#!/bin/bash

# Global variables
SSH_CONFIG_FILE="/etc/ssh/sshd_config"
PWQUALITY_CONF="/etc/security/pwquality.conf"
FAILLOCK_CONF="/etc/security/faillock.conf"
PAM_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
LOGIN_DEFS="/etc/login.defs"

# Function to backup a file
backup_file() {
    local file=$1
    local backup_file="$file.bak"
    cp "$file" "$backup_file"
}

# Function to update configuration files
update_config() {
    local file=$1
    local pattern=$2
    local value=$3

    backup_file "$file"
    sed -i -e "/^#$pattern.*/ {s/^#//; s/.*/$pattern $value/}" "$file"
}

# Function to update SSH configuration
update_ssh_config() {
    # Ensure PermitRootLogin is set to prohibit-password
    echo "PermitRootLogin prohibit-password" > "$SSH_CONFIG_FILE.d/01-permitrootlogin.conf"
    sed -i -e '/^#PermitRootLogin.*/ {s/^#//; s/.*/PermitRootLogin prohibit-password/}' "$SSH_CONFIG_FILE"

    # Change SSH port to 10022
    local port="10022"
    sed -i -e '/^#Port.*/ {s/^#//; s/.*/Port '"$port"'/}' "$SSH_CONFIG_FILE"
    setenforce 0
    systemctl restart sshd
}

# Function to update password complexity settings
update_password_complexity() {
    for file in "${PAM_FILES[@]}"; do
        backup_file "$file"
        echo "password    required    pam_pwquality.so enforce_for_root" >> "$file"
    done

    local retry_conf="3"
    local minlen_conf="9"
    local lcredit_conf="-1"
    local ucredit_conf="-1"
    local dcredit_conf="-1"
    local ocredit_conf="-1"

    update_config "$PWQUALITY_CONF" "retry" "$retry_conf"
    update_config "$PWQUALITY_CONF" "minlen" "$minlen_conf"
    update_config "$PWQUALITY_CONF" "lcredit" "$lcredit_conf"
    update_config "$PWQUALITY_CONF" "ucredit" "$ucredit_conf"
    update_config "$PWQUALITY_CONF" "dcredit" "$dcredit_conf"
    update_config "$PWQUALITY_CONF" "ocredit" "$ocredit_conf"
}

# Function to update account lock threshold settings
update_account_lock() {
    update_config "$FAILLOCK_CONF" "dir" ""
    update_config "$FAILLOCK_CONF" "audit" ""
    update_config "$FAILLOCK_CONF" "silent" ""
    update_config "$FAILLOCK_CONF" "even_deny_root" ""
}

# Function to update password policy
update_password_policy() {
    local pass_min_len_conf="9"
    local pass_max_days_conf="31"
    local pass_min_days_conf="1"

    update_config "$LOGIN_DEFS" "PASS_MIN_LEN" "$pass_min_len_conf"
    update_config "$LOGIN_DEFS" "PASS_MAX_DAYS" "$pass_max_days_conf"
    update_config "$LOGIN_DEFS" "PASS_MIN_DAYS" "$pass_min_days_conf"
}

# Function to remove unnecessary accounts
remove_unnecessary_accounts() {
    userdel -r lp >& /dev/null
    userdel -r ftp >& /dev/null
}

# Function to set session timeout
set_session_timeout() {
    local timeout="300"
    echo -e "\nexport TMOUT=$timeout" >> /etc/profile
    source /etc/profile
}

# Function to set file permissions
set_file_permissions() {
    chmod 640 /etc/rsyslog.conf
    chmod 644 /etc/exports
}

# Function to configure SUID, SGID, and permissions
configure_permissions() {
    local remove_list=("/sbin/dump" "/sbin/restore" "/sbin/unix_chkpwd" "/usr/bin/at" "/usr/bin/lpq" \
                       "/usr/bin/lpq-lpd" "/usr/bin/lpr" "/usr/bin/lpr-lpd" "/usr/bin/lprm" \
                       "/usr/bin/lprm-lpd" "/usr/bin/newgrp" "/usr/sbin/lpc" "/usr/sbin/lpc-lpd" \
                       "/usr/sbin/traceroute")

    for file in "${remove_list[@]}"; do
        chmod u-s "$file"
        chmod g-s "$file"
    done >& /dev/null
}

# Function to restrict access by IP and port
restrict_access() {
    # Add your IP and port restriction logic here
    # Example: iptables, firewalld, or other tools
    # This part needs to be customized based on your requirements
}

# Function to set UMASK
set_umask() {
    echo -e "\numask 022\nexport umask" >> /etc/profile
    source /etc/profile
}

# Function to configure NFS settings
configure_nfs() {
    local export_file="/etc/exports"
    local new_entry="/nfs 192.168.1.0/24 (rw,no_root_squash,async)"

    if [ -n "$(grep -E '\S' "$export_file")" ]; then
        sed -i "s@.*@$new_entry@" "$export_file"
    fi
}

# Function to configure at service
configure_at_service() {
    local at_bin="/usr/bin/at"
    local at_deny="/etc/at.deny"

    # Check if /usr/bin/at exists before changing permissions
    if [ -e "$at_bin" ]; then
        chmod 4750 "$at_bin"
    fi

    # Check if /etc/at.deny exists before changing permissions
    if [ -e "$at_deny" ]; then
        chmod 640 "$at_deny"
    fi
}

# Function to display warning message on login
display_warning_message() {
    local motd_file="/etc/motd"
    local issue_net_file="/etc/issue.net"
    local warning_message="
************************************************************
WARNING: This is a secure system. Unauthorized access is prohibited.
If you are not an authorized user, disconnect immediately.
All activities on this system are monitored and logged.
************************************************************
"

    if [ -e "$motd_file" ]; then
        echo "$warning_message" | sudo tee "$motd_file" > /dev/null
    fi

    if [ -e "$issue_net_file" ]; then
        echo "$warning_message" | sudo tee "$issue_net_file" > /dev/null
    fi
}

