
	done
fi
## initramfs
if [[ -f /usr/share/initramfs-tools/scripts/functions ]]; then
	sed -i 's/ln -s "$0" \/tmp\/mountroot-fail-hooks.d\/"$0"/ln -s "$0" \/tmp\/mountroot-fail-hooks.d\/"$1"/g' /usr/share/initramfs-tools/scripts/functions
fi
if [[ -f /etc/initramfs-tools/initramfs.conf ]]; then
	#sed -i 's/MODULES=most/MODULES=dep/g' /etc/initramfs-tools/initramfs.conf
	if ! [[ -z $(blkid | grep swap | grep PARTUUID | awk '{print $2}' | sed 's/.$//g' | cut -d '"' -f2) ]]; then
		echo "RESUME=UUID=$(blkid | grep swap | grep PARTUUID | awk '{print $2}' | sed 's/.$//g' | cut -d '"' -f2)" > /etc/initramfs-tools/conf.d/resume
		update-initramfs -c -k all
	fi
fi
for j in ${quienh[@]}; do
	mbash="/home/"$j"/.bashrc"
	mssh="/home/"$j"/.ssh"
	if ! [[ -f /home/"$j"/.gnupg/gpg.conf.old ]]; then
		mkdir -p /home/"$j"/.gnupg
		mv -f /home/"$j"/.gnupg/gpg.conf /home/"$j"/.gnupg/gpg.conf.old
		cp -f /usr/share/gpg.conf.sample /home/"$j"/.gnupg/gpg.conf
		chown -R "$j":"$j" /home/"$j"/.gnupg
		chmod -R 700 /home/"$j"/.gnupg
	fi
	if ! [[ -d /home/"$j"/.config/autostart ]]; then
		mkdir -p /home/"$j"/.config/autostart
	fi
	mkdir -p "$mssh"
	chown -R "$j":"$j" "$mssh"
	chmod -R 700 "$mssh"
	if [[ -z $(grep -i "export GTK_IM_MODULE=xim" $mbash) ]]; then
		echo "export GTK_IM_MODULE=xim" >> "$mbash"
		echo "export XMODIFIERS=@im=ibus" >> "$mbash"
		echo "export QT_IM_MODULE=ibus" >> "$mbash"
	fi
done
if [[ $(dpkg --get-selections | grep -w "ssh" | awk '{print $1}' | head -1) = ssh ]]; then
	if ! [[ -f /etc/ssh/moduli.old ]]; then
		awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.tmp
		mv -f /etc/ssh/moduli /etc/ssh/moduli.old
		mv -f /etc/ssh/moduli.tmp /etc/ssh/moduli
	fi
fi
ssh-keygen -A
if ! [[ -f /usr/bin/mizram ]]; then
	ln -s /etc/init.d/mizram /usr/bin/mizram
fi

## module blacklist
if [[ -z $(grep -i "blacklist cramfs" $black) ]]; then
	echo "blacklist cramfs" >> "$black"
fi
if [[ -z $(grep -i "install cramfs /bin/true" $black) ]]; then
	echo "install cramfs /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist freevxfs" $black) ]]; then
	echo "blacklist freevxfs" >> "$black"
fi
if [[ -z $(grep -i "install freevxfs /bin/true" $black) ]]; then
	echo "install freevxfs /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist hfs" $black) ]]; then
	echo "blacklist hfs" >> "$black"
fi
if [[ -z $(grep -i "install hfs /bin/true" $black) ]]; then
	echo "install hfs /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist hfsplus" $black) ]]; then
	echo "blacklist hfsplus" >> "$black"
fi
if [[ -z $(grep -i "install hfsplus /bin/true" $black) ]]; then
	echo "install hfsplus /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist jffs2" $black) ]]; then
	echo "blacklist jffs2" >> "$black"
fi
if [[ -z $(grep -i "install jffs2 /bin/true" $black) ]]; then
