#!/bin/bash

set -e

cd "`dirname $0`"

. resources/functions

cat <<EOF

Welcome to SSO-in-a-Box! This script configures a stock Ubuntu 12.10 install

into a working Kerberos, LDAP, RADIUS and WebAuth server. We'll ask you for

details on your domain and your first administrative account, then get started

creating things.

WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

>>>   If you have ANY existing LDAP or Kerberos database that you   <<<

>>>    want to save, EXIT THIS SCRIPT NOW by pressing Control-C.    <<<

WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

EOF

get_input()

{

	local var="$1"

	local prompt="$2"

	local prefill="${3:-}"

	[ -n "$prefill" ] && prompt="${prompt} [${prefill}]"

	eval "$var="\""$prefill"\"

	while true; do

		read -p "$prompt: " "$var"

		if [ -z "${!var}" ]; then

			if [ -n "$prefill" ]; then

				eval "$var="\""$prefill"\"

				break

			fi

		else

			break

		fi

		echo "Invalid input."

	done

}

get_input fullname "Your full name"

username=`echo "$fullname" | awk '{print $1;}' | tr '[A-Z]' '[a-z]'`

get_input username "Admin username" "$username"

password="`generate_password 16`"

#while true; do

#	stty -echo

#	get_input password "Admin password"

#	echo

#	get_input pconf "Confirm password"

#	stty echo; echo

#	[ "$password" = "$pconf" ] && break

#	echo "Passwords do not match."

#done

get_input domain "Domain name"

domain="`echo $domain | tr '[:upper:]' '[:lower:]'`"

ldap_suffix="dc=`echo $domain | sed -re 's/\./,dc=/g'`"

krb5_realm="`echo $domain | tr '[:lower:]' '[:upper:]'`"

echo "Your LDAP suffix is: $ldap_suffix"

echo "Your Kerberos V realm is: $krb5_realm"

echo "Setting up your /etc/hosts file"

patch_hosts_file

echo "Setting up your Kerberos V client config."

generate_krb5_config

echo "Updating apt, purging any existing SSO packages and installing stuff."

# silence apt etc.

export DEBIAN_FRONTEND=noninteractive

#apt-get update

apt-get remove --purge -y ${krb5_packages} ${ldap_packages} ${sasl_packages} \

		${radius_packages} ${http_packages}

apt-get install -y ${krb5_packages} ${ldap_packages} ${sasl_packages} screen \

		${radius_packages} build-essential libkrb5-dev libssl-dev acl \

		${http_packages} libnet-ldap-perl php5-ldap php5-dev libyaml-dev \

		libnl-dev

# stop any running services

if pidof apache2 > /dev/null; then

	invoke-rc.d apache2 stop

fi

if pidof freeradius > /dev/null; then

	invoke-rc.d freeradius stop

fi

if pidof kcrap_server > /dev/null; then

	killall kcrap_server

fi

if pidof saslauthd > /dev/null; then

	invoke-rc.d saslauthd stop

fi

if pidof slapd > /dev/null; then

	invoke-rc.d slapd stop

fi

if pidof krb5kdc > /dev/null; then

	invoke-rc.d krb5-kdc stop

fi

if pidof kadmind > /dev/null; then

	invoke-rc.d krb5-admin-server stop

fi

# LDAP setup

# remove any existing LDAP db

pidof slapd && killall -9 slapd

if [ -f /var/lib/ldap/__db.001 ]; then

	rm -fv /var/lib/ldap/__db.* \

		/var/lib/ldap/alock \

		/var/lib/ldap/dn2id.bdb \

		/var/lib/ldap/id2entry.bdb \

		/var/lib/ldap/log.* \

		/var/lib/ldap/objectClass.bdb

fi

ldap_manager_pw="`generate_password 40`"

echo -n "$ldap_manager_pw" > /etc/ldap.secret

chmod 600 /etc/ldap.secret

ldap_manager_pw_hash="`echo "$ldap_manager_pw" | slappasswd -T /etc/ldap.secret`"

ldap_reader_pw="`generate_password 10`"

