#!/bin/bash

KS=$1
test -f $KS || exit

echo "# KICKSTART FILE CREATED: $(date)" >> $KS

SYSTEMD_SERVICE_DISABLE="nftables cockpit nis-domainname"

echo "INFO: Change /boot partition"
sed -i 's|^part /boot .*|part /boot --fstype=xfs --size=2048|' $KS

echo "INFO: Change / partition"
sed -i 's|^logvol / .*|logvol / --fstype=xfs --name=root --vgname=VolGroup --size=20480|' $KS

echo "INFO: Change /home partition"
sed -i 's|^logvol /home .*|logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=2048 --fsoptions="nodev"|' $KS

echo "INFO: Change /tmp partition"
sed -i 's|^logvol /tmp .*|logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"|' $KS

echo "INFO: Change /var/tmp partition"
sed -i 's|^logvol /var/tmp .*|logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec"|' $KS

echo "INFO: Change /var partition"
sed -i 's|^logvol /var .*|logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048|' $KS

echo "INFO: Change /var/log partition"
sed -i 's|^logvol /var/log .*|logvol /var/log --fstype=xfs --name=varlog --vgname=VolGroup --size=2048|' $KS

echo "INFO: Change /var/log/audit partition"
sed -i 's|^logvol /var/log/audit .*|logvol /var/log/audit --fstype=xfs --name=varlogaudit --vgname=VolGroup --size=512|' $KS

echo "INFO: Remove admin user"
sed -i '/^user --name=admin.*/ s/^/#/' $KS

#echo "INFO: Remove zerombr, it is a risk with shared disks"
#sed -i '/^zerombr/ s/^/#/' $KS

#echo "INFO: Remove clearpart, it is a risk with shared disks"
#sed -i '/^clearpart/ s/^/#/' $KS

echo "INFO: Set Timezone"
sed -i 's#^timezone .*#timezone --utc Europe/Vaduz#' $KS

# remove unwanted services from firewalld public zone
sed -i 's#^firewall .*#firewall --enabled --ssh --remove-service cockpit,dhcpv6-client#' $KS

echo "INFO: Set Grub password in kickstart"
read -sp "Enter Grub Password: " grub_pw
echo 
GRUB_HASH=$(echo -e "$grub_pw\n$grub_pw" | grub2-mkpasswd-pbkdf2 | awk '/PBKDF2/ {print $NF}')
sed -i "s|^bootloader --password.*|bootloader --password=$GRUB_HASH --iscrypted|" $KS
#echo "INFO: Remove Grub password in kickstart"
#sed -i '/^bootloader --password/ s/^/#/' $KS

echo "INFO: Set root password in kickstart"
read -sp "Enter new root password: " root_pw
echo
root_hash=$(openssl passwd -6 "$root_pw")
sed -i "s|^rootpw --iscrypted.*|rootpw --iscrypted $root_hash|" $KS

echo "INFO: disable unwanted services"
echo "services --disabled=$(echo $SYSTEMD_SERVICE_DISABLE | tr ' ' ','  )" >> $KS
echo >> $KS

grep -1 '%post' $KS
if [ $? -ne 0 ]
then
echo "INFO: Add post install section"
cat <<EOF >> $KS
%post

# xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
echo '
# Per : Set retry = 3 in /etc/security/pwquality.conf
retry = 3
' >> /etc/security/pwquality.conf

# mask services
for svc in $SYSTEMD_SERVICE_DISABLE
do
  /usr/bin/systemctl mask \$svc || true
done  

# set firewalld default zone to drop and allow ssh
#sed -i 's/^DefaultZone=.*/DefaultZone=drop/' /etc/firewalld/firewalld.conf
#firewall-cmd --add-service=ssh --zone=drop --permanent

# restrict firewalld loopback traffic
#firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
#firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop'
#firewall-cmd --permanent --zone=trusted --add-interface=lo

# set max password age to 365d
sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS   365/' /etc/login.defs
var_accounts_maximum_age_login_defs='365'
while IFS= read -r i; do
    chage -M \$var_accounts_maximum_age_login_defs \$i
done <   <(awk -v var="\$var_accounts_maximum_age_login_defs" -F: '(/^[^:]+:[^!*]/ && (\$5 > var || \$5 == "")) {print \$1}' /etc/shadow)

# set password min age to 1d
sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS   1/' /etc/login.defs
var_accounts_minimum_age_login_defs='1'
while IFS= read -r i; do
    chage -m \$var_accounts_minimum_age_login_defs \$i
done <   <(awk -v var="\$var_accounts_minimum_age_login_defs" -F: '(/^[^:]+:[^!*]/ && (\$4 < var || \$4 == "")) {print \$1}' /etc/shadow)

# reset root password to update the "last changed" timestamp
usermod -p '$root_hash' root

%end
EOF

fi