	echo "install jffs2 /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist udf" $black) ]]; then
	echo "blacklist udf" >> "$black"
fi
if [[ -z $(grep -i "install udf /bin/true" $black) ]]; then
	echo "install udf /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist dccp" $black) ]]; then
	echo "blacklist dccp" >> "$black"
fi
if [[ -z $(grep -i "install dccp /bin/true" $black) ]]; then
	echo "install dccp /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist sctp" $black) ]]; then
	echo "blacklist sctp" >> "$black"
fi
if [[ -z $(grep -i "install sctp /bin/true" $black) ]]; then
	echo "install sctp /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist rds" $black) ]]; then
	echo "blacklist rds" >> "$black"
fi
if [[ -z $(grep -i "install rds /bin/true" $black) ]]; then
	echo "install rds /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist tipc" $black) ]]; then
	echo "blacklist tipc" >> "$black"
fi
if [[ -z $(grep -i "install tipc /bin/true" $black) ]]; then
	echo "install tipc /bin/true" >> "$black"
fi
if [[ -z $(grep -i "blacklist lp" $black) ]]; then
	echo "blacklist lp" >> "$black"
fi
if [[ -z $(grep -i "install lp /bin/true" $black) ]]; then
	echo "install lp /bin/true" >> "$black"
fi
if [[ -z $(grep -i "alias rotorar='unrar e -kb -y'" $etbah) ]]; then
	echo "alias rotorar='unrar e -kb -y'" >> "$etbah"
fi
if [[ -z $(grep -i 'export HISTIGNORE="ls:clear"' $etbah) ]]; then
	echo 'export HISTIGNORE="ls:clear"' >> "$etbah"
fi
if [[ -z $(grep -i "shopt -s checkwinsize" $etbah) ]]; then
	echo "shopt -s checkwinsize" >> "$etbah"
fi
if [[ -z $(grep -i "HISTFILESIZE=2000" $etbah) ]]; then
	echo "HISTFILESIZE=2000" >> "$etbah"
fi
if [[ -z $(grep -i "HISTSIZE=1000" $etbah) ]]; then
	echo "HISTSIZE=1000" >> "$etbah"
fi
if [[ -z $(grep -i "HISTCONTROL=ignoreboth" $etbah) ]]; then
	echo "HISTCONTROL=ignoreboth" >> "$etbah"
fi
if ! [[ -z $(lscpu | grep GenuineIntel) ]]; then
	if [[ -z $(grep -i 'INTEL_BATCH="1"' /etc/environment) ]]; then
		echo 'INTEL_BATCH="1"' >> /etc/environment
	fi
fi
if [[ -z $(grep -i 'PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin"' /etc/profile) ]]; then
	echo 'PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin"' >> /etc/profile
fi
if [[ -z $(grep -i "#kernel.kptr_restrict = 1" /etc/sysctl.d/10-kernel-hardening.conf) ]]; then
	sed -i 's/kernel.kptr_restrict =.*/#kernel.kptr_restrict = 1/g' /etc/sysctl.d/10-kernel-hardening.conf
fi
if [[ -z $(grep -i "#kernel.sysrq = 176" /etc/sysctl.d/10-magic-sysrq.conf) ]]; then
	sed -i 's/kernel.sysrq =.*/#kernel.sysrq = 176/g' /etc/sysctl.d/10-magic-sysrq.conf
fi
if [[ -z $(grep -i "#net.ipv4.conf.default.rp_filter=2" /etc/sysctl.d/10-network-security.conf) ]]; then
	sed -i 's/net.ipv4.conf.default.rp_filter=.*/#net.ipv4.conf.default.rp_filter=2/g' /etc/sysctl.d/10-network-security.conf
