#!/bin/sh

set_minlen(){
        #=======================================================
        InsertSection "set password minlen"

        #IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep pam_pwquality.so | grep -w minlen=$MINLEN |wc -l`
        IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep $1 | grep -w minlen=$MINLEN |wc -l`
        if [ "${IS_EXIST}" = "0" ] ; then
            Display --indent 2 --text "- Set password minlen failed... " --result FAILED --color RED
        else
            Display --indent 2 --text "- Set password minlen finished... " --result FINISHED --color GREEN
        fi
}

set_ucredit(){
        #=======================================================
        InsertSection "set password ucredit"

        IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#"  |grep $1 | grep -w ucredit=$UCREDIT |wc -l`
        if [ "${IS_EXIST}" = "0" ] ; then
            Display --indent 2 --text "- Set password ucredit failed... " --result FAILED --color RED
        else
            Display --indent 2 --text "- Set password ucredit finished... " --result FINISHED --color GREEN
        fi
}

set_lcredit(){
        #=======================================================
        InsertSection "set password lcredit"
        IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep $1 | grep -w lcredit=$LCREDIT |wc -l`
        if [ "${IS_EXIST}" = "0" ] ; then
            Display --indent 2 --text "- Set password lcredit failed... " --result FAILED --color RED
        else
            Display --indent 2 --text "- Set password lcredit finished... " --result FINISHED --color GREEN
        fi
}

set_dcredit(){
        #=======================================================
        InsertSection "set password dcredit"
        IS_EXIST=`grep password /etc/pam.d/system-auth |grep $1 | grep -w dcredit=$DCREDIT  |wc -l`
        if [ "${IS_EXIST}" = "0" ] ; then
            Display --indent 2 --text "- Set password dcredit failed... " --result FAILED --color RED
        else
            Display --indent 2 --text "- Set password dcredit finished... " --result FINISHED --color GREEN
        fi
}

set_ocredit(){
        #=======================================================
        InsertSection "set password ocredit"

        IS_EXIST=`grep password /etc/pam.d/system-auth |grep $1 | grep -w ocredit=$OCREDIT |wc -l`
        if [ "${IS_EXIST}" = "0" ] ; then
            Display --indent 2 --text "- Set password ocredit failed... " --result FAILED --color RED
        else
            Display --indent 2 --text "- Set password ocredit finished... " --result FINISHED --color GREEN
        fi
}

set_minclass(){
        #=======================================================
        InsertSection "set password minclass"
        IS_EXIST=`grep password /etc/pam.d/system-auth |grep $1 | grep minclass |wc -l`
        if [ "${IS_EXIST}" = "0" ] ; then
            Display --indent 2 --text "- Set password minclass failed... " --result FAILED --color RED
        else
            Display --indent 2 --text "- Set password minclass finished... " --result FINISHED --color GREEN
        fi
}


#=======================================================
InsertSection "Set password complex"


if [ $SET_PASSCOMPLEX -eq 1 ]; then

    cp -np /etc/pam.d/system-auth  /etc/pam.d/system-auth_bak
    
    if [ ${OS_DISTRO} == "22.10" -o  ${OS_DISTRO} == "21.10" -o  ${OS_DISTRO} == "20.12" -o ${OS_DISTRO} == "\"8\"" -o ${OS_DISTRO} == "8" ]; then
        IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep pam_pwquality.so |wc -l`
        if [[ "$IS_EXIST" != "0" ]] ; then
            IS_EXIST=`cat /etc/pam.d/system-auth | grep -v "^#" | grep -w minclass=$MINCLASS | grep -w minlen=$MINLEN | grep -w ucredit=$UCREDIT | grep -w lcredit=$LCREDIT |grep -w dcredit=$DCREDIT | grep -w ocredit=$OCREDIT | wc -l`
            if [ "${IS_EXIST}" = "0" ] ; then
                sed -i  "/password.*pam_pwquality.so/d" /etc/pam.d/system-auth
                sed -i "/password.*pam_unix.so/i\password    requisite     pam_pwquality.so try_first_pass local_users_only  retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT authtok_type=" /etc/pam.d/system-auth
            fi
        else
            sed -i "/password.*pam_unix.so/i\password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT authtok_type=" /etc/pam.d/system-auth
        fi

        set_minlen pam_pwquality.so
        set_ucredit pam_pwquality.so
        set_lcredit pam_pwquality.so
        set_dcredit pam_pwquality.so
        set_ocredit pam_pwquality.so
        set_minclass pam_pwquality.so
        

