#! /bin/sh
echo ""
echo "Beginning local customization"
cd /
#
KEY=/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
if [ -f ${KEY} ]; then
	echo -n "Importing CentOS RPM-GPG-KEY ... "
	rpm --import ${KEY}
	echo "done"
else
	echo "${KEY} does not exist!"
fi
#

KEY=/etc/pki/rpm-gpg/SCI-RPM-KEY
wget -O ${KEY} http://install.cs.pitt.edu/centos7/openafs/SCI-RPM-KEY
if [ -f ${KEY} ]; then
	echo -n "Importing SCI OpenAFS RPM key ... "
	rpm --import ${KEY}
	echo "done"
else
	echo "${KEY} does not exist!"
fi
#

REPOS=/etc/yum.repos.d
if [ -f ${REPOS}/CentOS-Base.repo ]; then
    mv ${REPOS}/CentOS-Base.repo ${REPOS}/CentOS-Base.repo.orig
    sed -e "s/^mirrorlist/#&/" -e "s/^#baseurl/baseurl/" \
      -e "/^baseurl/s/mirror.centos.org/mirror.cs.pitt.edu/" \
      ${REPOS}/CentOS-Base.repo.orig > ${REPOS}/CentOS-Base.repo
fi

# Add our local OpenAFS repo
cat > ${REPOS}/OpenAFS.repo << \EOFEOF
[openafs]
name=OpenAFS for CentOS 7 - $basearch
baseurl=http://install.cs.pitt.edu/centos7/openafs/$basearch
enabled=1
EOFEOF

echo "Installing updates ... "
/usr/bin/yum -y update
if [ $? -ne 0 ]; then
    echo "FAILED!  Remainder of customizations aborted."
    exit 1
else
    echo "done"
fi

# Install EPEL, then DKMS, then OpenAFS, then pam_afs_session
yum -y install epel-release
yum -y install dkms
yum -y install openafs openafs-client openafs-compat openafs-krb5 dkms-openafs
yum -y install pam_afs_session

# Install extra packages from EPEL
yum -y install kstart taskjuggler taskjuggler-libs tofrodos unique \
    unique-devel xfig xfig-common

# Configure OpenAFS
mv /usr/vice/etc/ThisCell /usr/vice/etc/ThisCell.orig
echo "pitt.edu" > /usr/vice/etc/ThisCell
echo "pitt.edu pitt" > /usr/vice/etc/CellAlias
ed - /usr/vice/etc/cacheinfo << \EOFEOF
s/\/usr\/vice\/cache/\/var\/vice\/cache/
w
q
EOFEOF
mkdir -p /var/vice/cache
chmod 700 /var/vice/cache
ed - /usr/lib/systemd/system/openafs-client.service << \EOFEOF
/^ExecStart=/a
ExecStartPost=/usr/bin/fs sysname -newsys amd64_cen7
.
w
q
EOFEOF
systemctl daemon-reload
# need to add empty files if none exist
for i in /usr/vice/etc/SuidCells.dist /usr/vice/etc/SuidCells.local
do
    if [ ! -f "$i" ]; then
        cp /dev/null $i
    fi
done
systemctl enable openafs-client.service

echo "Swapping new files for old files"

for i in /etc/cups/printers.conf \
	etc/dconf/db/gdm.d/00-login-screen \
	etc/dconf/db/gdm.d/01-banner-message \
	etc/dconf/db/gdm.d/01-logo \
	etc/dconf/db/gdm.d/02-disable-user-switching \
	/etc/issue.net /etc/issue \
	/etc/krb5.conf /etc/chrony.conf \
	/etc/pam.d/password-auth-ac \
	/etc/pam.d/system-auth-ac \
	/etc/postfix/main.cf \
	/etc/shells /etc/snmp/snmpd.conf \
	/etc/ssh/ssh_config /etc/ssh/sshd_config \
	/root/.bashrc \
	usr/share/pixmaps/pittCS.jpg
do
	if [ -f $i.new ]; then
		if [ -f $i ]; then
			mv -i $i $i.orig
		fi
		mv -i $i.new $i
		echo $i
	fi
done
# Update the dconf database so the new config files take effect
dconf update
#
echo " ... done"
#
mkdir /var/run/authdir
echo -n "Removing conflicting accounts from /etc/passwd and /etc/shadow ..."
mv /etc/passwd /etc/passwd.orig
cp /etc/passwd.orig /etc/passwd
ed - /etc/passwd << \EOFEOF
/^mail:x:8:/d
w
q
EOFEOF
mv /etc/shadow /etc/shadow.orig
cp /etc/shadow.orig /etc/shadow
chmod 600 /etc/shadow
ed - /etc/shadow << \EOFEOF
/^mail:/d
w
q
EOFEOF
chmod 400 /etc/shadow
echo " ... done"


