#!/usr/bin/env bash
# -------------------------------------------------
# audit_packages.sh – reproducible package audit
# -------------------------------------------------
set -euo pipefail

TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
AUDIT_DIR="${HOME}/audit_${TIMESTAMP}"
mkdir -p "${AUDIT_DIR}"
chmod 700 "${AUDIT_DIR}"

# -------------------------------------------------
# 1. OS / kernel info
# -------------------------------------------------
cat /etc/os-release > "${AUDIT_DIR}/os_release.txt"
uname -a >> "${AUDIT_DIR}/kernel.txt"
lsb_release -a >> "${AUDIT_DIR}/os_release.txt" 2>/dev/null || true

# -------------------------------------------------
# 2. DEB packages
# -------------------------------------------------
dpkg -l > "${AUDIT_DIR}/dpkg_list.txt"
apt list --installed > "${AUDIT_DIR}/apt_installed.txt"
dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' > "${AUDIT_DIR}/dpkg_detailed.txt"
apt-mark showmanual > "${AUDIT_DIR}/manual_installed.txt"
apt-mark showauto   > "${AUDIT_DIR}/auto_installed.txt"

# -------------------------------------------------
# 3. Snap packages (if snapd is present)
# -------------------------------------------------
if command -v snap >/dev/null; then
    snap list > "${AUDIT_DIR}/snap_list.txt"
fi

# -------------------------------------------------
# 4. Flatpak packages (if flatpak is present)
# -------------------------------------------------
if command -v flatpak >/dev/null; then
    flatpak list > "${AUDIT_DIR}/flatpak_list.txt"
fi

# -------------------------------------------------
# 5. Language‑specific packages
# -------------------------------------------------
if command -v pip3 >/dev/null; then
    pip3 list --format=columns > "${AUDIT_DIR}/pip3_list.txt"
fi

if command -v npm >/dev/null; then
    npm list -g --depth=0 > "${AUDIT_DIR}/npm_global.txt"
fi

# -------------------------------------------------
# 6. Example: which DEB owns /bin/bash
# -------------------------------------------------
dpkg -S "$(command -v bash)" > "${AUDIT_DIR}/bash_owning_package.txt" 2>/dev/null || true

# -------------------------------------------------
# 7. SYSTEM & SECURITY BASELINE
# -------------------------------------------------
# 7.1 Systemd unit status (enabled/disabled, failed)
# NOTE: These commands need root to see *all* units. Uncomment if running as root.
# systemctl list-unit-files --type=service > "${AUDIT_DIR}/systemd_unit_files.txt"
# systemctl --failed > "${AUDIT_DIR}/systemd_failed_units.txt"

# 7.2 Running services (active units)
# NOTE: Root privileges give a complete view. Uncomment if desired.
# systemctl list-units --type=service --state=running > "${AUDIT_DIR}/systemd_running_services.txt"

# -------------------------------------------------
# 8. USERS, GROUPS & PRIVILEGE ESCALATION
# -------------------------------------------------
# 8.1 Local users (passwd entries) – readable by any user
getent passwd > "${AUDIT_DIR}/passwd_entries.txt"

# 8.2 Local groups – readable by any user
getent group > "${AUDIT_DIR}/group_entries.txt"

# 8.3 sudo configuration (who can sudo) – may prompt for password
# sudo -l > "${AUDIT_DIR}/sudoers.txt" 2>/dev/null || echo "sudo not configured" > "${AUDIT_DIR}/sudoers.txt"
echo "sudo check skipped (requires password/root)" > "${AUDIT_DIR}/sudoers.txt"

# 8.4 Authorized SSH keys (all users) – readable by any user
{
    for d in /home/*/.ssh; do
        [ -d "$d" ] && cat "$d/authorized_keys" 2>/dev/null
    done
} > "${AUDIT_DIR}/ssh_authorized_keys.txt"

# 8.5 Shadow file (password hashes & policies) – **requires root**
# Uncomment the line below if you run the script as root.
# cat /etc/shadow > "${AUDIT_DIR}/shadow.txt" 2>/dev/null || echo "shadow not readable" > "${AUDIT_DIR}/shadow.txt"

# 8.6 Cron jobs (system‑wide and per‑user) – root crontab needs root
# Uncomment if you have root privileges.
# crontab -l > "${AUDIT_DIR}/root_crontab.txt" 2>/dev/null || true
for u in $(cut -d: -f1 /etc/passwd); do
    crontab -u "$u" -l > "${AUDIT_DIR}/crontab_${u}.txt" 2>/dev/null || true
done

# -------------------------------------------------
# 9. NETWORK & FIREWALL
# -------------------------------------------------
# 9.1 Listening sockets
ss -tulnp > "${AUDIT_DIR}/listening_sockets.txt"

# 9.2 Active network connections
ss -tunap > "${AUDIT_DIR}/active_connections.txt"

# 9.3 Firewall rules (ufw or iptables) – iptables needs root
if command -v ufw >/dev/null; then
    # ufw status verbose > "${AUDIT_DIR}/firewall_ufw.txt"
    echo "ufw status skipped (requires root)" > "${AUDIT_DIR}/firewall_ufw.txt"
else
    # iptables requires root; uncomment if running as root.
    # iptables -L -nv > "${AUDIT_DIR}/firewall_iptables.txt"
    echo "iptables command requires root – not executed" > "${AUDIT_DIR}/firewall_iptables.txt"
fi

