#!/bin/bash

# Variablen anpassen
REALM="MGT.HEIM.LAN"
lowerREALM=$(hostname -d)
DOMAIN="MGT"
HOSTNAME="pdc"
PASSWORD="P@ssw0rd"
STATE_FILE="/var/log/samba_setup_state"
IP_ADDRESS=$(hostname -I | awk '{print $1}')
HOSTNAME=$(hostname)
FQDN=$(hostname -f)
IP_FORWARDER="192.168.1.1"
# Initialisiere den Fortschrittszustand, falls nicht vorhanden
if [ ! -f "$STATE_FILE" ]; then
    echo "0" > "$STATE_FILE"
fi

# Lese den aktuellen Fortschritt
CURRENT_STEP=$(cat "$STATE_FILE")

# Funktion zum Aktualisieren des Fortschritts
update_state() {
    echo "$1" > "$STATE_FILE"
}

# Funktion: /etc/hosts anpassen
configure_hosts() {
    if [ "$CURRENT_STEP" -le 1 ]; then
        eche "Function Configure Hosts"
        echo "${IP_ADDRESS} ${FQDN} ${HOSTNAME}" >> /etc/hosts
        update_state 2
    fi
}

# Funktion: Lokaleinstellungen setzen
set_locale() {
    if [ "$CURRENT_STEP" -le 2 ]; then
        echo "function set locale to en_US.utf8"
        localectl set-locale LANG=en_US.utf8
        update_state 3
    fi
}

# Funktion: SELinux deaktivieren
disable_selinux() {
    echo "function diable selinux"
    if [ "$CURRENT_STEP" -le 3 ]; then
        sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
        update_state 4
    fi
}

# Funktion: System neu starten
reboot_system() {
    echo "function reboot"
    if [ "$CURRENT_STEP" -le 4 ]; then
        update_state 5
        init 6
    fi
}

# Funktion: SSHD konfigurieren und neu starten
configure_sshd() {
    echo "function configure sshd"
    if [ "$CURRENT_STEP" -le 5 ]; then
        nano /etc/ssh/sshd_config
        systemctl restart sshd
        update_state 6
    fi
}

# Funktion: SELinux Status prüfen
check_selinux_status() {
    echo "function check selinux"
    if [ "$CURRENT_STEP" -le 6 ]; then
        sestatus
        update_state 7
    fi
}

# Funktion: Firewall starten und konfigurieren
configure_firewall() {
    echo "function configure Firewall"
    if [ "$CURRENT_STEP" -le 7 ]; then
        systemctl start firewalld
        systemctl enable firewalld
        firewall-cmd --zone=public --add-port=53/tcp --add-port=53/udp --permanent
        firewall-cmd --zone=public --add-port=88/tcp --add-port=88/udp --permanent
        firewall-cmd --zone=public --add-port=135/tcp --permanent
        firewall-cmd --zone=public --add-port=389/tcp --add-port=389/udp --permanent
        firewall-cmd --zone=public --add-port=445/tcp --permanent
        firewall-cmd --zone=public --add-port=464/tcp --add-port=464/udp --permanent
        firewall-cmd --zone=public --add-port=636/tcp --permanent
        firewall-cmd --zone=public --add-port=3268/tcp --permanent
        firewall-cmd --zone=public --add-port=3269/tcp --permanent
        firewall-cmd --zone=public --add-port=50000-51000/tcp --permanent
        firewall-cmd --zone=public --add-port=49152-65535/tcp --permanent
        firewall-cmd --reload
        update_state 8
    fi
}

# Funktion: System aktualisieren und notwendige Pakete installieren
install_packages() {
    echo "function install required packages"
    if [ "$CURRENT_STEP" -le 8 ]; then
        dnf update -y
        #dnf install -y epel-release
        
        subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
        yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
        yum repolist
        wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-8
        rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8
        echo "[tis-samba]
name=tis-samba
baseurl=https://samba.tranquil.it/redhat8/samba-4.19/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8" > /etc/yum.repos.d/tissamba.repo
        dnf repolist
        yum install -y samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python39-pip
        pip3 install markdown
        yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop
        update_state 9
    fi
}

# Funktion: Kerberos-Konfiguration anpassen
configure_kerberos() {
    echo "function configure kerberos"
    if [ "$CURRENT_STEP" -le 9 ]; then
        cat <<EOF > /etc/krb5.conf
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/

[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
    spake_preauth_groups = edwards25519
    default_realm = $REALM
    default_ccache_name = KEYRING:persistent:%{uid}
    dns_lookup_kdc = false