SELINUX=`grep SELINUX=enforcing /etc/selinux/config`
if [ "${SELINUX}x" != "x" ]; then
    echo -n "Disabling SELinux ..."
    mv /etc/selinux/config /etc/selinux/config.orig
    sed -e "s/^SELINUX=enforcing/SELINUX=disabled/" \
        /etc/selinux/config.orig > /etc/selinux/config
    echo " ... done"
fi
#
if [ -f /etc/Muttrc ]; then
    echo -n "Modifying /etc/Muttrc ..."
    mv /etc/Muttrc /etc/Muttrc.orig
    sed -e '/^# set hidden_host=no/s//set hidden_host=yes/' \
        -e '/^# set spoolfile=""/s//set spoolfile="imaps:\/\/exchange.pitt.edu\/INBOX"/' \
        /etc/Muttrc.orig >/etc/Muttrc
    echo " ... done"
else
    echo /etc/Muttrc not found
fi
#
echo "*.*							@logger" > /etc/rsyslog.d/catchall.conf

#
if [ -f /etc/sysconfig/desktop ]; then
    echo -n "Modifying /etc/sysconfig/desktop ..."
    mv /etc/sysconfig/desktop /etc/sysconfig/desktop.orig
    sed -e 's/GNOME/KDE/' /etc/sysconfig/desktop.orig >/etc/sysconfig/desktop
    echo " ... done"
else
    echo 'DESKTOP="KDE"' > /etc/sysconfig/desktop
    echo 'DISPLAYMANAGER="KDE"' >> /etc/sysconfig/desktop
fi
#
echo -n "Configuring boot-time services ... "
systemctl enable NetworkManager-wait-online.service
systemctl enable snmpd.service
systemctl disable firstboot-graphical.service
systemctl disable firewalld.service
systemctl disable kdump.service
systemctl disable libvirtd
systemctl disable libvirt-guests
systemctl disable virt-who
echo "done"
#
echo -n "Making symbolic links ... "
ln -s ../share/terminfo /usr/lib/terminfo
ln -s gawk /bin/nawk
#mv /usr/local /usr/local.orig
# @sys seems to be broken in CentOS 7; hard-code the link
#ln -s /afs/cs.pitt.edu/system/@sys/usr/local /usr/local
#ln -s /afs/cs.pitt.edu/system/amd64_cen7/usr/local /usr/local
#ln -s /afs/cs.pitt.edu/system/share/etc/nightly_update /etc/cron.daily/nightly_update
echo "done"
#
if [ -f /usr/bin/rdist ]; then
	chmod 500 /usr/bin/rdist
fi
#
#echo -n "Removing aliases for color-ls ... "
#if [ -f /etc/profile.d/colorls.csh ]; then
#	mv /etc/profile.d/colorls.csh /etc/profile.d/colorls.csh.orig
#fi
#if [ -f /etc/profile.d/colorls.sh ]; then
#	mv /etc/profile.d/colorls.sh /etc/profile.d/colorls.sh.orig
#fi
#echo "done"
#
#if [ -f /root/.kde/share/config/kdesktoprc ]; then
#        echo -n "Setting root's default screen saver ... "
#	mv /root/.kde/share/config/kdesktoprc /root/.kde/share/config/kdesktoprc.orig
#	echo "[ScreenSaver]" > /root/.kde/share/config/kdesktoprc
#	echo "Saver=KBlankscreen.desktop" >> /root/.kde/share/config/kdesktoprc
#	echo "" >> /root/.kde/share/config/kdesktoprc
#	cat /root/.kde/share/config/kdesktoprc.orig >> /root/.kde/share/config/kdesktoprc
#        echo "done"
#fi

echo 'RUN_FIRSTBOOT=NO' > /etc/sysconfig/firstboot

#for i in `grep -l "pam_succeed_if.so user != root" /etc/pam.d/*`
#do
#    mv ${i} ${i}.orig
#    sed -e "/pam_succeed_if.so user != root/s/.*/#&/" ${i}.orig > ${i}
#done