if [ -d /etc/ldap/slapd.d ]; then

	rm -rfv /etc/ldap/slapd.d

fi

cp `dirname $0`/resources/openssh-lpk_openldap.schema /etc/ldap/schema/

generate_slapd_config

generate_base_ldif | slapadd

chown -R openldap:openldap /var/lib/ldap

if ! grep -q "KRB5_KTNAME=/etc/ldap" /etc/default/slapd; then

	echo 'export KRB5_KTNAME="FILE:/etc/ldap/keytab"' >> /etc/default/slapd

fi

cat <<EOF > /etc/ldap/sasl2/slapd.conf

pwcheck_method: saslauthd

saslauthd_path: /var/run/saslauthd/mux

EOF

# this allows slapd access to saslauthd's auth socket

gpasswd -a openldap sasl

# KDC setup

stash_pw="`generate_password 40`"

# seeds /dev/random rather nicely...

screen -dmS hasher sh -c "find /usr/lib/ /usr/share/ -print0 -type f | xargs -0 -n1 sha1sum"

if [ -f /var/lib/krb5kdc/principal ]; then

	rm -fv /var/lib/krb5kdc/principal \

			/var/lib/krb5kdc/principal.kadm5 \

			/var/lib/krb5kdc/principal.kadm5.lock \

			/var/lib/krb5kdc/principal.ok

fi

echo -en "${stash_pw}\n${stash_pw}\n" | kdb5_util create -s

echo -e "*/admin\t*" > /etc/krb5kdc/kadm5.acl

invoke-rc.d krb5-kdc start

invoke-rc.d krb5-admin-server start

kadmin.local -q "ank -pw "\""${password}"\"" $username"

webkerb_pw="`generate_password 40`"

kadmin.local -q "ank -pw "\""${webkerb_pw}"\"" webkerb/admin"

kadmin.local -q "ank -randkey host/ssoinabox.$domain"

[ -f /etc/krb5.keytab ] && rm -f /etc/krb5.keytab

kadmin.local -q "ktadd -norandkey -kt /etc/krb5.keytab host/ssoinabox.$domain"

kadmin.local -q "ank -randkey ldap/ssoinabox.$domain"

[ -f /etc/ldap/keytab ] && rm -f /etc/ldap/keytab

kadmin.local -q "ktadd -norandkey -kt /etc/ldap/keytab ldap/ssoinabox.$domain"

chown root:openldap /etc/ldap/keytab

chmod 640 /etc/ldap/keytab

echo "/etc/ldap/keytab rk," > "/etc/apparmor.d/local/usr.sbin.slapd"

invoke-rc.d apparmor restart

invoke-rc.d slapd start

# SASL setup

configure_saslauthd

invoke-rc.d saslauthd start

# KCRAP setup

build_kcrap > /dev/null

configure_kcrap

/usr/sbin/kcrap_server

# RADIUS setup

configure_freerad

invoke-rc.d freeradius start

# RADIUS tests

test_freerad

# generate web stuff

generate_web_yaml

# apache config

for module in rewrite authz_dbm webauth webkdc; do

	a2enmod $module

done

build_kadm5 > /dev/null

configure_webkdc

configure_webauth

configure_apache2

if pecl list | grep -q yaml; then

	pecl uninstall yaml

fi

yes "" | pecl install yaml > /dev/null

test -d /etc/php5/conf.d || mkdir /etc/php5/conf.d

echo "extension=yaml.so" > /etc/php5/conf.d/yaml.ini

cp `dirname $0`/resources/ldap-groups.db /etc/apache2/ldap-groups

# install packages

for d in packages/*; do

	cd $d

	./build

	cd ../..

done

find packages -name \*.deb -type f | xargs dpkg -i

/usr/local/share/ssoinabox/bin/ldap-groups-to-dbm

invoke-rc.d apache2 start

echo "Passwords to remember (WRITE THESE DOWN):"

echo "Kerberos master key:   $stash_pw"

echo "LDAP manager password: $ldap_manager_pw"

echo "LDAP reader DN:        cn=ldap-reader,ou=Roles,$ldap_suffix"

echo "LDAP reader password:  $ldap_reader_pw"

echo "Admin username:        $username"

echo "Admin password:        $password"

echo "Change your admin password by typing:"

echo "  kadmin.local -q "\""cpw $username"\"""