#!/bin/sh

domain=thisbox

echo slapd slapd/domain string $domain   | debconf-set-selections

DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils

# Make sure slapd isn't running when we use slapadd
service slapd stop

cat <<EOF |slapadd
dn: ou=users,dc=$domain
objectClass: top
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=$domain
objectClass: top
objectClass: organizationalUnit
ou: groups

EOF

# Configure PAM for LDAP user logins
echo nslcd nslcd/ldap-uris string "ldapi:///" | debconf-set-selections
echo nslcd nslcd/ldap-base string "dc=thisbox" | debconf-set-selections
echo nslcd nslcd/ldap-auth-type select SASL | debconf-set-selections
echo nslcd nslcd/ldap-sasl-mech select EXTERNAL | debconf-set-selections
echo libnss-ldapd libnss-ldapd/nsswitch multiselect group, passwd, shadow \
    | debconf-set-selections
DEBIAN_FRONTEND=noninteractive apt-get install -y nslcd libpam-ldapd libnss-ldapd

# Only users in admin group can login
cat <<EOF > /usr/share/pam-configs/access
Name: restrict login using access control table file
Default: yes
Priority: 0
Account-Type: Additional
Account-Final:
 required pam_access.so
EOF

# Create home directories for LDAP users logging in for the first time
cat <<EOF > /usr/share/pam-configs/mkhomedir
Name: Create home directory during login
Default: yes
Priority: 900
Session-Type: Additional
Session:
        required        pam_mkhomedir.so umask=0022 skel=/etc/skel
EOF

pam-auth-update --package

if ! grep -q -- "^-:ALL EXCEPT root fbx (admin):ALL$" \
     /etc/security/access.conf ; then
    printf "%s\n" "-:ALL EXCEPT root fbx (admin):ALL" \
	 >> /etc/security/access.conf
fi

echo "%admin ALL=(root) ALL" > /etc/sudoers.d/freedombox
