#!/bin/bash

SCRIPTVER="3.1"
export TZ="UTC"

osx_realpath() {
    [[ $1 = /* ]] && echo "$1" || echo "$PWD/${1#./}"
}

echo -e "This application will enable various security settings on your Mac. A reboot will be necessary at the end. To begin, please enter your password when prompted."
_pw="$(osascript -e 'Tell application "System Events" to display dialog "Your laptop password:" default answer "" with hidden answer' -e 'text returned of result' 2>/dev/null)"

echo
echo "Running as the following user:"
echo $_pw | sudo -Sp '' id -p

if [ $? -ne 0 ]
then
    echo
    echo "********************************************************"
    echo "*                                                      *"
    echo "*  ERROR: Please try again with the correct password.  *"
    echo "*                                                      *"
    echo "********************************************************"
    exit 1
fi

echo
echo "Enabling automatic updates..."
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true &> /dev/null
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true &> /dev/null
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true &> /dev/null
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true &> /dev/null
sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdate -bool true &> /dev/null
sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdateRestartRequired -bool true &> /dev/null

echo "Enabling Gatekeeper..."
sudo spctl --master-enable &> /dev/null

echo "Configuring firewall..."
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1

echo "Configuring screen saver..."
defaults write com.apple.screensaver askForPassword -int 1 &> /dev/null
defaults write com.apple.screensaver askForPasswordDelay -int 3 &> /dev/null
defaults write com.apple.screensaver idleTime 600 &> /dev/null
sudo pmset -b displaysleep 15 &> /dev/null
sudo pmset -c displaysleep 15 &> /dev/null

echo "Disabling Safari automatic file opening..."
defaults write com.apple.Safari AutoOpenSafeDownloads -boolean no &> /dev/null

echo "Disabling wake for access..."
sudo pmset -c womp 0 &> /dev/null

echo "Enabling secure trash..."
defaults write com.apple.finder EmptyTrashSecurely True &> /dev/null

echo "Enabling show all file extensions in Finder..."
defaults write NSGlobalDomain AppleShowAllExtensions True &> /dev/null

echo "Disabling core dumps..."
sudo launchctl limit core 0 &> /dev/null

echo "Enabling FileVault disk encryption..."
sudo fdesetup enable -defer /FileVaultRecoverKeyInfo.plist -showrecoverykey

echo "Adding sudo security setting..."
sudo grep -q 'tty_tickets' /etc/sudoers || sudo bash -c 'echo -e "\n## Auth0 settings\nDefaults    tty_tickets" >> /etc/sudoers'

echo
echo "*************************************************************"
echo "*                                                           *"
echo "*  Done! Please reboot so that these settings take effect.  *"
echo "*                                                           *"
echo "*  Tip: Use shift-control-power to lock your screen.        *"
echo "*       Press and hold each key in sequence, not all        *"
echo "*       at once.                                            *"
echo "*                                                           *"
echo "*************************************************************"
exit 0