grep PERSISTENT_DHCLIENT /etc/sysconfig/network-scripts/ifup-eth > /dev/null
if [ $? -eq 0 ]; then
    for i in `ls /etc/sysconfig/network-scripts/ifcfg-* |sed -e /ifcfg-lo/d`
    do grep "BOOTPROTO=\"*dhcp\"*" $i > /dev/null
        if [ $? -eq 0 ]; then
            grep "ONBOOT=\"*yes\"*" $i > /dev/null
            if [ $? -eq 0 ]; then
                grep "PERSISTENT_DHCLIENT=\"*yes\"*" $i > /dev/null
                if [ $? -ne 0 ]; then
                    echo "PERSISTENT_DHCLIENT=\"yes\"" >> $i
                fi
            fi
        fi
    done
fi

cat > /etc/sudoers.d/techstaff << \EOFEOF
hoffman    ALL=(ALL)       ALL
n3cvl      ALL=(ALL)       ALL
tjw        ALL=(ALL)       ALL
ahobaugh   ALL=(ALL)       ALL
ach54      ALL=(ALL)       ALL
mad371     ALL=(ALL)       ALL
EOFEOF
chmod 440 /etc/sudoers.d/techstaff

mv /etc/sysconfig/man-db /etc/sysconfig/man-db.orig
sed -e "/OPTS/s/-q/& \/usr\/share\/man/" /etc/sysconfig/man-db.orig > /etc/sysconfig/man-db

echo "Creating /etc/cron.daily/updpass:"
cat > /etc/cron.daily/updpass << \END_OF_UPDPASS
#! /bin/sh
PWD="/afs/pitt.edu/common/etc/passwd.global"

if [ ! -f ${PWD} ]; then
    echo "Cannot access ${PWD}; update aborted."
    exit 1
fi

sed -e "s/sync::/sync:X:/" ${PWD} > /etc/passwd.tmp
sed -e "s/:X:.*/:X:14018:0:99999:7:::/" /etc/passwd.tmp > /etc/shadow.tmp
#
cat /etc/passwd.local /etc/passwd.tmp > /etc/passwd.new
#
if [ -f /etc/passwd ]; then
mv /etc/passwd /etc/passwd.old
fi
if [ -f /etc/passwd.new ]; then
mv /etc/passwd.new /etc/passwd
fi
if [ -f /etc/shadow ]; then
mv /etc/shadow /etc/shadow.old
fi
cat /etc/shadow.local /etc/shadow.tmp > /etc/shadow
chmod 0400 /etc/shadow
rm /etc/passwd.tmp /etc/shadow.tmp
#
# 12/21/2007 -- katsura account compromised
ed - /etc/shadow << \EOFEOF
/^katsura:/s/:X:/:!!:/
EOFEOF
END_OF_UPDPASS

chmod 755 /etc/cron.daily/updpass

echo "Creating /etc/passwd.local:"
mv /etc/passwd /etc/passwd.local
mv /etc/shadow /etc/shadow.local
mv /etc/passwd.cssd /etc/passwd
mv /etc/shadow.cssd /etc/shadow

echo "Updating /etc/group:"
mv /etc/group /etc/group.orig
cp /etc/group.orig /etc/group
cat >> /etc/group << \END_OF_GROUP
ACCOUNTS:*:5262:
PRINTERS:*:5594:
GUESTS:*:5123:
SPECIAL:*:4340:
USC_U1:*:1000:
USC_B:*:1001:
USC_G:*:1002:
USC_J:*:1003:
USC_P:*:1004:
USC_T:*:1005:
USC_U2:*:1006:
UNKNOWN1:*:2000:
BRADFORD:*:2001:
GREENSBU:*:2002:
JOHNSTOW:*:2003:
OAKLAND:*:2004:
TITUSVIL:*:2005:
UNKNOWN2:*:2006:
END_OF_GROUP

echo "Creating /usr/ucb/hostname:"
mkdir -p /usr/ucb
ln -s /bin/hostname /usr/ucb/hostname

echo "Creating /usr/pitt/bin/sysname:"
mkdir -p /usr/pitt/bin
cat > /usr/pitt/bin/sysname << \END_OF_SYSNAME
#! /bin/sh
/usr/afsws/bin/fs sysname |sed -e "s/Current sysname is '//" -e "s/'//"
END_OF_SYSNAME
chmod 755 /usr/pitt/bin/sysname

#if [ -f /var/yp/nicknames ]; then
#    /bin/mv /var/yp/nicknames /var/yp/nicknames.orig
#    /bin/cp /var/yp/nicknames.orig /var/yp/nicknames
#    echo "shadow            shadow.byname" >> /var/yp/nicknames
#fi

#
echo ""
echo ""
echo "All done.  Cross your fingers and reboot."