#!/bin/bash
#
# Script: mjact_ssh
#
# Usage: mjact_ssh -a <action (list/add/remove/changepassword)> -n <SSH username> -p
#
# Description: A tool for managing SSH accounts
#
# Author: Nikita Shchetinin
#
# Changelog:
# * 26.03.2021: Nikita Shchetinin
# - Initial write

if [ "$(whoami)" != 'root' ]
then
	echo "You must execute this script as the root user!"
	exit 1
fi

if [ -d /home/httpd/html ]
then
	group=$(stat -c "%G" /home/httpd/html)
else
	echo "/home/httpd/html does not exist, so this server's configuration seems to be very custom and it will not be modified by this script!"
	exit 1
fi

if [ "$group" == 'root' ]
then
	echo "/home/httpd/html must not belong to the root user!"
	exit 1
fi

LIST () {
if [ $(lid -g sshuser | wc -l) == 0 ]
then
	echo "No SSH user is added to this server!"
	exit 1
else
	lid -g sshuser
fi
}

ADD () {
if ! grep -qw "Match Group sshuser" /etc/ssh/sshd_config
then
	echo "Match Group sshuser
PasswordAuthentication yes
Match all" >> /etc/ssh/sshd_config
	systemctl restart sshd
fi
if [ -z "$name" ]
then
	echo "The username is required!"
	exit 1
else
	if id -u $name > /dev/null 2>&1
	then
		echo "The provided username is already added to this server!"
		exit 1
	else
		if [ "$passprompt" == "YES" ]
		then
			read -p "Enter the password: " password
			while [ -z "$password" ]
			do
			echo "The password is required!"
			read -p "Enter the password: " password
			done
		else
			password=$(</dev/urandom tr -dc A-Za-z0-9 | head -c16)
		fi
		useradd $name
		usermod -a -G $group $name
		usermod -a -G sshuser $name
		echo $name:$password | chpasswd
	fi
	echo "Hostname: $(hostname)"
	echo "Port: 22"
	echo "SSH user: $name"
	echo "SSH password: $password"
fi
}

REMOVE () {
if [ -z "$name" ]
then
	echo "The username is required!"
	exit 1
else
	if id -u $name > /dev/null 2>&1
	then
		if lid -g sshuser | grep -q "$name"
		then
			userdel -r $name
			echo "$name has been deleted"
		else
			echo "The provided username is not an SSH username!"
			exit 1
		fi
	else
		echo "The provided username does not exist!"
		exit 1
	fi
fi
}

CHANGE () {
if [ -z "$name" ]
then
	echo "The username is required!"
	exit 1
else
	if id -u $name > /dev/null 2>&1
	then
		if lid -g sshuser | grep -q "$name"
		then
			if [ "$passprompt" == "YES" ]
			then
				read -p "Enter the password: " password
				while [ -z "$password" ]
				do
				echo "The password is required!"
				read -p "Enter the password: " password
				done
			else
				password=$(</dev/urandom tr -dc A-Za-z0-9 | head -c16)
			fi
			echo $name:$password | chpasswd
			echo "Hostname: $(hostname)"
			echo "Port: 22"
			echo "SSH user: $name"
			echo "SSH password: $password"
		else
			echo "The provided username is not an SSH username!"
			exit 1
		fi
	else
		echo "The provided username does not exist!"
		exit 1
	fi
fi
}

HELP () {
echo "A tool for managing SSH accounts"
echo "usage: mjact_ssh -a <action (list/add/remove/changepassword)> -n <SSH username> -p (to submit password using a password prompt)"
}

if [[ "${1}" == "" ]] || [[ "${1}" == "-h" ]] || [[ "${1}" == "--help" ]]
then
	HELP
	exit
else
	while getopts ":a:n:p" OPTION
	do
		case "${OPTION}" in
			a)
				action="${OPTARG}"
			;;
			n)
				name="${OPTARG}"
			;;
			p)
				passprompt="YES"
			;;
		esac
	done
fi

case $action in
	list)
		LIST
	;;
	add)
		ADD
	;;
	remove)
		REMOVE
	;;
	changepassword)
		CHANGE
	;;
	*)
		echo "Invalid action!"
		exit 1
	;;
esac