#!/bin/sh

# Shell script to collect users data.
# Copyright (C) 2001-2004 Open Challenge B.V.
# Copyright (C) 2004 OpenEyeT Professional Services.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.
# If not, write to the Free Software Foundation,
# 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
#
# Contact information: www.OpenEyeT.nl/scc/index.html 

# This is a system module of scc, to call it separately in the
# proper environment, use: scc-collect -i -e <module_name>

# SCC-release:	1.6.26
# file-version:	$Revision: 1.22 $
 
. ${SCC_BIN}/scc_modules/scc_utils

if [ -x /usr/sbin/useradd ]
then
	useradd -D 2>/dev/null		|
	sort				|
	sed -e 's/^/fix:users:useradd defaults::/'
fi
scc_check_file /etc/adduser.conf "fix:users:/etc/adduser.conf::" "#"
scc_check_file /etc/deluser.conf "fix:users:/etc/deluser.conf::" "#"

for f in /etc/skel/* /etc/skel/.*
do
	scc_check_file "${f}" "fix:users:${f}::" "#"
done

if [ -x /usr/sbin/logins -o -x /usr/bin/logins ]		# Available on HP-UX and SunOS
then
	# Get all account data, inclusing password aging. Erase date of password change.
	logins -o -x -a 								|
	awk -F: '{
			prefix="var:users:logins::"
			if ( $2 < m )
			{
				prefix="fix:users:logins::"
			}
			print prefix $0;
		}' m=${MAX_SYS_ACCOUNT_ID}						|
	sed  -e 's/:\([A-Z][A-Z]\):[0-9][0-9][0-9][0-9][0-9][0-9]:/:\1:XXXXXX:/'	|
	sort

	logins -d				|
	sort -k 2n -k 1				|
	sed -e 's/^/fix:users:check:duplicate UIDs::/'

	logins -p				|
	sort -k 1				|
	sed -e 's/^/fix:users:check:accounts without password::/'

	sed	-e 's/:[^:]*:/:/'		\
		-e "s@^@var:users:/etc/group::@" /etc/group
else
	for f in passwd group shadow master.passwd
	do
		if [ -f /etc/${f} ]
		then
			# Erase the password fields when they are longer than 10 characters.
			sed	-e 's/^\([^:]*\):[^:][^:][^:][^:][^:][^:][^:][^:][^:][^:]*:/\1:ERASED:/' /etc/${f}	|
			if [ ${f} = "passwd" -o "${f}" = "master.passwd" ]
			then
				awk -F: '{
					prefix="var:users:"
					if ( $3 < m )
					{
						prefix="fix:users:"
					}
					print prefix f "::" $0;
				}' f=/etc/${f} m=${MAX_SYS_ACCOUNT_ID}
			else
				sed -e "s@^@var:users:/etc/${f}::@"
			fi												|
			sort
		fi

		if [ ${IS_NIS_MASTER} -eq 1 -a "${NIS_DATA_DIR}" != "/etc" -a -f "${NIS_DATA_DIR}/${f}" ]
		then
			# Erase the password fields when they are longer than 10 characters.
			sed	-e 's/^\([^:]*\):[^:][^:][^:][^:][^:][^:][^:][^:][^:][^:]*:/\1:ERASED:/'	\
				-e "s@^@var:users:${NIS_DATA_DIR}/${f}::@" "${NIS_DATA_DIR}/${f}"
		fi
	done

	if [ "${OS_NAME}" = "AIX" ]
	then
		# Again, erase the passwords that are longer than 10 characters.
		sed -e 's/password = ...........*$/password = ERASED/' /etc/security/passwd 2>/dev/null	|
		awk	'/^[ 	]*$/	{ next }
			/^[^ 	]/	{ account=$1; next }
					{ print "var:users:/etc/security/passwd::" account $0 }'

		awk	'/^[ 	]*$/	{ next }
			/^[^ 	]/	{ group=$1; next }
					{ print "var:users:/etc/security/group::" group $0 }' /etc/security/group 2>/dev/null
	fi
fi

scc_check_file /etc/passwd.conf "fix:users:/etc/passwd.conf::" "#"

# Single Signon: password synchronisation between Unix and Windows.
scc_check_file /etc/sso.conf "fix:users:/etc/sso.conf::" "#"

