#!/bin/bash

REPAIR_FLAG=$1
if [ $2 == 0 ]
then
	echo "修复密码最小长度"
	if [ -f /var/lib/rpm/Packages ]
	then
		if [ ! -f /etc/security/pwquality.conf ]
		then
			echo "3001#1#2#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			sed -i /minlen/d /etc/security/pwquality.conf
			echo "minlen=$3" >> /etc/security/pwquality.conf
			echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	elif [ -f /var/lib/dpkg/status ]
	then
		if [ ! -f /etc/pam.d/common-password ]
		then
			echo "3001#1#2#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			UcreditConf=`cat /etc/pam.d/common-password | grep -o 'ucredit=[0-9]' | cut -d'=' -f2`
			if [ -z $UcreditConf ]
			then
				UcreditConf=-1
			fi

			DcreditConf=`cat /etc/pam.d/common-password | grep -o 'dcredit=[0-9]' | cut -d'=' -f2`
			if [ -z $DcreditConf ]
			then
				DcreditConf=-1
			fi

			OcreditConf=`cat /etc/pam.d/common-password | grep -o 'ocredit=[0-9]' | cut -d'=' -f2`
			if [ -z $OcreditConf ]
			then
				OcreditConf=-1
			fi
			
			LcreditConf=`cat /etc/pam.d/common-password | grep -o 'lcredit=[0-9]' | cut -d'=' -f2`
			if [ -z $LcreditConf ]
			then
				LcreditConf=-1
			fi

			sed -i /minlen/d /etc/pam.d/common-password
			echo "password    requisite     pam_pwquality.so try_first_pass retry=3 minlen=$3 ucredit=$UcreditConf dcredit=$DcreditConf ocredit=$OcreditConf lcredit=$LcreditConf" >> /etc/pam.d/common-password
			echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	fi
elif [ $2 == 1 ]
then
	echo "修复密码最短使用期限"
	sed -i /PASS_MIN_DAYS/d /etc/login.defs
	echo "PASS_MIN_DAYS=$3" >> /etc/login.defs
	echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
	sleep 0.5
elif [ $2 == 2 ]
then
	echo "修复密码最长使用期限"
	sed -i /PASS_MAX_DAYS/d /etc/login.defs
	echo "PASS_MAX_DAYS=$3" >> /etc/login.defs
	echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
	sleep 0.5
elif [ $2 == 3 ]
then
	echo "修复密码复杂度"
	if [ -f /var/lib/rpm/Packages ]
	then
		if [ ! -f /etc/security/pwquality.conf ]
		then
			echo "3001#1#2#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			sed -i /ucredit/d /etc/security/pwquality.conf
			sed -i /ocredit/d /etc/security/pwquality.conf
			sed -i /dcredit/d /etc/security/pwquality.conf
			sed -i /lcredit/d /etc/security/pwquality.conf

			echo "ucredit=-1" >> /etc/security/pwquality.conf
			echo "ocredit=-1" >> /etc/security/pwquality.conf
			echo "dcredit=-1" >> /etc/security/pwquality.conf
			echo "lcredit=-1" >> /etc/security/pwquality.conf
			echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	elif [ -f /var/lib/dpkg/status ]
	then
		if [ ! -f /etc/pam.d/common-password ]
		then
			echo "3001#1#2#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			MinLen=`cat /etc/pam.d/common-password | grep -o 'minlen=[0-9]' | cut -d'=' -f2`
			if [ -z $MinLen ]
			then
				MinLen=8
			fi

			sed -i /ucredit/d /etc/pam.d/common-password
			sed -i /ocredit/d /etc/pam.d/common-password
			sed -i /dcredit/d /etc/pam.d/common-password
			sed -i /lcredit/d /etc/pam.d/common-password
			echo "password    requisite     pam_pwquality.so try_first_pass retry=3 minlen=$MinLen ucredit=-1 dcredit=-1 ocredit=-1 lcredit=-1" >> /etc/pam.d/common-password
			echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	fi
elif [ $2 == 5 ]
then
        echo "检查登录失败次数"
	FAILCOUNT=`cat /etc/pam.d/sshd | grep -v "#" | grep pam_tally2.so | awk '{print $4}' | awk -F '=' '{print $2}'`
	if [ -z $FAILCOUNT ]
	then
		if [ $REPAIR_FLAG == 1 ]
		then
			echo "自动加固"
			sed -i '/pam_tally2.so/d' /etc/pam.d/sshd
			sed -i '2i auth    required pam_tally2.so deny='$3' unlock_time=300 even_deny_root root_unlock_time=10' /etc/pam.d/sshd
			echo "3001#0#1#$2#$3#0#"
			echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			echo "3001#1#0#$2#$3#0#"
			echo "3001#1#0#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	elif [ $FAILCOUNT -lt $3 ]
	then
		if [ $REPAIR_FLAG == 1 ]
		then
			echo "自动加固"
			DENYCONTENT=`cat /etc/pam.d/sshd | grep -v "#" | grep "deny=" | awk '{print $4}'`
			sed -i s/$DENYCONTENT/deny=$3/g /etc/pam.d/sshd
			echo "3001#0#1#$2#$3#$FAILCOUNT#"
			echo "3001#0#1#$2#$3#$FAILCOUNT#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			echo "3001#1#0#$2#$3#$FAILCOUNT#"
			echo "3001#1#0#$2#$3#$FAILCOUNT#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	else
		echo "3001#0#0#$2#$3#$FAILCOUNT#"
		echo "3001#0#0#$2#$3#$FAILCOUNT#" >> /usr/local/edr/var/baseline/pwcheck_result
		sleep 0.5
	fi
elif [ $2 == 6 ]
then
        echo "检查锁定时间"
	TIMEINT=`cat /etc/profile | grep -v "#" | grep TMOUT= | awk -F '=' '{print $2}'`
	if [ -z $TIMEINT ]
	then
		if [ $REPAIR_FLAG == 1 ]
		then
			echo "自动加固"
			sed -i '/#TMOUT/d' /etc/profile
			echo "TMOUT=$3" >> /etc/profile
			echo "3001#0#1#$2#$3#0#"
			echo "3001#0#1#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			echo "3001#1#0#$2#$3#0#"
			echo "3001#1#0#$2#$3#0#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	elif [ $TIMEINT -gt $3 ] || [ $TIMEINT == "0" ]
	then
		if [ $REPAIR_FLAG == 1 ]
		then
			echo "自动加固"
			TIMEINT=`cat /etc/profile | grep -v "#" | grep TMOUT=`
			sed -i s/$TIMEINT/TMOUT=$3/g /etc/profile
			echo "3001#0#1#$2#$3#$TIMEINT#"
			echo "3001#0#1#$2#$3#$TIMEINT#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		else
			echo "3001#1#0#$2#$3#$TIMEINT#"
			echo "3001#1#0#$2#$3#$TIMEINT#" >> /usr/local/edr/var/baseline/pwcheck_result
			sleep 0.5
		fi
	else
		echo "3001#0#0#$2#$3#$TIMEINT#"
		echo "3001#0#0#$2#$3#$TIMEINT#" >> /usr/local/edr/var/baseline/pwcheck_result
		sleep 0.5
	fi
fi