#!/bin/sh 
#
# Copyright 1996 Sun Microsystems, Inc. All Rights Reserved
#
# "@(#)remote.sh	3.2 99/02/03 Sun Microsystems"
#
# Install script for remote administration bootstrapping SunScreen EFS after a
# fresh installation of SKIP and SunScreen EFS.
#
# For this script to work the following must be completed:
#    1. SKIP packages are installed
#    2. SunScreen EFS packages are installed
#    3. the machine was rebooted (to start SKIP)
#
# Exit Codes:
#    0       success
#

read SUNSCREEN_BASE <${SUNSCREEN_ETC:-/etc/opt/SUNWicg/SunScreen}/location
. $SUNSCREEN_BASE/bin/.ssenv.profile

PATH="/opt/SUNWicg/bin:$BIN_DIR:/usr/bin"
export PATH

#
# Defaults
#
CONFIG_NAME="Initial"
LOCAL_ONLY=""
ROUTING=""
CERT_DISC=""
SECURITY_LEVEL="$1"
NAME_SERVICE_TYPE="$2"
NSID_TYPE="$3"
EFS_CERT="$4"
ADMIN_CERT="$5"

#
# Find the valid interface names and set the default admin
#
INTERFACE_LIST=`ss_interfaces default list | awk '{ printf("%s ",$1) }'`
#
#echo "$INTERFACE_LIST"

if [ "$CERT_DISC" = "" ] ; then
  CERT_DISC="ON"
fi

if [ $SECURITY_LEVEL -eq 1 ] ; then
  if [ "$ROUTING" = "" ] ; then
    ROUTING="OFF"
  fi
elif [ $SECURITY_LEVEL -eq 2 ] ; then
  if [ "$ROUTING" = "" ] ; then
    ROUTING="ON"
  fi
elif [ $SECURITY_LEVEL -eq 3 ] ; then
  if [ "$ROUTING" = "" ] ; then
    ROUTING="ON"
  fi
fi
 
#
# Initialize 'vars' database
#
$LIB_DIR/init_vars

#
# Initialize 'authuser' & 'proxyuser' databases
#
$LIB_DIR/init_users

#
# Initialize 'logmacro' databases
#
$LIB_DIR/init_logmacro
    
#
# Add certificates to the registry
#
 ss_certificate add local CERTIFICATE $NSID_TYPE $EFS_CERT SUNSCREEN "" "" ""
 ss_certificate add admin CERTIFICATE $NSID_TYPE $ADMIN_CERT SUNSCREEN "" "" ""

#
# Create Admin Group
#
 ss_certificate add admin-group GROUP { admin } ""

#
# Create a base configuration
#	
ss_configuration default add $CONFIG_NAME  > /dev/null 2>&1


#
#	Add addresses for each interface, and for smtp server (smtp proxy)
#
for INTERFACE in $INTERFACE_LIST ; do
  ss_address default add $INTERFACE LIST { } { } ""
done
  ss_address default add smtp-server HOST 1.1.1.1 ""

# add placeholder for HA
ss_address default add HA_HOSTS LIST { "*" } { } ""

#
# enable and plumb all interfaces 
#
for INTERFACE in $INTERFACE_LIST ; do
	ss_interfaces default add $INTERFACE EFS $INTERFACE LOG_NONE SNMP_NONE ICMP_PORT_UNREACHABLE
#	ss_interfaces default list
#	ss_plumb_interface -d default `eval echo $INTERFACE`
#	ss_default_drop -d default `eval echo $INTERFACE`
done

 if [ -f /opt/SUNWicg/lib/skipsupd.o ] ; then
    KEY_ALG="DES-EDE-K3"
    DATA_ALG="DES-CBC"
    MAC_ALG="MD5"
  elif [ -f /opt/SUNWicg/lib/skipsupu.o ] ; then
    KEY_ALG="DES-CBC"
    DATA_ALG="DES-CBC"
    MAC_ALG="MD5"
  elif [ -f /opt/SUNWicg/lib/skipsupi.o ] ; then
    KEY_ALG="DES-CBC"
    DATA_ALG="RC2-40"
    MAC_ALG="MD5"
  else
    echo "WARNING: could not find SKIP support module, no encryption used."
    KEY_ALG="DES-CBC"
    DATA_ALG="NONE"
    MAC_ALG="NONE"
  fi

# Add ALL access for local GUI administartion for user admin
ss_access default add USER "admin" ALL
  ss_access default add "*" USER "admin" SKIP_VERSION_2 \( admin-group local $KEY_ALG $DATA_ALG $MAC_ALG NONE \) ALL SKIP
  # also need blank entry to enable remote CLI access
  ss_access default add "*"  SKIP_VERSION_2  "(" "admin-group"  "local" $KEY_ALG $DATA_ALG $MAC_ALG NONE \) ALL SKIP

   echo "This file is automatically generated during installation"  >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "SKIP parameters used for administration traffic." > /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "Admin's certificate ID:    $ADMIN_CERT" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "EFS certificate ID:        $EFS_CERT" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "Key encryption algoritm:   $KEY_ALG" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "Data encryption algorithm: $DATA_ALG" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "MAC algorithm:             $MAC_ALG" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme

OX="0x"

  HOSTNAME=`uname -n`
  echo "#Run the following command on the administration station to configure skip:" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
   echo ""  >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  echo "skiphost -a $HOSTNAME -r $NSID_TYPE -R $OX$EFS_CERT -s $NSID_TYPE -S $OX$ADMIN_CERT -k $KEY_ALG -t $DATA_ALG -m $MAC_ALG" >> /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
  chmod 500 /etc/opt/SUNWicg/SunScreen/AdminSetup.readme
			   	   			   

ss_admin default add Routing $ROUTING
ss_admin default add Name_Service $NAME_SERVICE_TYPE
ss_admin default add Certificate_Discovery $CERT_DISC

#
# Add common service rule
#
if [ $SECURITY_LEVEL -eq 2 ] ; then
  ss_rule default $CONFIG_NAME add "common services" "localhost" "*" ALLOW \( LOG_NONE SNMP_NONE \)
  ss_rule default $CONFIG_NAME add "rip" "*" "*" ALLOW \(LOG_NONE SNMP_NONE \)
elif [ $SECURITY_LEVEL -eq 3 ] ; then
  ss_rule default $CONFIG_NAME add "common services" "*" "*" ALLOW \( LOG_NONE SNMP_NONE \) 
fi

#
# compile and activate configuration
#
echo "Compiling configuration"
ss_compile default $CONFIG_NAME 2>&1

#
# Activate the configuration only if the compile succeeded
#
if [ "$?" = "0" ] ; then
    echo "Activating configuration"
    ss_activate default $CONFIG_NAME 2>&1
else
    echo "An error occurred while compiling the configuration."
    echo "The configuration has not been activated."
    exit 5
fi

#
# disable all interfaces if the activate config fails
#
if [ "$?" != "0" ] ; then
    echo "An error occurred activating the configuration."
    echo "The interfaces are being disabled to avoid hosing your machine."
    for INTERFACE in $INTERFACE_LIST ; do
	echo "Disabling interface $INTERFACE"
	ss_interfaces default add $INTERFACE DISABLED $INTERFACE
    done
    exit 6
fi

#
# Now the machine must be rebooted
#
echo ""
exit 0 
