#!/sbin/sh
#*******************************************************************************
#
#	Name:			%M%
#	SCCS Id:		%W%	%G%
#
#	Description:	This file is a script for system set up, phase 2.  Phase 2
#					is immediately after the latest Recommended and Security
#					patch clusters have been installed, and the system has
#					been rebooted so they take effect.
#					
#
#			Copyright © 2000 - 2002 by Rich Teer.  All rights reserved.
#
#*******************************************************************************


OS_REL=`uname -r`
ARCH=`uname -m`
HOSTNAME=`uname -n`
IS_ROUTER=false
DEFAULT_DOMAIN="richteer.ca"
DEFAULT_MAILSERVER="mail"
DEFAULT_NS1="192.168.0.1"
DEFAULT_NS2="192.9.9.3"
LOGINLOG="/var/adm/loginlog"
INETD_CONF="/etc/inet/inetd.conf"
DUMP_DATES="/etc/dumpdates"
RESOLV_CONF="/etc/resolv.conf"
SENDMAIL_PKGS="SUNWsndmu SUNWsndmr"
SYSTEM="/etc/system"
SYS_USER_SHELL="/opt/local/bin/noshell"
SYS_USERS=`awk -F: '{print $1}' /etc/passwd`
BACKUP_USER="backup"
BACKUP_GROUP="sys"
BACKUP_UID=500
NTP_CONF="/etc/inet/ntp.conf"
NTP_DRIFT="/etc/inet/ntp.drift"
NTP_KEYS="/etc/inet/ntp.keys"

echo "Starting system hardening for $HOSTNAME, Phase 2"

echo "Enter default DNS domain [$DEFAULT_DOMAIN]: \c"
read LINE
DOMAIN=${LINE:-$DEFAULT_DOMAIN}
echo "Enter first DNS name server [$DEFAULT_NS1]: \c"
read LINE
NS1=${LINE:-$DEFAULT_NS1}
echo "Enter second DNS name server [$DEFAULT_NS2]: \c"
read LINE
NS2=${LINE:-$DEFAULT_NS2}

echo "Checking if Sendmail is installed...  \c"
pkginfo -q $SENDMAIL_PKGS
SENDMAIL_INSTALLED=$?
if [ "$SENDMAIL_INSTALLED" = "0" ]; then
	echo "Yes."
	echo "Remove Sendmail [y]: \c"
	read LINE
	RM_SENDMAIL=${LINE:-y}
	if [ "$RM_SENDMAIL" != "y" ]; then
		echo "Enter mail server [$DEFAULT_MAILSERVER]: \c"
		read LINE
		MAILSERVER=${LINE:-$DEFAULT_MAILSERVER}
	fi
else
	echo "No."
fi

echo "Adding backup user...  \c"
useradd -c "Tape backup user" -g $BACKUP_GROUP -u $BACKUP_UID -s /bin/ksh $BACKUP_USER
echo "Done."

echo "Modifying /etc/system...  \c"
echo "\n" >> $SYSTEM
echo "forceload: misc/obpsym" >> $SYSTEM
case "$OS_REL" in
	'5.5.1' | '5.6' | '5.7')
		echo "set priority_paging = 1" >> $SYSTEM
		;;

	*)
		;;
esac
echo "set noexec_user_stack = 1" >> $SYSTEM
echo "set nfssrv:nfs_portmon = 1" >> $SYSTEM
echo "set noexec_user_stack_log = 1" >> $SYSTEM
echo "\n" >> $SYSTEM
echo "set shmsys:shminfo_shmmax = 268435456" >> $SYSTEM
echo "set shmsys:shminfo_shmseg = 100" >> $SYSTEM
echo "Done."

echo "Setting TCP_STRONG_ISS...  \c"
ed /etc/default/inetinit << EOF > /dev/null
g/^TCP_STRONG_ISS/s/=1/=2/
w
q
EOF
echo "Done."

if [ "$IS_ROUTER" = "false" ]; then
	echo "Disabling IP forwarding...  \c"
	touch /etc/notrouter
	echo "Done."
fi

echo "Creating /etc/resolv.conf...  \c"
echo "domain		\c" > $RESOLV_CONF
echo $DOMAIN >> $RESOLV_CONF
echo "nameserver	\c" >> $RESOLV_CONF
echo $NS1 >> $RESOLV_CONF
echo "nameserver	\c" >> $RESOLV_CONF
echo $NS2 >> $RESOLV_CONF
echo "Done."

echo "Adding dns to hosts line in /etc/nsswitch.conf...  \c"
ed /etc/nsswitch.conf << EOF > /dev/null
g/^hosts:/s/files/files dns/
w
q
EOF
echo "Done."

