#!/bin/bash

# ./lab7-check.bash

# Author:  Murray Saul
# Date:    June 28, 2016
# Modified: November 27, 2020 (Chris Johnson)
#
# Purpose: 

# Function to indicate OK (in green) if check is true; otherwise, indicate
# WARNING (in red) if check is false and end with false exit status

logfile=/root/lab7_output.txt

function check(){

  if eval $1
  then
     echo -e "\e[0;32mOK\e[m"
  else
     echo
     echo
     echo -e "\e[0;31mWARNING\e[m"
     echo
     echo
     echo $2
     echo
     exit 1
  fi

} # end of check() function

clear  # Clear the screen
cat <<+
ATTENTION:

In order to run this shell script, please
have the following information ready:

 - Your c7host and ALL of your VMs are running.
   
 - Your centos1 username.
   You were instructed to have the IDENTICAL usernames
   and passwords for ALL of these Linux servers. If not
   login into each VM, switch to root, and use the commands:

   useradd -m [regular username]
   passwd [regular username]

   Before proceeding.

After reading the above steps, press ENTER to continue
+
read null
clear

# Make certain user is logged in as root
if [ $USER != "root" ]
then
  echo "Note: You are required to run this program as root."
  exit 1
fi

# System information gathering
echo "OPS235 Lab 7 Check Script" > $logfile
echo | tee -a $logfile
echo "SYSTEM INFORMATION:" | tee -a $logfile
#echo "------------------------------------" | tee -a $logfile
hostnamectl | tee -a $logfile
echo -n "              Date: "  | tee -a $logfile
date | tee -a $logfile
echo | tee -a $logfile

# Start checking lab7
echo "CHECKING YOUR LAB 7 WORK:" | tee -a $logfile
echo | tee -a $logfile


# Check myfile.txt copied to user's Matrix home directory
echo "Checking file \"myfile.txt\" copied to user's Matrix home directory: " | tee -a $logfile
read -p "Enter your username for matrix: " matrixUserName
check "ssh $matrixUserName@matrix.senecacollege.ca ls /home/$matrixUserName/myfile.txt > /dev/null 2>/dev/null" "This program did not detect the file called \"myfile.txt\" in your Matrix account's home directory. Please make corrections, and re-run this checking shell script." | tee -a $logfile

# Check that the account "other" was created
echo "Checking that the user called \"other\" was created: " | tee -a $logfile
read -p "Enter your username for your centos1 VM: " centos1UserName
check "ssh $centos1UserName@centos1 grep -sq other /etc/passwd" "This program did not detect the user called \"other\" in your centos1 VM. Please make corrections, and re-run this checking shell script." | tee -a $logfile

# Check that PermitRootLogin in /etc/ssh/sshd_config file was set to no
echo "Checking \"PermitRootLogin\" set to \"no\" (sshd_config backup): " | tee -a $logfile
check "ssh $centos1UserName@centos1 grep -qsi PermitRootLogin.*no /home/$centos1UserName/sshd_config.bk" "This program did not detect the option \"PermitRootLogin\" was set to \"no\" in the \"/home/$centos1UserName/sshd_config.bk\" file in your centos1 VM. Please make corrections, and re-run this checking shell script." | tee -a $logfile

# Check that account called other is AllowUsers in sshd_config file
echo "Checking user \"other\" added to \"AllowUsers\" option (sshd_config backup): " | tee -a $logfile
check "ssh $centos1UserName@centos1 grep -sq AllowUsers.*other.* /home/$centos1UserName/sshd_config.bk" "This program did not detect the option \"AllowUsers\" including the \"other\" account in the \"/home/$centos1UserName/check_ssh.bk\" file in your centos1 VM. Please make corrections, and re-run this checking shell script." | tee -a $logfile

# Check that public key created in centos2 VM
echo "Checking that public key created in \"centos2\" VM: " | tee -a $logfile
check "ssh $centos1UserName@centos2 ls /home/$centos1UserName/.ssh/id_rsa.pub > /dev/null" "This program did not detect the public key \"/home/$centos1UserName/.ssh/id_rsa.pub\" in the centos2 VM. Please make corrections, and re-run this checking shell script." | tee -a $logfile

