setup_security.sh

#!/bin/bash
PATH="/bin:/usr/bin:/sbin:/usr/sbin"

##################################################################
# Configuration
#
USER_NAME="Coiney"
#
# There is no user configurable parts below this line
##################################################################
set -e

#
# Return codes:
# 0 - all OK
# 1 - user already exists
# 2 - could not generate password
#

# Run this at the verey begining just to make sure user has sudo
# permissions.
cache_sudo() {
    cat <<EOF
This script uses sudo to create user account and to modify system setting.
Please provide your sudo password.


EOF
    sudo -l > /dev/null 2>&1
}
random_password() {
    ruby -r securerandom -e "puts SecureRandom.base64(15)" | tr -d "[:punct:]" 2> /dev/null
}

guard(){
    local TARGETUSER=${1}

    if dscl . -list /Users | grep ${TARGETUSER} > /dev/null
    then
        echo "User ${TARGETUSER} already exists."
        exit 1
    fi
}

make_admin_user(){
echo "-- Creating admin user "
    local TARGETUSER=${1}
    local PASSWORD=${2}

    GID=$(dscl . list groups gid | awk '$1 ~ /^staff/ {print $2}')

    sudo dscl . -create /Users/${TARGETUSER}
    sudo dscl . -create /Users/${TARGETUSER} UserShell /bin/bash
    sudo dscl . -create /Users/${TARGETUSER} RealName ${TARGETUSER}

    lastid=$(dscl . -list /Users UniqueID | awk 'BEGIN {max = 0} {if ($2>max) max=$2} END {print max}')
    newid=$((lastid+1))

    sudo dscl . -create /Users/${TARGETUSER} UniqueID         ${newid}
    sudo dscl . -create /Users/${TARGETUSER} PrimaryGroupID   ${GID}
    sudo dscl . -create /Users/${TARGETUSER} NFSHomeDirectory /Users/${TARGETUSER}

    sudo cp -a /System/Library/User\ Template/English.lproj /Users/${TARGETUSER}
    sudo chown -R ${TARGETUSER}\:staff /Users/${TARGETUSER}
    sudo chmod 701 /Users/${TARGETUSER}
    sudo dscl . -passwd /Users/${TARGETUSER} ${PASSWORD}
    sudo dscl . append /Groups/admin GroupMembership ${TARGETUSER}

    # Admin user should NOT expire
    sudo pwpolicy -setpolicy -u ${TARGETUSER} "maxMinutesUntilChangePassword=2147483647"
}

# This sets global policy
set_pw_policy(){
    echo "-- Setting default password policies"

    sudo pwpolicy -setglobalpolicy \
         "minChars=7 maxFailedLoginAttempts=3 requiresNumeric=1 requiresAlpha=1 usingHistory=4 maxFailedLoginAttempts=6 maxMinutesUntilChangePassword=129600"

}

# Configure Screen saver to 15 mins - PCI DSS requirement
screen_saver() {
    echo "-- Configuring screensaver"
    defaults -currentHost write com.apple.screensaver idleTime 900
}

# Require password immediately after sleep or screen saver begins
screen_lock() {
    echo "-- Configuring screen lock"
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int 0
}

print_out_admins(){
    echo "-------check admins-------"
    dscl localhost -read /Local/Default/Groups/admin
}

computer_name() {
    scutil --get ComputerName
}

print_policy() {
    echo '----------------------------------------------------------'
    printf "Your effective password policies are:\n\n\n"
    pwpolicy get-effective-policy  -u $(whoami)
}

save_password() {
    local OUTPUT="${HOME}/admin_user_password.txt"
    cat <<EOF > ${OUTPUT}
================================================================


This password was generated by security script for administrator
user '${USER_NAME}' on
computer "$(computer_name)" at $(date "+%Y %m %d %H:%M")

${USER_NAME}'s password: ${PASSWORD}

Please keep this record safe.

================================================================
EOF

    cat <<EOF

  **********************************************************************
  *
  *  User's ${USER_NAME} password saved to the file
  *
  * ${OUTPUT}
  *
  * Please print out and delete this file. Keep it in safe place.
  *
  **********************************************************************

EOF
    open -e --background --fresh ${OUTPUT}
}

cache_sudo
guard ${USER_NAME}

PASSWORD=$(random_password)

test -z "${PASSWORD}" && { echo "Something wrong. Empty password."; exit 2; }

save_password
set_pw_policy
make_admin_user ${USER_NAME} ${PASSWORD}
print_out_admins
screen_saver
screen_lock
print_policy

printf  "\n\n\n----success----\n\n\n"
exit 0