#echo "Clearing crontabs...  \c"
#CWD=`pwd`
#cd /var/spool/cron/crontabs
#for i in *;do
#	if [ "$i" != "root" ]; then
#		rm $i
#	fi
#done
#cd $CWD
#echo "Done."

echo "Enabling loginlog... \c"
touch $LOGINLOG
chmod 600 $LOGINLOG
chgrp sys $LOGINLOG
echo "Done."

case $OS_REL in
	'5.5' | '5.5.1' | '5.6' | '5.7')
		echo "Fixing /etc permissions...  \c"
		chmod -R g-w /etc
		echo "Done."

		echo "Fixing /etc/dumpdates permissions...  \c"
		chmod 664 $DUMP_DATES
		echo "Done."
		;;

	*)
		;;
esac

echo "Enabling auth.info in /etc/syslog.conf...  \c"
ed /etc/syslog.conf << EOF > /dev/null
g/^#auth.notice/s/#auth.notice/auth.info/
w
q
EOF
echo "Done."

echo "Building /opt/local directory tree:"
echo "    Making directories."
mkdir -m 755 /opt/local
mkdir -m 755 /opt/local/bin
mkdir -m 755 /opt/local/etc
mkdir -m 755 /opt/local/lib
mkdir -m 755 /opt/local/lib/sparcv9
mkdir -m 755 /opt/local/man
mkdir -m 755 /opt/local/sbin
FLAG=false
echo "    Copying files: \c"
cat phase2_files-$OS_REL/INDEX | while read SRC DEST OWNER GROUP PERMS; do
	if [ $FLAG = "false" ]; then
		echo "$SRC\c"
		FLAG=true
	else
		echo ", $SRC\c"
	fi
	cp phase2_files-$OS_REL/$SRC $DEST
	chown $OWNER:$GROUP $DEST
	chmod $PERMS $DEST
done
echo "."
case $OS_REL in
	'5.5' | '5.5.1' | '5.6' | '5.7')
		ln /opt/local/bin/gunzip /opt/local/bin/gzip
		;;

	*)
		;;
esac
ln -s ../init.d/openssh /etc/rc2.d/S99openssh
echo "Done."

echo "Creating /opt/local/lib symbolic links for $ARCH...  \c"
case $ARCH in
	sun4u)
		rm /opt/local/lib/libcrypto.so.0.9.6
		rm /opt/local/lib/libssl.so.0.9.6
		ln -s sparcv9/libcrypto.so /opt/local/lib/libcrypto.so.0.9.6
		ln -s sparcv9/libssl.so /opt/local/lib/libssl.so.0.9.6
		ln -s libcrypto.so.0.9.6 /opt/local/lib/libcrypto.so
		ln -s libssl.so.0.9.6 /opt/local/lib/libssl.so
		;;

	*)
		ln -s libcrypto.so.0.9.6 /opt/local/lib/libcrypto.so
		ln -s libssl.so.0.9.6 /opt/local/lib/libssl.so
		;;
esac
echo "Done."

echo "Setting system users' shell to $SYS_USER_SHELL...  \c"
for i in $SYS_USERS; do
	if [ "$i" != "root" ]; then
		usermod -s $SYS_USER_SHELL $i
	fi
done
echo "Done."

case $OS_REL in
	'5.5' | '5.5.1')
		;;

	*)
		echo "Setting up NTP client...  \c"
		echo "multicastclient 224.0.1.1" > $NTP_CONF
		echo "" >> $NTP_CONF
		echo "enable auth" >> $NTP_CONF
		echo "keys $NTP_KEYS" >> $NTP_CONF
		echo "trustedkey 1" >> $NTP_CONF
		echo "driftfile $NTP_DRIFT" >> $NTP_CONF
		echo "1 M TrustMe!" > $NTP_KEYS
		touch $NTP_DRIFT
		chown root:other $NTP_CONF $NTP_KEYS $NTP_DRIFT
		chmod 400 $NTP_CONF $NTP_KEYS
		chmod 644 $NTP_DRIFT
		echo "Done."
		;;
esac