fi
if [[ -z $(grep -i "#net.ipv4.conf.all.rp_filter=2" /etc/sysctl.d/10-network-security.conf) ]]; then
	sed -i 's/net.ipv4.conf.all.rp_filter=.*/#net.ipv4.conf.all.rp_filter=2/g' /etc/sysctl.d/10-network-security.conf
fi
if [[ -z $(grep -i "#kernel.yama.ptrace_scope = 1" /etc/sysctl.d/10-ptrace.conf) ]]; then
	sed -i 's/kernel.yama.ptrace_scope =.*/#kernel.yama.ptrace_scope = 1/g' /etc/sysctl.d/10-ptrace.conf
fi
if [[ -z $(grep -i 'WARNING: unauthorized access to this system is prohibited.' /etc/issue) ]]; then
	echo 'WARNING: unauthorized access to this system is prohibited.' >> /etc/issue
fi
if [[ -z $(grep -i 'WARNING: unauthorized access to this system is prohibited.' /etc/issue.net) ]]; then
	echo 'WARNING: unauthorized access to this system is prohibited.' >> /etc/issue.net
fi
if [[ -z $(grep -i '#Listen localhost:631' /etc/cups/cupsd.conf) ]]; then
	sed -i 's/Listen localhost:631/#Listen localhost:631/g' /etc/cups/cupsd.conf
	chmod 600 /etc/cups/cupsd.conf
fi
if [[ -f /usr/bin/as ]]; then
	chmod 744 /usr/bin/as
fi
if [[ -f /etc/init.d/rc ]]; then
	sed -i 's/umask.*/umask 027/g' /etc/init.d/rc
fi
if [[ -f /etc/cups/cups-browsed.conf ]]; then
	sed -i 's/BrowseRemoteProtocols.*/BrowseRemoteProtocols none/g' /etc/cups/cups-browsed.conf
	sed -i 's/# BrowseProtocols.*/BrowseProtocols none/g' /etc/cups/cups-browsed.conf
fi
if [[ -f /etc/avahi/avahi-daemon.conf ]]; then
	sed -i 's/#host-name=foo/enable-dbus=no/g' /etc/avahi/avahi-daemon.conf
fi
if [[ -f $logd ]]; then
	sed -i 's/# SHA_CRYPT_MIN_ROUNDS.*/SHA_CRYPT_MIN_ROUNDS 8000/g' "$logd"
	sed -i 's/# SHA_CRYPT_MAX_ROUNDS.*/SHA_CRYPT_MAX_ROUNDS 10000/g' "$logd"
	sed -i 's/PASS_MAX_DAYS.*/PASS_MAX_DAYS\t180/g' "$logd"
	sed -i 's/PASS_MIN_DAYS.*/PASS_MIN_DAYS\t1/g' "$logd"
	sed -i 's/UMASK\t\t022/UMASK\t\t027/g' "$logd"
	if [[ -z $(grep -i 'HOME_MODE 0750' $logd) ]]; then
		echo "HOME_MODE 0750" >> "$logd"
	fi
fi
if [[ -f $miadd ]]; then
	sed -i 's_DSHELL=/bin/bash_DSHELL=/usr/bin/fish_g' "$miadd"
	sed -i 's/DIR_MODE=.*/DIR_MODE=0750/g' "$miadd"
fi
if [[ -f /etc/default/keyboard ]]; then
	sed -i 's/XKBOPTIONS=.*/XKBOPTIONS="terminate:ctrl_alt_bksp"/g' /etc/default/keyboard
fi
if [[ -f /etc/passwd ]]; then
	sed -i 's_/bin/bash_/usr/bin/fish_g' /etc/passwd
fi
if [[ -f /etc/default/prelink ]]; then
	sed -i 's/PRELINKING=.*/PRELINKING=yes/g' /etc/default/prelink
	sed -i 's/PRELINK_OPTS=.*/PRELINK_OPTS=-amfR/g' /etc/default/prelink
fi
if [[ -f $rkh ]]; then
	sed -i 's\UPDATE_MIRRORS=.*\UPDATE_MIRRORS=1\g' "$rkh"
	sed -i 's\MIRRORS_MODE=.*\MIRRORS_MODE=0\g' "$rkh"
	sed -i 's\WEB_CMD="/bin/false"\#WEB_CMD="/bin/false"\g' "$rkh"
	sed -i 's\SCRIPTWHITELIST=/usr/bin/egrep\SCRIPTWHITELIST=/bin/egrep\g' "$rkh"