(
	# Get all the mountpoints of NFS-mounted file systems.
	# We exclude these file systems from the survey of the accounts.
	df -P 2>/dev/null		|
	awk '{
		if ( $1 ~ ".*:.*" )
		{
			NFS=1;
			if ( NF == 1 )
			{
				next;
			}
		}
		if ( NFS )
		{
			print $NF;
			NFS=0;
		}
	}'				|
	sort

	# Now we produce the data of the users.
	if [ ${IS_NIS_MASTER} -eq 1 ]
	then
		ypcat passwd
	else
		grep -v "^[#+]" /etc/passwd 2>/dev/null
	fi
)						|
awk -F: '{
	if ( NF == 1 )
	{
		# Process the names of the NFS file systems
		dir=sprintf( "%s/", $1 );
		nfs[ dir ]=1;
		next;
	}

	# Visit each homedirectory only once.
	if ( visited[ $6 ] == 0 )
	{
		nfs_home_dir=0;
		for ( d in nfs )
		{
			# Does homedirectory start with nfs-directory?
			if ( index( $6, d ) )
			{
				nfs_home_dir=1;
				break;
			}
		}
		if ( ! nfs_home_dir )
		{
			print $1, $3, $6;	# Show: username, uid and home-directory
		}
		visited[ $6 ] =1;
	}
}'						|
sort						|
while read user uid dir
do
	if [ -z "${user}" ]
	then
		continue
	fi

	# Determine whether we are dealing with a system or an ordinary user.
	prefix="var"
	if [ ${uid} -lt ${MAX_SYS_ACCOUNT_ID} ]
	then
		prefix="fix"
	fi

	scc_check_file "${dir}/.rhosts" "${prefix}:users:accounts:${user}::.rhosts:	" "#"	|
	sort

	scc_check_file "${dir}/.netrc" "${prefix}:users:accounts:${user}::.netrc:       " "#"   | 
	while read line 
	do 
		pw="$(echo "${line}" | sed -e 's/.*password[ 	]*//' -e 's/[ 	].*//')" 
		if [ "${pw}" ]
		then
			# Show checksum of the plain-text passwords.
			pw_e="$(echo "${pw}" | scc_crypt)" 
			echo "${line}"		|
			sed -e "s${sed_sep}password[ 	]*${pw}${sed_sep}password ${pw_e}${sed_sep}" 2>/dev/null
		else
			echo "${line}"
		fi
	done 

	scc_check_file "${dir}/.forward" "${prefix}:users:accounts:${user}::.forward:	" "#"

	(
		scc_check_file "${dir}/.ssh/known_hosts" "${prefix}:users:accounts:${user}::ssh known hosts:	" "#"
		scc_check_file "${dir}/.ssh/authorized_keys" "${prefix}:users:accounts:${user}::authorized_keys:	" "#"
	)						|
	awk '/^...:users:accounts:/	{
						for ( i = 2; i <= NF; i++ )	# Skip the classification.
						{
							if ( length( $i ) > 40 )
							{
								$i="";		# Erase the keys
							}
						}
					}
					{
						print;
					}'
done

if [ -d /var/mail ]
then
	ls /var/mail 2>/dev/null
elif [ -d /var/spool/mail ]
then
	ls /var/spool/mail 2>/dev/null
fi					|
sed -e 's/^/var:users:mailboxes::/'

pw_grp_ck_options=""
if [ "${OS_NAME}" = "Linux" ]
then
	pw_grp_ck_options="-r"
fi
if [ -x /usr/sbin/pwck ]
then
	# For HP-UX 11 you will need patch PHCO_16196 to reduce the "noise" of pwck.
	# Erase the password-field from the output.
	/usr/sbin/pwck ${pw_grp_ck_options} 2>&1				|
	sed	-e 's/:[^:][^:]*:/:/'	\
		-e '/^[ 	]*$/d'	\
		-e 's/^/fix:users:check:pwck::/'
fi
if [ -x /usr/sbin/grpck ]
then
        # Contributed by Doug Probst.
	if [ "$OS_NAME" = "AIX" ]
	then
		pw_grp_ck_options="-n ALL"
	fi

	# Erase the password-field from the output.
	/usr/sbin/grpck ${pw_grp_ck_options} 2>&1				|
	sed	-e 's/:[^:][^:]*:/:/'	\
		-e '/^[ 	]*$/d'	\
		-e 's/^/fix:users:check:grpck::/'
fi

exit 0
