#!/bin/bash
# Script for setting up FreeNX with custom keys, and SSH-server if not running.
# Suitable for non-headless boxes you want access to, else just use ssh.
# SSH-keys are set up for PuTTY import, so pubkey is added to /%h/.ssh/authorized_keys.
# This is, obviously, just my way of doing it, my needs are a Linux server 
# with secure GUI access from work. Feel very free to adjust.
#
# Running this script will result in the following:
# 
# OpenSSH will be installed and configured with key authorization only, using RSA 4096 bit key.
# FreeNX will be installed and configured with custom keys.
# 
# Written by Svein Arne Røed. Use at your own risk, there is no guarantee.
# This script is tested working on Kubuntu 9.10.

#####################################################################################################
# Prerequisites (OpenSSH + key and some variables)
#####################################################################################################

# Make sure script is running as root
if [ "$(id -u)" != "0" ]; then
   echo "This script must run as root." 1>&2
   exit 1
fi

if [ "$1" == "" ]; then
	echo -e "\n Usage: sshnx [user] \n"
	exit 1
else
	export USER="$1"
fi

# Adjust if your distro does it another way
export SSHD_CONFIG="/etc/ssh/sshd_config"
export FREENX_CONFIG="/etc/nxserver/node.conf"

# Check for present SSH-server and install if not present
type -P sshd &>/dev/null || { \
echo "No OpenSSH-server found, installing one now."; aptitude install --assume-yes \
openssh-server ssh; } && echo -e "SSH server found, moving on..   \n"
if [ ! -f /home/${USER}/.ssh/id_rsa ]; then
	echo "RSA key not found for user $USER, generating.. ";
    su $USER -c	"ssh-keygen -t rsa -b 4096 -f /home/${USER}/.ssh/id_rsa -N ''";
	su $USER -c "touch /home/${USER}/.ssh/authorized_keys";
	cat /home/${USER}/.ssh/id_rsa.pub >> /home/${USER}/.ssh/authorized_keys
	else
	echo -e "RSA key found for user $USER, I will skip creating in case you \
	want to use the existing one(s). \n"
fi

#####################################################################################################
# Getting FreeNX
#####################################################################################################

type -P nxserver &>/dev/null && echo -e "\nFreeNX server found, moving on \n" || { \
echo -e "\nGetting FreeNX\n"; aptitude install --assume-yes python-software-properties;
add-apt-repository ppa:freenx-team; aptitude update; aptitude install --assume-yes freenx; }

#####################################################################################################
# Configure OpenSSH + FreeNX
#####################################################################################################

echo "# Added by sshnx script" >> ${SSHD_CONFIG}
echo "AllowUsers nx ${USER}" >> ${SSHD_CONFIG}

sed -i 's/PubkeyAuthentication no/PubkeyAuthentication yes/' ${SSHD_CONFIG}
echo "# Made sure that PubkeyAuthentication was set to yes" >> ${SSHD_CONFIG}

sed -i 's/PermitRootLogin yes/PermitRootLogin no/' ${SSHD_CONFIG}
echo "# Made sure that PermitRootLogin was set to no" >> ${SSHD_CONFIG}

sed -i 's/^#[[:space:]]*PasswordAuthentication/PasswordAuthentication/' ${SSHD_CONFIG}
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' ${SSHD_CONFIG}
echo "# Made sure that PasswordAuthentication was set to no" >> ${SSHD_CONFIG}

sed -i 's/StrictModes no/StrictModes yes/' ${SSHD_CONFIG}
echo "# Made sure that StrictModes was set to yes" >> ${SSHD_CONFIG}

sed -i 's/LogLevel INFO/LogLevel VERBOSE/' ${SSHD_CONFIG}
echo "# Made sure that we can log attempted logins (LogLevel VERBOSE)" >> ${SSHD_CONFIG}

sed -i 's/UsePAM no/UsePAM yes/' ${SSHD_CONFIG}
echo "# Made sure that we use PAM" >> ${SSHD_CONFIG}