	sed -i 's\SCRIPTWHITELIST=/usr/bin/fgrep\SCRIPTWHITELIST=/bin/fgrep\g' "$rkh"
	sed -i 's\#SCRIPTWHITELIST=/usr/sbin/prelink\SCRIPTWHITELIST=/usr/sbin/prelink\g' "$rkh"
fi
if [[ -f /etc/default/motd-news ]]; then
	sed -i 's\ENABLED=.*\ENABLED=0\g' /etc/default/motd-news
fi
if [[ -f /etc/xdg/autostart/tracker-miner-fs-3.desktop ]]; then
	mv -f /etc/xdg/autostart/tracker-miner-fs-3.desktop $miroot/
	mv -f /etc/xdg/autostart/tracker-extract.desktop $miroot/
	mv -f /etc/xdg/autostart/tracker-miner-apps.desktop $miroot/
	mv -f /etc/xdg/autostart/tracker-miner-user-guides.desktop $miroot/
	mv -f /etc/xdg/autostart/tracker-store.desktop $miroot/
	mv -f /etc/xdg/autostart/org.gnome.DejaDup.Monitor.desktop $miroot/
	mv -f /etc/xdg/autostart/org.gnome.Evolution-alarm-notify.desktop $miroot/
	chmod 666 /usr/libexec/tracker-miner-fs
	chmod 666 /usr/libexec/tracker-miner-fs-3
	chmod 666 /usr/libexec/tracker-extract
	chmod 666 /usr/libexec/tracker-extract-3
	chmod 666 /usr/libexec/tracker-writeback
	chmod 666 /usr/libexec/tracker-writeback-3
	echo "TimeoutStartSec=2" >> /usr/share/dbus-1/services/org.freedesktop.Tracker1.service
fi
if ! [[ -f /etc/systemd/coredump.conf.d/custom.conf ]]; then
	mkdir -p /etc/systemd/coredump.conf.d/
	echo "[Coredump]" > "$cuscore"
	echo "Storage=none" >> "$cuscore"
	echo "ProcessSizeMax=0" >> "$cuscore"
fi
if [[ -z $(grep -i 'apparmor=1 lsm=lockdown,yama,apparmor' $mgrub) ]]; then
	sed -i 's/GRUB_TIMEOUT_STYLE=.*/GRUB_TIMEOUT_STYLE=menu/g' "$mgrub"
	sed -i 's/GRUB_TIMEOUT=.*/GRUB_TIMEOUT=3/g' "$mgrub"
	if [[ -f $miroot/onipv6.custom ]]; then
		sed -i 's/net.ipv6.conf.all.disable_ipv6 = 1/#net.ipv6.conf.all.disable_ipv6 = 1/g' /etc/sysctl.d/30-mio.conf
		sed -i 's/net.ipv6.conf.default.disable_ipv6 = 1/#net.ipv6.conf.default.disable_ipv6 = 1/g' /etc/sysctl.d/30-mio.conf
		sed -i 's/net.ipv6.conf.lo.disable_ipv6 = 1/#net.ipv6.conf.lo.disable_ipv6 = 1/g' /etc/sysctl.d/30-mio.conf
		sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 rd.systemd.show_status=auto rd.udev.log_level=3 apparmor=1 lsm=lockdown,yama,apparmor panic=10 quiet"/g' "$mgrub"
	else
		sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 rd.systemd.show_status=auto rd.udev.log_level=3 apparmor=1 lsm=lockdown,yama,apparmor ipv6.disable=1 panic=10 quiet"/g' "$mgrub"
	fi
	update-grub2
fi
if [[ -z $(grep -i "sensors-detect" /etc/modules) ]]; then
	yes | sensors-detect
fi
if [[ -f /etc/NetworkManager/NetworkManager.conf.old ]]; then
	#sed '/^plugins=*/a dns=dnsmasq' /etc/NetworkManager/NetworkManager.conf > /etc/NetworkManager/NetworkManager.conf.new
	mv -f /etc/NetworkManager/NetworkManager.conf /etc/NetworkManager/NetworkManager.conf.old
	#mv -f /etc/NetworkManager/NetworkManager.conf.new /etc/NetworkManager/NetworkManager.conf
	echo "[main]" > /etc/NetworkManager/NetworkManager.conf
