#!/bin/bash
set -euo pipefail
shopt -s inherit_errexit

# shellcheck source=scripts/libcc
. /usr/lib/common-criteria/scripts/libcc

###########################################
# PAM configuration for CC configuration

check_30_cc_pam_config() {
	if ! grep -q "pam_pwquality.so" /etc/pam.d/common-password 2>/dev/null; then
		echo "pam_pwquality.so not configured in /etc/pam.d/common-password"
		return 1
	fi
	if ! grep -q "pam_pwhistory.so" /etc/pam.d/common-password 2>/dev/null; then
		echo "pam_pwhistory.so not configured in /etc/pam.d/common-password"
		return 1
	fi
	if ! grep -q "pam_loginuid.so.*require_auditd" /etc/pam.d/sshd 2>/dev/null; then
		echo "pam_loginuid.so require_auditd not configured in /etc/pam.d/sshd"
		return 1
	fi
	if ! systemctl is-active --quiet auditd; then
		echo "auditd is not running"
		return 1
	fi
}

apply_30_cc_pam_config() {
	# password quality check is always performed
	pam-config -a --pwquality --pwquality-retry=3 --pwquality-difok=3 --pwquality-minlen=12 --pwquality-dcredit=-1 --pwquality-ucredit=-1 --pwquality-lcredit=-1 --pwquality-ocredit=-1
	cc_echo "pam_pwquality.so configured for global service"

	# password history
	pam-config -a --pwhistory --pwhistory-use_authtok --pwhistory-enforce_for_root --pwhistory-remember=7
	cc_echo "pam_pwhistory.so configured for global service"

	# require auditd to be running for remote logins. pam_loginuid.so's
	# require_auditd option denies the whole session (not just this check)
	# if auditd isn't active at login time - applying it while auditd is
	# stopped would lock out every subsequent SSH login, including a
	# still-connected administrator's own session, so make sure auditd is
	# actually running first rather than trusting it already is.
	if ! systemctl is-active --quiet auditd; then
		systemctl enable --now auditd || {
			cc_echo "FAILED: could not start auditd - refusing to enable pam_loginuid's require_auditd (would lock out SSH logins)"
			return 1
		}
		cc_echo "auditd was not running - enabled and started it"
	fi

	pam-config --service sshd -a --loginuid --loginuid-require_auditd
	cc_echo "pam_loginuid.so configured for service sshd"

	check_30_cc_pam_config || {
		cc_echo "FAILED: PAM configuration does not verify after applying"
		return 1
	}
}

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
	cc_start_logging
	trap 'cc_exit $?' ERR
	apply_30_cc_pam_config
	cc_exit 0
fi