# Check that public key copied to the centos3 VM
echo "Checking that public key copied to the \"centos3\" VM: " | tee -a $logfile
check "ssh ops235@centos3 ls /home/ops235/.ssh/authorized_keys > /dev/null" "This program did not detect the public key \"/home/ops235/.ssh/authorized_keys\" in the centos3 VM. Please make corrections, and re-run this checking shell script." | tee -a $logfile

# Have student run the command to remotely run gedit application
cat <<+
You will now be required to run the ssh command using tunnelling to
run the gedit application from centos1, but display in your c7host machine.
Type the command at the prompt below:

+
read -p "Enter ssh command here: " studentCommand
until [ "$studentCommand" = "ssh -X -C $centos1UserName@centos1 gedit" -o "$studentCommand" = "ssh -C -X $centos1UserName@centos1 gedit" -o "$studentCommand" = "ssh -XC $centos1UserName@centos1 gedit" -o "$studentCommand" = "ssh -CX $centos1UserName@centos1 gedit" ]
do
   echo "Error: Refer to lab7 to run gedit command remotely via ssh" | tee -a $logfile
   read -p "Enter correct ssh command with gedit argument here: " studentCommand
done

ssh -f -X -C $centos1UserName@centos1 gedit > /dev/null 2> /dev/null && echo -e "\e[0;32mOK\e[m" | tee -a $logfile

# check for iptables policy
echo -n "Checking for history of setting of default iptables policy: " | tee -a $logfile
check "history | grep 'iptables -P INPUT DROP' | head -1" "This program did not detect when viewing results from the \"history\" command the iptables command: \"iptables -P INPUT DROP\". Please make corrections, REBOOT your c7host machine, and re-run this checking shell script." | tee -a $logfile

# check for iptables exception web traffic
echo -n "Checking for history of setting web traffic exception: " | tee -a $logfile
check "history | grep 'iptables -A INPUT.*-p.*tcp.*--dport.*80.*ACCEPT' | head -1" "This program did not detect when viewing results from the \"history\" command the iptables command: \"iptables -A INPUT -p tcp --dport 80 -j ACCEPT\". Please make corrections, REBOOT your c7host machine, and re-run this checking shell script." | tee -a $logfile

# check for iptables exception for pinging
echo -n "Checking for history of setting ping exception: " | tee -a $logfile
check "history | grep -sq 'iptables -A INPUT.*-p.*icmp.*ACCEPT' | head -1" "This program did not detect when viewing results from the \"history\" command the iptables command: \"iptables -A INPUT -p icmp -s {lab-mates external-facing ip address} -j ACCEPT\". Please make corrections, REBOOT your c7host machine,  and re-run this checking shell script." | tee -a $logfile

# check for iptables exception for ssh
echo -n "Checking for history of setting SSH exception: " | tee -a $logfile
check "history | grep -sq 'iptables -A INPUT.*-p.*tcp.*--dport.*22.*ACCEPT' | head -1" "This program did not detect when viewing results from the \"history\" command the iptables command: \"iptables -A INPUT -p tcp -s {lab-mates external-facing ip address} --dport 22 -j ACCEPT\". Please make corrections, REBOOT your c7host machine, and re-run this checking shell script." | tee -a $logfile

# check for backing up iptables file to a backup file
echo -n "Checking for history of backing up iptables rules to a file: " | tee -a $logfile
check "history | grep -sq 'iptables-save > /etc/sysconfig/iptables.bk' | head -1" "This program did not detect when viewing results from the \"history\" command the iptables command: \"iptables-save > /etc/sysconfig/iptables.bk\". Please make corrections, REBOOT your c7host machine, and re-run this checking shell script." | tee -a $logfile

# check for making iptables rules persistent
echo -n "Checking for history for making iptables rules persistent: " | tee -a $logfile
check "history | grep -sq 'iptables-save > /etc/sysconfig/iptables' | head -1" "This program did not detect when viewing results from the \"history\" command the iptables command: \"iptables-save > /etc/sysconfig/iptables\". Please make corrections, REBOOT your c7host machine, and re-run this checking shell script." | tee -a $logfile

echo | tee -a $logfile
echo | tee -a $logfile
echo "Congratulations!" | tee -a $logfile
echo | tee -a $logfile
echo "You have successfully completed Lab 7." | tee -a $logfile
echo "1. Submit a screenshot of your entire desktop (including this window) to your course professor." | tee -a $logfile
echo "2. A copy of this script output has been created at /root/lab7_output.txt. Submit this file along with your screenshot." | tee -a $logfile
echo