if [ "$SENDMAIL_INSTALLED" = "0" ]; then
	if [ "$RM_SENDMAIL" = "y" ]; then
		echo "Removing Sendmail packages...  \c"
		echo "setuid=nocheck" > /tmp/admin.$$
		echo "rdepend=nocheck" >> /tmp/admin.$$
		pkgrm -a /tmp/admin.$$ -n $SENDMAIL_PKGS > /dev/null 2>&1
		rm -f /tmp/admin.$$
		echo "Done."
	else
		echo "Building null client sendmail.cf...  \c"
		CWD=`pwd`
		cd /usr/lib/mail/cf
		echo "#" > nullclient.mc
		echo "# This file directs all outgoing email" >> nullclient.mc
		echo "# to the mail server \"$MAILSERVER\"." >> nullclient.mc
		echo "#\n" >> nullclient.mc
		echo "OSTYPE(solaris2.ml)dnl" >> nullclient.mc
		echo "FEATURE(\`nullclient', \`$MAILSERVER')dnl" >> nullclient.mc
		chown root:mail nullclient.mc
		chmod 444 nullclient.mc
		/usr/ccs/bin/m4 ../m4/cf.m4 nullclient.mc > nullclient.cf
		chown root:mail nullclient.cf
		chmod 444 nullclient.cf
		cp -p nullclient.cf /etc/mail/sendmail.cf
		cd $CWD
		echo "Done."
		echo "Preventing Sendmail from starting in daemon mode...  \c"
		mv /etc/rc2.d/S88sendmail /etc/rc2.d/s88sendmail
		echo "Done."
	fi
fi

echo "Setting up inetd.conf...  \c"
mv $INETD_CONF $INETD_CONF.orig
echo "#" > $INETD_CONF
echo "# Rstatd is used by programs such as perfmeter." >> $INETD_CONF
echo "#" >> $INETD_CONF
echo "rstatd/2-4 tli rpc/datagram_v wait root /usr/lib/netsvc/rstat/rpc.rstatd rpc.rstatd" >> $INETD_CONF

case $OS_REL in
	'5.5' | '5.5.1')
		;;

	*)
		echo "#" >> $INETD_CONF
		echo "# Time service is used for clock synchronization." >> $INETD_CONF
		echo "#" >> $INETD_CONF
		echo "time	stream	tcp6	nowait	root	internal" >> $INETD_CONF
		echo "time	dgram	udp6	wait	root	internal" >> $INETD_CONF
		;;
esac
chown root:sys $INETD_CONF
chmod 444 $INETD_CONF
echo "Done."

# echo "Configuring TCP Wrapper...  \c"
# cp $INETD_CONF /tmp
# sed '/^[^#]/s/^/#/' /tmp/inetd.conf > $INETD_CONF
# chgrp sys $INETD_CONF
# chmod 111 $INETD_CONF
# echo "Done."

case $OS_REL in
	'5.5' | '5.5.1' | '5.6' | '5.7' | '5.8')
		echo "Configuring OpenSSH (this may take a while)...  \c"
		mkdir -m 755 /etc/ssh
		echo "ssh		22/tcp" >> /etc/services
		echo "DenyUsers					\c" >> /etc/sshd.conf
		echo $SYS_USERS >> /etc/sshd.conf
		/opt/local/bin/ssh-keygen -b 1024 -t rsa1 -f /etc/ssh/ssh_host_key -N "" > /dev/null
		/opt/local/bin/ssh-keygen -b 1024 -t rsa -f /etc/ssh/ssh_host_rsa_key -N "" > /dev/null
		/opt/local/bin/ssh-keygen -b 1024 -t dsa -f /etc/ssh/ssh_host_dsa_key -N "" > /dev/null
		echo "Done."
		;;

	*)
		;;
esac


sync

echo "\n"
echo "Phase 2 of the system hardening for $HOSTNAME is complete."
echo ""
echo "By default, all services in /etc/inet/inetd.conf have"
echo "been disabled.  You will have to manually enable the"
echo "services you want, not forgetting to put them under"
echo "the control of /opt/local/sbin/tcpd."
echo ""
echo "You should examine /etc/rc2.d and /etc/rc3.d, and make"
echo "sure that only those services you need are enabled."
echo "You should also check that /etc/defaultrouter contains"
echo "the right IP address for your router."
echo ""
echo "If you use the backup user, remember to add tapehost to the"
echo "~/.ssh/known_hosts2, and generate the ssh keys."
echo ""
echo "Finally, you should now install your server applications,"
echo "e.g., Apache, BIND, Sendmail, etc."
echo ""
echo "Now is probably a good time to reboot this machine,"
echo "to ensure that nothing has gone awry."