sed -i 's/^#[[:space:]]*AuthorizedKeys/AuthorizedKeys/' ${SSHD_CONFIG}
echo "# Made sure that AuthorizedKeys file is uncommented" >> ${SSHD_CONFIG}

sed -i 's/X11Forwarding yes/X11Forwarding no/' ${SSHD_CONFIG}
echo "# Made sure that X11Forwarding is set to no" >> ${SSHD_CONFIG}

echo -e "# sshnx script done\n" >> ${SSHD_CONFIG}

# Just to make sure..
chmod 755 /home/${USER}/.ssh
chown ${USER}:${USER} /home/${USER}/.ssh/*
chmod 600/home/${USER}/.ssh/authorized_keys
chmod 600/home/${USER}/.ssh/id_rsa
chmod 644/home/${USER}/.ssh/id_rsa.pub

clear
echo -e "\nATTENTION\n"
read -p "Press 'y' for custom keys when prompted by nxserver installer"
# Run the nxserver installscript
/usr/lib/nx/nxsetup --install

echo "# Added by sshnx script" >> ${FREENX_CONFIG}
sed -i 's/^#[[:space:]]*ENABLE_PASSDB_AUTHENTICATION/ENABLE_PASSDB_AUTHENTICATION/' ${FREENX_CONFIG}
sed -i 's/ENABLE_PASSDB_AUTHENTICATION="1"/ENABLE_PASSDB_AUTHENTICATION="0"/' ${FREENX_CONFIG}

sed -i 's/^#[[:space:]]*ENABLE_USER_AUTHENTICATION/ENABLE_USERDB_AUTHENTICATION/' ${FREENX_CONFIG}
sed -i 's/ENABLE_USERMODE_AUTHENTICATION="1"/ENABLE_USERMODE_AUTHENTICATION="0"/' ${FREENX_CONFIG}

sed -i 's/^#[[:space:]]*ENABLE_SSH_AUTHENTICATION/ENABLE_SSH_AUTHENTICATION/' ${FREENX_CONFIG}
sed -i 's/ENABLE_SSH_AUTHENTICATION="1"/ENABLE_SSH_AUTHENTICATION="0"/' ${FREENX_CONFIG}

sed -i 's/^#[[:space:]]*ENABLE_SU_AUTHENTICATION/ENABLE_SU_AUTHENTICATION/' ${FREENX_CONFIG}
sed -i 's/ENABLE_SU_AUTHENTICATION="0"/ENABLE_SU_AUTHENTICATION="1"/' ${FREENX_CONFIG}
echo "# Made sure that authentication method is SU only" >> ${FREENX_CONFIG}

sed -i 's/^#[[:space:]]*SSHD_PORT=22/SSHD_PORT=22/' ${FREENX_CONFIG}
echo "# Made sure that SSHD_PORT is uncommented" >> ${FREENX_CONFIG}
echo -e "# sshnx script done\n" >> ${FREENX_CONFIG}

cat /var/lib/nxserver/home/.ssh/server.id_dsa.pub.key >> /var/lib/nxserver/home/.ssh/authorized_keys

# Delete default keys
rm /etc/nxserver/user.id_dsa*

/etc/init.d/ssh restart
/etc/init.d/freenx-server restart >&/dev/null

echo -e "\nOpenSSH and FreeNX up and running, only PuTTY and NX client to go."
echo -e "SSH server currently listening on port 22. Remember to open/rewrite router/firewall."
echo -e "\n\nGeneral info: Import private ssh key in /home/${USER}/.ssh/id_rsa in PuTTY(gen)"
echo -e "to generate .ppk keyfile. Authorized_keys file updated with pubkey.\n"
echo "If you didn't have a RSA key the one now present has no passphrase,"
echo "add one with the following command: ssh-keygen -f /home/${USER}/.ssh/id_rsa -p"
echo -e "\nImport /var/lib/nxserver/home/.ssh/client.id_dsa.key in NX client\n\n"