    elif [[ ${OS_DISTRO} == "7" ]]; then
        #echo -e "make sure this file has (pam_pwquality.so module and has minclass minlen config)"
        IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep pam_pwquality.so |wc -l`
        crack_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep pam_cracklib.so |wc -l`

        if [[ "$IS_EXIST" != "0"  &&  "$crack_EXIST" != "0" ]]; then
            sed -i  "/password.*pam_cracklib.so/d" /etc/pam.d/system-auth
            #if current setting isn't match ${PROFILE} config settings, than change.
            IS_EXIST=`cat /etc/pam.d/system-auth | grep -v "^#" | grep -w minclass=$MINCLASS | grep -w minlen=$MINLEN | grep -w ucredit=$UCREDIT | grep -w lcredit=$LCREDIT |grep -w dcredit=$DCREDIT | grep -w ocredit=$OCREDIT | wc -l`
            if [ "${IS_EXIST}" = "0" ] ; then
                sed -i  "/password.*pam_pwquality.so/d" /etc/pam.d/system-auth
                sed -i "/password.*pam_unix.so/i\password    requisite     pam_pwquality.so try_first_pass local_users_only  retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT authtok_type=" /etc/pam.d/system-auth
            fi
        elif [[ "$IS_EXIST" != "0"  &&  "$crack_EXIST" = "0" ]] ; then
             IS_EXIST=`cat /etc/pam.d/system-auth | grep -v "^#" | grep -w minclass=$MINCLASS | grep -w minlen=$MINLEN | grep -w ucredit=$UCREDIT | grep -w lcredit=$LCREDIT |grep -w dcredit=$DCREDIT | grep -w ocredit=$OCREDIT | wc -l`
            if [ "${IS_EXIST}" = "0" ] ; then
                sed -i  "/password.*pam_pwquality.so/d" /etc/pam.d/system-auth
                sed -i "/password.*pam_unix.so/i\password    requisite     pam_pwquality.so try_first_pass local_users_only  retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT authtok_type=" /etc/pam.d/system-auth
            fi
        elif [[ "$IS_EXIST" = "0"  &&  "$crack_EXIST" != "0" ]] ; then
              sed -i  "/password.*pam_cracklib.so/d" /etc/pam.d/system-auth
              sed -i "/password.*pam_unix.so/i\password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT authtok_type=" /etc/pam.d/system-auth
        else
            sed -i "/password.*pam_unix.so/i\password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT authtok_type=" /etc/pam.d/system-auth
        fi

        set_minlen pam_pwquality.so
        set_ucredit pam_pwquality.so
        set_lcredit pam_pwquality.so
        set_dcredit pam_pwquality.so
        set_ocredit pam_pwquality.so
        set_minclass pam_pwquality.so


    elif [[ ${OS_DISTRO} == "6" ]]; then
        IS_EXIST=`grep password /etc/pam.d/system-auth | grep -v "^#" |grep pam_cracklib.so |wc -l`
        if [ "${IS_EXIST}" != "0" ] ; then
            #------------------------------------
            #if current setting isn't match ${PROFILE} config settings, than change.
            IS_EXIST=`cat /etc/pam.d/system-auth | grep -v "^#" | grep -w minclass=$MINCLASS | grep -w minlen=$MINLEN | grep -w ucredit=$UCREDIT | grep -w lcredit=$LCREDIT |grep -w dcredit=$DCREDIT | grep -w ocredit=$OCREDIT | wc -l`
            if [ "${IS_EXIST}" = "0" ] ; then
                sed -i  "/password.*pam_cracklib.so/d" /etc/pam.d/system-auth
                sed -i "/password.*pam_unix.so/i\password    requisite     pam_cracklib.so try_first_pass type= retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT" /etc/pam.d/system-auth
            fi
        else
            sed -i "/password.*pam_unix.so/i\password    requisite     pam_cracklib.so try_first_pass type= retry=3 difok=3 minclass=$MINCLASS minlen=$MINLEN ucredit=$UCREDIT lcredit=$LCREDIT dcredit=$DCREDIT ocredit=$OCREDIT" /etc/pam.d/system-auth
        fi

         set_minlen pam_cracklib.so
         set_ucredit pam_cracklib.so
         set_lcredit pam_cracklib.so
         set_dcredit pam_cracklib.so
         set_ocredit pam_cracklib.so
         set_minclass pam_cracklib.so


    else
        Display --indent 2 --text "- Skip set password complex due to config file... " --result SKIPPING --color YELLOW
    fi

else

    Display --indent 2 --text "- Skip set password complex due to config file... " --result SKIPPING --color YELLOW

fi