#!/bin/bash
# DEVELOPER: Vaibhav K

echo "Security Check......................"

sleep 3s

#echo 'Y'| apt --fix-broken install
#echo 'Y'| apt-get upgrade

sleep 2s


chmod -R 755 /parablu-scripts
chmod 777 /parablu-scripts/Installable/scripts
chmod 777 /parablu-scripts/Installable/scripts/health_check
chmod 777 /parablu-scripts/Installable/scripts/health_check/consolidate
chmod 777 /parablu-scripts/Installable/scripts/PULL_LOGS
chmod 777 /parablu-scripts/Installable/scripts/summary

## Disabling root login
sshconf="/etc/securetty"
while read -r line;
        do
                case $line in
                        ''|\#*) continue ;;         ## skip blank lines and lines starting with ##
                esac

        echo $line | grep -e "console" -e "vc" -e tty[0-9][0-9] -e tty[0-9]
        if [ $? -ne 0 ]; then
                sed -i "/$line/d" $sshconf
                echo "Line is: $line"
        fi

        echo $line | grep -e tty[0-9][0-9]
        if [ $? -ne 0 ]; then
#                sed -i "/$line/d" $sshconf
                echo "Line is: $line"
        fi

        done < $sshconf

        sed -i '/lxc/d' $sshconf
	sed -i '/xvc/d' /etc/securetty
        sed -i '/hvc/d' /etc/securetty
        sed -i '/\/tty/d' /etc/securetty

        sed -i '/net.ipv4.conf.default.accept_redirects/d' /etc/sysctl.conf
        sed -i '/net.ipv4.conf.all.secure_redirects/d' /etc/sysctl.conf
        sed -i '/net.ipv4.conf.default.secure_redirects/d' /etc/sysctl.conf

        echo 'net.ipv4.conf.default.accept_redirects=0' >>/etc/sysctl.conf
        echo 'net.ipv4.conf.all.secure_redirects=0' >>/etc/sysctl.conf
        echo 'net.ipv4.conf.default.secure_redirects=0' >>/etc/sysctl.conf

sed -i "/PermitRootLogin.*/d" /etc/ssh/sshd_config
echo "PermitRootLogin no" >> /etc/ssh/sshd_config

#GSSAPIAuthentication DISABLING
sed -i 's|GSSAPIAuthentication yes|GSSAPIAuthentication no|' /etc/ssh/ssh_config

## Enabling GRUB Password

#grubConfFile="/etc/grub.d/40_custom"
#read -p "Enter username for setting up grup password:" grubuser

#grub-mkpasswd-pbkdf2 | tee grub
#if [ $? -ne 0 ]; then
#        rm grub
#        grub-mkpasswd-pbkdf2 | tee grub
#fi
#sed -i "s/PBKDF2 hash of your password is //" grub
#sed -i "/password/d" grub
#grubpassword=`cat grub`

#echo "set superusers=\"$grubuser\"
#password_pbkdf2 $grubuser $grubpassword" >>/etc/grub.d/40_custom

#sleep 2s
#update-grub

function enable_grub ()
{
tput clear
                echo "                                 =========================GRUB PASSWORD(OPTIONAL: LOCAL SERVERS ONLY)==================== "
read -p "Do you want to add GRUB password for bootloader(STRICTLY NOT RECOMMENDED FOR CLOUD BASED SERVERS...!!!): [ y/n]" confirmgrub

#### INVALID CHECK
	while [[ "$confirmgrub" != "N" ]] && [[ "$confirmgrub" != "y" ]] && [[ "$confirmgrub" != "Y" ]] && [[ "$confirmgrub" != "n" ]]; do
        	echo ""
                echo "INVALID INPUT"
                echo ""
                read -p "Do you want to add GRUB password for bootloader(STRICTLY NOT RECOMMENDED FOR CLOUD BASED SERVERS...!!!): [ y/n]" confirmgrub
                echo ""
        done
if [[ $confirmgrub = y ]] || [[ $confirmgrub = Y ]]; then

        ##new GRUB LOGIC
## Enabling GRUB Password

grubConfFile="/etc/grub.d/40_custom"
read -p "Enter username for setting up grup password:" grubuser
read -p "Enter Grub password:" grubpassword

echo "$grubpassword" >grub_input
echo "$grubpassword" >>grub_input

grubEncryptPassword=`cat grub_input | grub-mkpasswd-pbkdf2 | awk '/grub.pbkdf/{print$NF}'`

echo "set superusers=\"$grubuser\"
password_pbkdf2 $grubuser $grubEncryptPassword" >>/etc/grub.d/40_custom

sleep 1s
sed -i "2ipassword $grubpassword" /boot/grub/menu.lst

sleep 2s
update-grub

fi
if [[ $confirmgrub = n ]] || [[ $confirmgrub = N ]]; then
        echo "SKIPPING GRUB PASSWORD"
fi
}

enable_grub
sleep 3s
service ssh restart

### HTTP deny
ufw deny http


chmod -R 750 /home/parablu/

## ICMP REDIRECTION
sed -i '/#net.ipv4.conf.all.accept_redirects = 0/s/^#//g' /etc/sysctl.conf
sed -i '/#net.ipv6.conf.all.accept_redirects = 0/s/^#//g' /etc/sysctl.conf

sysctl -p