	echo "dns=none" >> /etc/NetworkManager/NetworkManager.conf
	echo "rc-manager=unmanaged" >> /etc/NetworkManager/NetworkManager.conf
	echo "" >> /etc/NetworkManager/NetworkManager.conf
	echo "[ifupdown]" >> /etc/NetworkManager/NetworkManager.conf
	echo "managed=false" >> /etc/NetworkManager/NetworkManager.conf
	echo "" >> /etc/NetworkManager/NetworkManager.conf
	echo "[device]" >> /etc/NetworkManager/NetworkManager.conf
	echo "wifi.scan-rand-mac-address=no" >> /etc/NetworkManager/NetworkManager.conf
fi

echo "interface=lo" > "$dnsmas"
echo "bind-interfaces" >> "$dnsmas"
echo "bogus-priv" >> "$dnsmas"
echo "cache-size=2048" >> "$dnsmas"
echo "listen-address=127.0.0.1" >> "$dnsmas"
echo "server=76.76.19.19" >> "$dnsmas"
echo "server=94.140.14.14" >> "$dnsmas"
echo "conf-file=/etc/trust-anchors.conf" >> "$dnsmas"
echo "#dnssec" >> "$dnsmas"
echo "#dnssec-check-unsigned" >> "$dnsmas"
echo "no-resolv" >> "$dnsmas"
echo "all-servers" >> "$dnsmas"
echo "local-ttl=60" >> "$dnsmas"
echo "log-facility=/var/log/dnsmasq.log" >> "$dnsmas"
echo "address=/localhost/127.0.0.1" >> "$dnsmas"

echo "[Resolve]" > "$reso"
echo "DNS=127.0.0.1" >> "$reso"
echo "FallbackDNS=76.76.19.19 94.140.14.14" >> "$reso"
echo "DNSSEC=allow-downgrade" >> "$reso"
echo "DNSOverTLS=opportunistic" >> "$reso"
echo "options edns0 trust-ad" >> "$reso"
echo "search ." >> "$reso"

if [[ -z $(grep -i "DefaultTimeoutStopSec=10s" $syst) ]]; then
	echo "[Manager]" > "$syst"
	echo "DumpCore=no" >> "$syst"
	echo "CtrlAltDelBurstAction=none" >> "$syst"
	echo "CrashShell=no" >> "$syst"
	echo "DefaultLimitCORE=0" >> "$syst"
	echo "DefaultLimitNOFILE=1024" >> "$syst"
	echo "DefaultLimitNPROC=1024" >> "$syst"
	echo "DefaultTimeoutStopSec=10s" >> "$syst"
fi
if [[ -z $(grep -i "password requisite retry=3 minlen=15 difok=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1" $cpas) ]]; then
	echo "password [success=1 default=ignore] pam_unix.so sha512 remember=5 rounds=65536" > "$cpas"
	echo "password requisite pam_deny.so" >> "$cpas"
	echo "password required pam_permit.so" >> "$cpas"
	echo "password optional pam_gnome_keyring.so" >> "$cpas"
fi

if [[ -z $(grep -i "* soft priority 0" $limi) ]]; then
	echo "# /etc/security/limits.conf" > "$limi"
	echo "* soft core 0" >> "$limi"
	echo "* hard core 0" >> "$limi"
	echo "* hard nice -19" >> "$limi"
	echo "root hard nice -20" >> "$limi"
	echo "* hard nproc 1000" >> "$limi"
	echo "* soft nofile 2000" >> "$limi"
	echo "* hard nofile 2000" >> "$limi"
	echo "* hard maxlogins 10" >> "$limi"
	echo "* soft priority 0" >> "$limi"
	echo "# End of file" >> "$limi"
fi

if [[ -z $(grep -i "kernel/security/lockdown = confidentiality" $sysf) ]]; then
	echo "kernel/mm/transparent_hugepage/enabled = always" > "$sysf"
