#!/bin/sh

UNAME=$(uname)
[ $(id -u) -ne 0 ] && { echo "error: this script must be run as root">&2; exit 1; }

echo "warning: this script will disable ssh password authentication"
echo -n "continue? [y/N] "
read answer

[ "${answer}" != "y" ] && exit 0

echo "cleaning ssh host keys"
rm /etc/ssh/ssh_host_{ecdsa,dsa,dss}_key* 2>/dev/null
[ ! -f /etc/ssh/ssh_host_ed25519_key ] && ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" > /dev/null
[ ! -f /etc/ssh/ssh_host_rsa_key ] && ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" > /dev/null

ssh_config="/etc/ssh/sshd_config"
echo "writing ssh config"
[ -f ${ssh_config} ] && mv ${ssh_config} ${ssh_config}.bak

cat <<EOF> ${ssh_config}
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512
PubkeyAcceptedAlgorithms ssh-ed25519,rsa-sha2-512
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
Compression no
PermitRootLogin no
ChallengeResponseAuthentication no
PasswordAuthentication no
HostbasedAuthentication no
KerberosAuthentication no
PrintMotd no
Subsystem sftp internal-sftp
EOF

[ "${UNAME}" = "Linux" ] && cat <<EOF>> ${ssh_config}
UsePrivilegeSeparation sandbox
UsePAM yes
EOF

echo -n "enter your username "
read user

if [ -z "${user}" ]; then
  echo "error: no user submitted">&2
  mv ${ssh_config}.bak ${ssh_config}
  exit 1
fi

user_ssh="/home/${user}/.ssh"
user_auth_keys="${user_ssh}/authorized_keys"
[ ! -d ${user_ssh} ] && mkdir ${user_ssh}
chmod 700 ${user_ssh}
chown ${user}: ${user_ssh}

echo "paste your full ssh public key "
read sshkey

if [ -z "${sshkey}" ]; then
  echo "error: no ssh key submitted">&2
  mv ${ssh_config}.bak ${ssh_config}
  exit 1
fi

echo "${sshkey}" > ${user_auth_keys}
chmod 600 ${user_auth_keys}
chown ${user}: ${user_auth_keys}

case ${UNAME} in
  Linux)
    service ssh restart
  ;;
  OpenBSD)
    rcctl restart sshd
  ;;
  FreeBSD)
    /etc/rc.d/sshd restart
  ;;
esac

if [ -z "$(ps aux -w | awk '/\/usr\/s?bin\/sshd/')" ]; then
  echo "error: ssh service failed to restart">&2
  echo "please check for sshd config errors manually">&2
  exit 1
fi