#!/bin/sh

echo -n "Enter hostname: "
read SRVHOST
echo -n "Enter username: "
read USERNAME
echo -n "Enter password: "
read -s PASSW1
echo
echo -n "Verify password: "
read -s PASSW2
echo

if [ "$PASSW1" != "$PASSW2" ]; then
    echo "Passwords do not match."
    exit 1
fi

if [ "$PASSW1" == "" ]; then
    echo "Must specify a password."
    exit 1
fi

echo "Setting hostname..."
echo $SRVHOST > /etc/hostname
hostname -F /etc/hostname
sed -i -e "1s/^/127.0.0.1\t$SRVHOST\n/" /etc/hosts

echo "Adding management account..."
groupadd sshlogin
useradd -U -G users,sudo,sshlogin -s /bin/bash -m $USERNAME
echo "$USERNAME:$PASSW1" | chpasswd
chmod 750 /home/$USERNAME

echo "Disabling IPv6..."
echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.d/99-sysctl.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.d/99-sysctl.conf
echo "net.ipv6.conf.lo.disable_ipv6 = 1" >> /etc/sysctl.d/99-sysctl.conf

echo "Disabling su access..."
dpkg-statoverride --update --add root sudo 4750 /bin/su

echo "Securing shared memory..."
echo "none /run/shm tmpfs defaults,ro 0 0" >> /etc/fstab

echo "Configuring SSH..."
sed -i -e "s/Port 22/Port 3300/g" /etc/ssh/sshd_config
sed -i -e "s/PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config
sed -i -e "s/LoginGraceTime 120/LoginGraceTime 20/g" /etc/ssh/sshd_config
echo "AllowGroups sshlogin" >> /etc/ssh/sshd_config
sed -i -e "s!Subsystem sftp /usr/lib/openssh/sftp-server!Subsystem sftp internal-sftp!g" /etc/ssh/sshd_config
echo "Match User example_user" >> /etc/ssh/sshd_config
echo "  ChrootDirectory %h/public_html" >> /etc/ssh/sshd_config
echo "  X11Forwarding no" >> /etc/ssh/sshd_config
echo "  AllowAgentForwarding no" >> /etc/ssh/sshd_config
echo "  AllowTcpForwarding no" >> /etc/ssh/sshd_config
echo "  ForceCommand internal-sftp" >> /etc/ssh/sshd_config

echo "Installing ufw..."
apt-get install -y ufw
ufw allow 3300
echo "y" | ufw delete 2
echo "y" | ufw enable

echo "Restarting..."
shutdown -rf now