---

#!/bin/bash

if [ "$EUID" -ne 0 ]; then
  exit 1
fi

apt install libpam-modules -y
sed -i '/pam_faillock.so/d' /etc/pam.d/common-auth
sed -i '1iauth required pam_faillock.so preauth deny=2 fail_interval=10 unlock_time=900' /etc/pam.d/common-auth
sed -i '/pam_unix.so/a auth sufficient pam_faillock.so authsucc deny=2 fail_interval=10 unlock_time=900' /etc/pam.d/common-auth
sed -i '/pam_deny.so/a auth required pam_faillock.so preauth silent deny=2 fail_interval=10 unlock_time=900' /etc/pam.d/common-auth

apt install libpam-pwquality -y
cat > /etc/security/pwquality.conf << EOF
minlen = 9
lcredit = -3
ucredit = -3
dcredit = -1
ocredit = -2
usercheck = 1
EOF

cat > /usr/local/bin/check_extra.sh << 'EOF'
#!/bin/bash
PASSWORD="$1"
USERNAME="$2"
if echo "$PASSWORD" | grep -qE '[0-9]{7,11}'; then
  exit 1
fi
if echo "$PASSWORD" | grep -qE '[0-9]{2,4}'; then
  exit 1
fi
exit 0
EOF
chmod +x /usr/local/bin/check_extra.sh

sed -i '/pam_pwquality.so/a password optional pam_exec.so seteuid /usr/local/bin/check_extra.sh' /etc/pam.d/common-password

useradd -m -s /bin/bash franzliszt 2>/dev/null
passwd franzliszt

mkdir -p /etc/security/faillock.d/
cat > /etc/security/faillock.d/franzliszt.conf << EOF
deny=6
fail_interval=10
unlock_time=900
EOF

echo "franzliszt ALL=(ALL:ALL) ALL" > /etc/sudoers.d/franzliszt
chmod 440 /etc/sudoers.d/franzliszt

apt install ufw -y
ufw --force disable
ufw --force enable

ufw allow 9000:9100/udp

mkdir -p /etc/ufw/applications.d
cat > /etc/ufw/applications.d/myapp << EOF
[MyApp]
title=My Application
description=Иванов Иван
ports=8080/tcp|8080/udp|4799/tcp|4799/udp
EOF

ufw app update MyApp
ufw allow MyApp

ufw deny 2333

ufw reload

useradd -m -s /bin/bash testuser 2>/dev/null

if command -v pdpl-user &>/dev/null; then
  pdpl-user -l 3 testuser
fi

groupadd astra-admin 2>/dev/null
usermod -aG astra-admin testuser

echo "testuser ALL=(ALL) NOPASSWD: /usr/bin/journalctl" > /etc/sudoers.d/testuser-journalctl
chmod 440 /etc/sudoers.d/testuser-journalctl