A collection of advanced Bash scripts designed to automate system administration, enforce security compliance, and streamline developer environments on Linux endpoints.
All scripts follow idempotent design patterns for Linux configuration management. Each solution is self-contained and generally consists of:
Script.sh: The main Bash script.- Detection Logic: Checks if the software/configuration already exists. If compliant, exits with code
0to prevent redundant executions. - Execution Logic: Installs packages, configures permissions (e.g., AppArmor, Polkit), and validates the result.
- Detection Logic: Checks if the software/configuration already exists. If compliant, exits with code
README.md: Detailed documentation explaining the script's logic, edge cases, and deployment method.
These scripts are platform-agnostic and have been deployed in production using:
- Microsoft Intune (Custom Scripts and Configuration Profiles)
- Canonical Landscape (Ubuntu/Linux environments)
- Manual Execution (Standard Bash)
These are the high-value, complex scripts that go beyond simple installations — they configure kernel-level security, enforce compliance policies, and implement the Principle of Least Privilege.
| Script | Description |
|---|---|
| Configure-GeminiCLI | Full Detect/Remediate package that audits and fixes Gemini CLI corporate licensing across all users, forcing GCP auth flow and fixing TLS issues. |
| Configure-LeastPrivilegeEnvironment | Uses Polkit and sudoers drop-in files to grant developers granular, passwordless access to OpenVPN, /etc/hosts, and Charles Proxy — without full root. |
| Configure-NTPServer | Compliance audit script that sanitizes NTP sources across chrony configs, removes legacy pools, and enforces the corporate time server with logging. |
| Block-USBStorage | Kernel-level USB mass storage block via module blacklisting (usb-storage, uas). |
| Enable-USBStorage | Reverts the USB block with kernel hot-reload (modprobe) — no reboot required. |
| Set-CorporateWallpaper | Downloads and applies corporate wallpaper across GNOME light/dark modes and the lock screen via gsettings. |
| Update-OS | Silent, non-interactive OS patching with dist-upgrade, --force-confold, and automatic cleanup. |
Software Catalog (Install/)
All installation scripts are organized under the Install/ directory with logical subcategories.
📱 Apps (Install/Apps/)
| Script | Description |
|---|---|
| Install-Slack | Advanced: RPM-to-DEB conversion via Alien, SUID fix for chrome-sandbox, and AppArmor exemption for Ubuntu 24.04+. |
| Install-Zoom | Direct .deb download from official Zoom URL with dependency resolution. |
| Install-GoogleChromeMDM | Installs Chrome Enterprise + Endpoint Verification and injects managed JSON policies (extensions, URL blocks, login restrictions). |
| Install-MicrosoftEdgeMDM | Installs Edge + Endpoint Verification with corporate JSON policy injection. |
| Install-VLCMediaPlayer | Standard VLC installation from native repositories. |
| Install-Flameshot | Flameshot screenshot tool installation. |
| Install-ChromeRemoteDesktop | Chrome Remote Desktop provisioning for remote support. |
🛠️ DevTools (Install/DevTools/)
| Script | Description |
|---|---|
| Install-VSCode | VS Code from the official Microsoft APT repository. |
| Install-DBeaverCE | DBeaver Community Edition from the official APT repository. |
| Install-DbGate | DbGate with Electron sandboxing fixes. |
| Install-Insomnia | Insomnia API client with AppArmor exemptions for Ubuntu 24.04+. |
| Install-GitHubDesktop | GitHub Desktop from the Shiftkey community repository. |
| Install-AntigravityIDE | Antigravity IDE with Electron sandbox fixes and per-user provisioning. |
💻 CLI (Install/CLI/)
| Script | Description |
|---|---|
| Install-Git | Git from the official ppa:git-core/ppa. |
| Install-GitHubCLI | GitHub CLI (gh) with architecture-aware APT repository setup. |
| Install-AntigravityCLI | Antigravity CLI with SHA512 integrity verification. |
| Install-ClaudeCode | Claude Code CLI with per-user shell integration via su impersonation. |
| Install-Terraform | Terraform from official HashiCorp APT repositories. |
🏗️ Runtimes (Install/Runtimes/)
| Script | Description |
|---|---|
| Install-DockerEngine | Docker CE with docker-compose and user group permissions. |
| Install-VirtualBox | VirtualBox with kernel module (DKMS) installation. |
| Install-NVMNode | NVM with LTS Node.js pre-installed for all users. |
| Install-PythonStack | Python 3, pip, and venv modules. |
| Install-PHPStack | PHP from Ondřej Surý PPA with automatic fallback. |
| Install-PHPComposer | Composer with SHA384 signature verification. |
| Install-DotNetSDK | .NET SDK from the Microsoft APT repository. |
| Install-MongoDBToolchain | MongoDB Server, Shell, and Compass with granular sudoers aliases. |
| Install-MySQLClient | MySQL client binaries and libraries. |
| Install-PostgreSQLClient | PostgreSQL client tools. |
🛡️ Agents (Install/Agents/)
| Script | Description |
|---|---|
| Install-SentinelOneEDR | SentinelOne EDR agent deployment with site token registration. |
| Install-AikidoScanner | Aikido Local Scanner with dynamic developer detection. |
| Install-SplunkUF | Splunk Universal Forwarder with deployment server configuration. |
| Install-RMMAgent | Generic RMM agent silent deployment. |
| Install-AWSVPN | AWS VPN Client with daemon management. |
As an Infrastructure and Endpoint Management Engineer, I focus on automating complex administrative tasks, ensuring security compliance, and providing a seamless experience for end-users. While I work heavily in the Microsoft ecosystem (Windows/Intune), I also build robust, OS-agnostic automations for Linux and macOS environments.
Contributions are welcome! Feel free to fork this repository, submit pull requests, or open issues with suggestions and improvements.
These scripts are provided as-is with no warranty. Always test in a non-production environment before deploying to your fleet. The author assumes no liability for any damage or data loss caused by the use of these scripts. Review and adapt each script to your specific environment and security policies before deployment.