[realms]
    $REALM = {
        kdc = ${IP_ADDRESS}
        #admin_server = ${IP_ADDRESS}
    }

[domain_realm]
    .${lowerREALM} = $REALM
    ${lowerREALM} = $REALM
EOF
        update_state 10
    fi
}

# Funktion: Alte Samba-Konfiguration entfernen und neue Konfiguration erstellen
configure_samba() {
    echo "funktion configure samba" 
    if [ "$CURRENT_STEP" -le 10 ]; then
        rm -f /etc/samba/smb.conf
        samba-tool domain provision --realm=$REALM --domain=$DOMAIN --server-role=dc
        samba-tool user setpassword administrator --newpassword=$PASSWORD
        echo "dns forwarder = ${IP_FORWARDER}" >> /etc/samba/smb.conf
        systemctl restart NetworkManager
        rm -f /var/lib/samba/private/krb5.conf
        ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf
        systemctl enable samba
        systemctl start samba
        update_state 11
    fi
}

# Funktion: BIND9-DLZ installieren und konfigurieren
configure_bind() {
    echo "function configure bind"nan   
    if [ "$CURRENT_STEP" -le 11 ]; then
        yum install -y bind samba-dc-bind-dlz bind-utils
        cat <<EOF > /etc/named.conf
options {
    listen-on port 53 { any; };
    listen-on-v6 port 53 { ::1; };
    forwarders { ${IP_FORWARDER}; }; # modify depending on your local DNS forwarder
    tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query { any; };
    allow-recursion { any; };
    allow-query-cache { any; };
    recursion yes;
    dnssec-enable no;
    dnssec-validation no;
    bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
    minimal-responses yes;
};
logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };
};
zone "." IN {
    type hint;
    file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
dlz "$REALM" {
    database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so";
};
EOF
        echo 'OPTIONS="-4"' >> /etc/sysconfig/named
        sed -i 's/dns forwarder = '${IP_ADDRESS}'//g' /etc/samba/smb.conf
        echo "server services = -dns" >> /etc/samba/smb.conf
        mkdir -p /var/lib/samba/bind-dns/dns
        samba_upgradedns --dns-backend=BIND9_DLZ
        update_state 12
    fi
}

# Funktion: DNS-Konfiguration prüfen
verify_dns() {
    echo "funktion verify dns config"
    if [ "$CURRENT_STEP" -le 12 ]; then
        systemctl restart named
        netstat -tapn | grep 53
        dig @localhost google.de
        dig @localhost $FQDN
        dig. -t SRV @localhost _ldap._tcp.${lowerREALM}
        update_state 13
    fi
}

# Funktion: SELinux wieder aktivieren und konfigurieren
enable_selinux() {
    echo "function enable selinux"
    if [ "$CURRENT_STEP" -le 13 ]; then
        # SELinux auf permissive setzen
        setenforce 0
        
        # SELinux-Module installieren
        dnf install -y policycoreutils-python-utils
        
        # Boolsche Variablen für Samba und BIND9 setzen
        setsebool -P samba_enable_home_dirs on
        setsebool -P samba_export_all_rw on
        setsebool -P named_write_master_zones on
        setsebool -P named_update_master_zones on
        
        # Kontext für Samba- und BIND9-Verzeichnisse setzen
        semanage fcontext -a -t samba_share_t "/var/lib/samba(/.*)?"
        restorecon -Rv /var/lib/samba
        
        semanage fcontext -a -t named_cache_t "/var/lib/samba/bind-dns(/.*)?"
        restorecon -Rv /var/lib/samba/bind-dns
        
        # Prüfen der SELinux-Protokolle auf Verstöße und anpassen
        grep samba /var/log/audit/audit.log | audit2allow -M mypol
        semodule -i mypol.pp
        
        grep named /var/log/audit/audit.log | audit2allow -M mypol_named
        semodule -i mypol_named.pp
        
        # SELinux auf enforcing setzen
        setenforce 1
        
        # SELinux-Konfiguration persistent machen
        sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
        
        update_state 14
    fi
}

# Hauptskript: Funktionen nacheinander ausführen
configure_hosts
set_locale
disable_selinux
reboot_system
configure_sshd
check_selinux_status
configure_firewall
install_packages
configure_kerberos
configure_samba
configure_bind
verify_dns
##### OPTIONAL #####
#enable_selinux #####
####################
echo "Installation und Konfiguration abgeschlossen."