	echo "kernel/mm/transparent_hugepage/khugepaged/pages_to_scan = 20000" >> "$sysf"
	echo "kernel/mm/ksm/run = 1" >> "$sysf"
	echo "kernel/mm/ksm/pages_to_scan = 20000" >> "$sysf"
	echo "kernel/mm/ksm/sleep_millisecs = 200" >> "$sysf"
fi

if [[ -z $(grep -i "USE_RSYNC=true" $log2) ]]; then
	echo "SIZE=512M" > "$log2"
	echo "USE_RSYNC=true" >> "$log2"
	echo "MAIL=false" >> "$log2"
	echo 'PATH_DISK="/var/log"' >> "$log2"
	echo "ZL2R=false" >> "$log2"
	echo "COMP_ALG=lz4" >> "$log2"
	echo "LOG_DISK_SIZE=500M" >> "$log2"
fi

echo "[Journal]" > "$jour"
echo "SystemMaxUse=50M" >> "$jour"
echo "Storage=persistent" >> "$jour"
echo "ForwardToSyslog=yes" >> "$jour"
echo "Compress=yes" >> "$jour"
echo "PERCENTAGE=2" > /etc/default/zramswap
echo "PRIORITY=10" >> /etc/default/zramswap
echo "multi on" > /etc/host.conf
echo "order hosts,bind" >> /etc/host.conf
echo "[Unit]" > "$milog"
echo "Description=Log2Ram" >> "$milog"
echo "DefaultDependencies=no" >> "$milog"
echo "Before=basic.target rsyslog.service syslog-ng.service syslog.target systemd-journald.service sysinit.target shutdown.target zram-swap-conf.service apache2.service lighttpd.service" >> "$milog"
echo "After=local-fs.target" >> "$milog"
echo "Conflicts=shutdown.target reboot.target halt.target" >> "$milog"
echo "RequiresMountsFor=/var/log /var/hdd.log" >> "$milog"
echo "IgnoreOnIsolate=yes" >> "$milog"
echo "OnFailure=log2ramrecover.service" >> "$milog"
echo " " >> "$milog"
echo "[Service]" >> "$milog"
echo "Type=oneshot" >> "$milog"
echo "ExecStart= /usr/local/bin/log2ram start" >> "$milog"
echo "ExecStop= /usr/local/bin/log2ram stop" >> "$milog"
echo "ExecReload= /usr/local/bin/log2ram write" >> "$milog"
echo "TimeoutStartSec=120" >> "$milog"
echo "RemainAfterExit=yes" >> "$milog"
echo "Restart=on-failure" >> "$milog"
echo " " >> "$milog"
echo "[Install]" >> "$milog"
echo "WantedBy=sysinit.target" >> "$milog"
sed -i '/lp/d' "$emod"
sed -i "s/127.0.0.1.*/127.0.0.1\tlocalhost $HOSTNAME/g" /etc/hosts
sed -i "s/127.0.1.1.*/127.0.1.1\t$HOSTNAME/g" /etc/hosts
sed -i 's/rotate.*/rotate 1/g' $logr
sed -i 's/weekly/daily/g' $logr
sed -i 's_include /etc/logrotate 1_include /etc/logrotate.d_g' $logr
sed -i 's/rotate 7/rotate 1/g' /etc/logrotate.d/rsyslog
sed -i 's/rotate 4/rotate 1/g' /etc/logrotate.d/rsyslog
sed -i 's/weekly/daily/g' /etc/logrotate.d/rsyslog
sed -i 's/#SystemMaxFiles=.*/SystemMaxFiles=7/g' /etc/systemd/journald.conf
sed -i 's/AutoEnable=.*/AutoEnable=false/g' /etc/bluetooth/main.conf
sed -i 's/PresentControllerPolicy=.*/PresentControllerPolicy=apply-policy/g' /etc/usbguard/usbguard-daemon.conf
sed -i 's/# dictcheck = 1/dictcheck=1/g' $mipw
sed -i 's/# minlen = 8/minlen = 15/g' $mipw
sed -i 's/# enforcing = 1/enforcing = 1/g' $mipw
sed -i 's/# lcredit = 0/lcredit = -1/g' $mipw
sed -i 's/# dcredit = 0/dcredit = -1/g' $mipw
