#!/bin/bash
# BLOCK and UNBLOCK station script
# $1 - block or unblock parameter
# OR
# $0 - block or unblock
# IF 1 - used

PREFIX="/opt/secretnet"

NOLOGIN="/etc/nologin"
LOCK_REASON_FILE="${PREFIX}/var/tmp/lock_reason"

if [[ -f /opt/secretnet/bin/logger ]]; then
    LOGGER="/opt/secretnet/bin/logger"
else
    LOGGER="/usr/bin/logger"
    LOGGER_OPTS=" -u /dev/snlog -d"
fi

ID_LOCK="17037312"
ID_UNLOCK="17037568"
ID_NSD="17033472"
LOCK_MSG="Not authorized access. Station is LOCKED by SecretNet service!"
UNLOCK_MSG="The station is UNLOCKED!"
PRIORITY="local0.crit"
bash_lock="/etc/bashrc.d/00Lock.sh"
profile_lock="/etc/profile.d/00Lock.sh"

error () { echo -e "\033[1;31;40m!!! \033[1;37;40m$@ \033[1;31;40m!!!\033[1;0m"; }
warn ()  { echo -e "\033[1;33;40m*** \033[1;37;40m$@ \033[1;33;40m***\033[1;0m"; }

add_lock_reason() {
  if [[ -e ${LOCK_REASON_FILE} ]]; then
    cat ${LOCK_REASON_FILE} 1>>$1
  fi
}

add_lock_reason_sh() {
  if [[ -e ${LOCK_REASON_FILE} ]]; then
    echo 'echo "' >> $1
    cat ${LOCK_REASON_FILE} 1>>$1
    echo '"' >> $1
  fi
}

del_lock_reason() {
  if [[ -e ${LOCK_REASON_FILE} ]]; then
    rm -f ${LOCK_REASON_FILE}
  fi
}

set_lock() {
  install -dm755 $(dirname ${NOLOGIN}) $(dirname ${bash_lock}) $(dirname ${profile_lock})
# nologin
  cat > ${NOLOGIN}<<EOF
Station is LOCKED by SecretNet service!
Ask security administrator for assistance!
Рабочая станция ЗАБЛОКИРОВАНА! Обратитесь к администратору безопасности!
EOF
  add_lock_reason ${NOLOGIN}

# if user use bash
  cat > ${bash_lock}<<EOF
#!/bin/sh
echo
echo 'Station is LOCKED by SecretNet service!'
echo 'Check for problem and remove the cause of the lock workstation!'
echo 'Рабочая станция ЗАБЛОКИРОВАНА! Устраните причину НСД для разблокировки!'
EOF
  add_lock_reason_sh ${bash_lock}
  chmod +x ${bash_lock}

#profile
  cat > ${profile_lock}<<EOF
#!/bin/sh
echo
echo 'Station is LOCKED by SecretNet service!'
echo 'Check for problem and remove the cause of the lock workstation!'
echo 'Рабочая станция ЗАБЛОКИРОВАНА! Устраните причину НСД для разблокировки!'
EOF
  add_lock_reason_sh ${profile_lock}
  chmod +x ${profile_lock}

  chattr +i ${NOLOGIN} ${bash_lock} ${profile_lock}

  del_lock_reason

  ${LOGGER} ${LOGGER_OPTS} -p ${PRIORITY} -t "NSD" "[${ID_NSD}]"
  ${LOGGER} ${LOGGER_OPTS} -p ${PRIORITY} -t "LOCK" "[${ID_LOCK}] ${LOCK_MSG}"
  warn "${LOCK_MSG}"

  #close all user sessions, except for snadmin group
  users_list=$(who | cut -f 1 -d ' ' | uniq | grep -v root)
  for user in $users_list; do
    if ! (id -nG "$user" | grep -qw "snadmin") ; then
      pkill -9 -u $user
    fi
  done
}

set_unlock() {
  chattr -i ${bash_lock} ${profile_lock} ${NOLOGIN}
  rm -f ${bash_lock} ${profile_lock} ${NOLOGIN} &>/dev/null
  ${LOGGER} ${LOGGER_OPTS} -p ${PRIORITY} -t "LOCK" "[${ID_UNLOCK}] ${UNLOCK_MSG}"
  warn "${UNLOCK_MSG}"
}

ARG=$1
NAME=$(basename $0)

[[ -n $1 ]] && NAME=$1

case $NAME in
  block|snblock) set_lock ;;
  unblock|snunblock) set_unlock ;;
  *) error "Unknown parameter! Usage: $(basename $0) block|unblock"; exit 1 ;;
esac

exit 0
