#!/bin/bash
# Security hardening script
set -euo pipefail

# Function to create WiFi module blacklist
create_wifi_blacklist() {
  local output_file="${1:-/etc/modprobe.d/blacklist-wifi.conf}"

  cat >"$output_file" <<'EOF'
# WiFi module blacklisting
blacklist cfg80211
blacklist mac80211
blacklist brcmfmac
blacklist iwlwifi
blacklist ath9k
blacklist rt73usb
EOF

  echo "WiFi blacklist created at $output_file"
}

# Function to create Bluetooth module blacklist
create_bluetooth_blacklist() {
  local output_file="${1:-/etc/modprobe.d/blacklist-bluetooth.conf}"

  cat >"$output_file" <<'EOF'
# Bluetooth module blacklisting
blacklist btusb
blacklist bluetooth
blacklist btrtl
blacklist btintel
blacklist btbcm
EOF

  echo "Bluetooth blacklist created at $output_file"
}

# Function to configure SSH
configure_ssh() {
  local output_file="${1:-/etc/ssh/sshd_config}"

  cat >"$output_file" <<'EOF'
# SSH Security Configuration
Protocol 2
PermitRootLogin no
PasswordAuthentication yes
PubkeyAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
EOF

  echo "SSH configuration created at $output_file"
}

# Function to configure password policy
configure_password_policy() {
  local output_file="${1:-/etc/security/pwquality.conf}"

  cat >"$output_file" <<'EOF'
# Password quality requirements
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
difok = 4
maxrepeat = 3
usercheck = 1
dictcheck = 1
EOF

  echo "Password policy configured at $output_file"
}

# Function to configure system limits
configure_system_limits() {
  local output_file="${1:-/etc/security/limits.d/security.conf}"

  cat >"$output_file" <<'EOF'
# System security limits
* hard core 0
* soft nproc 1024
* hard nproc 2048
EOF

  echo "System limits configured at $output_file"
}

# Function to configure audit rules
configure_audit_rules() {
  local output_file="${1:-/etc/audit/rules.d/audit.rules}"

  cat >"$output_file" <<'EOF'
# Audit rules for security compliance
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /var/log/audit/ -p wa -k log_audit
-w /var/log/secure -p wa -k log_secure
-w /etc/wireguard/ -p wa -k wireguard_config
EOF

  echo "Audit rules configured at $output_file"
}

# Function to apply all security configurations
apply_security_hardening() {
  echo "Applying security hardening..."

  create_wifi_blacklist
  create_bluetooth_blacklist
  configure_ssh
  configure_password_policy
  configure_system_limits
  configure_audit_rules

  echo "Security hardening completed."
}

# Main execution
main() {
  echo "Starting KNEL-Football security hardening..."
  apply_security_hardening
  echo "Security hardening completed successfully!"
}

# Run main if script is executed directly
if [[ ${BASH_SOURCE[0]} == "${0}" ]]; then
  main "$@"
fi