sed -i 's/# ucredit = 0/ucredit = -1/g' $mipw
sed -i 's/# ocredit = 0/ocredit = -1/g' $mipw
sed -i 's/# difok = 1/difok = 8/g' $mipw
sed -i 's_//Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";_Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";_g' $muna
sed -i 's_//Unattended-Upgrade::Remove-Unused-Dependencies "false";_Unattended-Upgrade::Remove-Unused-Dependencies "true";_g' $muna
chown root /var/log
chgrp syslog /var/log
chgrp adm /var/log/syslog
chmod 444 /usr/libexec/evolution-calendar-factory
chmod 750 /home/*
sed -i 's/port    = ssh/port    = 2222/g' /etc/fail2ban/jail.conf
cp -f /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
calcmem
passwd -l root
# reactivar root: passwd -u root
ufw logging off
# reactivar registro de ufw: ufw logging low
dbus-uuidgen > /var/lib/dbus/machine-id
for i in ${quienh[@]}; do
	firecfg --add-users "$i"
done
firecfg
apparmor_parser -r /etc/apparmor.d/firejail-default
aa-enforce firejail-default
echo "apparmor" > /etc/firejail/globals.local
if [[ -z $(grep -i "apparmor" /etc/firejail/globaltime.profile) ]]; then
	echo "apparmor" >> /etc/firejail/globaltime.profile
fi
if [[ -z $(grep -i "# apparmor" /etc/firejail/default.profile) ]]; then
	echo "apparmor" >> /etc/firejail/default.profile
fi
rm -f /usr/lib/sysctl.d/*
if [[ -f /usr/share/fish/vendor_conf.d/snapd.fish ]]; then
	mv -f /usr/share/fish/vendor_conf.d/snapd.fish /root/
fi
myservices
## activar servicios
systemctl daemon-reload
systemctl enable upower
systemctl enable rsyslog
systemctl mask dnsmasq
systemctl mask systemd-resolved
systemctl mask ufw
systemctl enable btrfsmaintenance-refresh.path
systemctl enable acpid.service
## reiniciar servicios
sysctl --system > /dev/null
systemctl restart systemd-journald
systemctl restart log2ram.service
systemctl restart cups.service
systemctl restart systemd-resolved.service
systemctl restart sysfsutils.service
systemctl restart logrotate.service
systemctl restart usbguard.service
systemctl restart fail2ban.service
systemctl mask fwupd-offline-update.service
systemctl unmask fwupd.service
systemctl enable fwupd.service
if [[ -f $miroot/lowram.custom ]]; then
	echo "Se detecto el archivo lowram.custom y se procede a desactivar servicios."
	systemctl mask log2ram
	systemctl mask fail2ban
	systemctl mask haveged.service
	systemctl mask ksm.service
	systemctl mask ksmtuned.service
	systemctl mask libvirt-guests.service
	systemctl mask libvirtd.service
	systemctl mask openvpn.service
	systemctl mask qemu-kvm.service
	systemctl mask usbguard-dbus.service
	systemctl mask usbguard.service
	systemctl mask lxc-net.service
	systemctl mask lxc.service
	systemctl mask lxcfs.service
	nosnap
	systemctl mask docker
	systemctl mask containerd
	systemctl mask anydesk.service
fi
echo "Finalizado."