# 9.4 Routing table
ip route show > "${AUDIT_DIR}/routing_table.txt"

# 9.5 Network interfaces & IP addresses
ip -brief address > "${AUDIT_DIR}/interfaces.txt"

# -------------------------------------------------
# 10. STORAGE & FILESYSTEM
# -------------------------------------------------
# 10.1 Disk usage per filesystem
df -hT > "${AUDIT_DIR}/disk_usage.txt"

# 10.2 Mounted filesystems (options)
mount > "${AUDIT_DIR}/mounts.txt"

# 10.3 Top‑10 largest files on the system
# du -ah / | sort -rh | head -n 10 > "${AUDIT_DIR}/largest_files.txt"
echo "du check skipped (requires root to scan /)" > "${AUDIT_DIR}/largest_files.txt"

# 10.4 Modified package files (debsums) – needs root for a full check
# Uncomment if you have root privileges.
# if command -v debsums >/dev/null; then
#     debsums -s > "${AUDIT_DIR}/modified_deb_files.txt" 2>/dev/null || echo "No modified files detected" > "${AUDIT_DIR}/modified_deb_files.txt"
# else
#     echo "debsums not installed" > "${AUDIT_DIR}/modified_deb_files.txt"
# fi
echo "debsums check omitted (requires root)" > "${AUDIT_DIR}/modified_deb_files.txt"

# -------------------------------------------------
# 11. BUILD A SINGLE HUMAN‑READABLE REPORT
# -------------------------------------------------
{
    echo "=== OS INFORMATION ==="
    cat "${AUDIT_DIR}/os_release.txt"

    echo -e "\n=== KERNEL ==="
    cat "${AUDIT_DIR}/kernel.txt"

    echo -e "\n=== DEB PACKAGES (dpkg -l) ==="
    cat "${AUDIT_DIR}/dpkg_list.txt"

    echo -e "\n=== APT INSTALLED LIST ==="
    cat "${AUDIT_DIR}/apt_installed.txt"

    echo -e "\n=== SNAP PACKAGES ==="
    cat "${AUDIT_DIR}/snap_list.txt" 2>/dev/null || echo "Snap not installed"

    echo -e "\n=== FLATPAK PACKAGES ==="
    cat "${AUDIT_DIR}/flatpak_list.txt" 2>/dev/null || echo "Flatpak not installed"

    echo -e "\n=== PYTHON3 PACKAGES ==="
    cat "${AUDIT_DIR}/pip3_list.txt" 2>/dev/null || echo "pip3 not installed"

    echo -e "\n=== NODEJS GLOBAL PACKAGES ==="
    cat "${AUDIT_DIR}/npm_global.txt" 2>/dev/null || echo "npm not installed"

    echo -e "\n=== MANUALLY INSTALLED DEB PACKAGES ==="
    cat "${AUDIT_DIR}/manual_installed.txt"

    echo -e "\n=== AUTOMATIC DEB PACKAGES ==="
    cat "${AUDIT_DIR}/auto_installed.txt"

    echo -e "\n=== OWNING PACKAGE FOR /bin/bash ==="
    cat "${AUDIT_DIR}/bash_owning_package.txt" 2>/dev/null || echo "Not found"

    # ---- System & security baseline ----
    echo -e "\n=== SYSTEMD UNIT FILES (enabled/disabled) ==="
    cat "${AUDIT_DIR}/systemd_unit_files.txt" 2>/dev/null || echo "Skipped (requires root)"

    echo -e "\n=== SYSTEMD FAILED UNITS ==="
    cat "${AUDIT_DIR}/systemd_failed_units.txt" 2>/dev/null || echo "Skipped (requires root)"

    echo -e "\n=== SYSTEMD RUNNING SERVICES ==="
    cat "${AUDIT_DIR}/systemd_running_services.txt" 2>/dev/null || echo "Skipped (requires root)"

    # ---- Users, groups & privilege escalation ----
    echo -e "\n=== /etc/passwd ENTRIES ==="
    cat "${AUDIT_DIR}/passwd_entries.txt"

    echo -e "\n=== /etc/group ENTRIES ==="
    cat "${AUDIT_DIR}/group_entries.txt"

    echo -e "\n=== SUDOERS (who can sudo) ==="
    cat "${AUDIT_DIR}/sudoers.txt"

    echo -e "\n=== SSH AUTHORIZED KEYS ==="
    cat "${AUDIT_DIR}/ssh_authorized_keys.txt"

    echo -e "\n=== /etc/shadow (password hashes) ==="
    cat "${AUDIT_DIR}/shadow.txt" 2>/dev/null || echo "Skipped (requires root)"

    echo -e "\n=== ROOT CRONTAB ==="
    cat "${AUDIT_DIR}/root_crontab.txt" 2>/dev/null || echo "Skipped (requires root)"

    echo -e "\n=== USER CRONTABS ==="
    for f in "${AUDIT_DIR}"/crontab_*.txt; do
        echo "---- $(basename "$f") ----"
        cat "$f"
    done

    # ---- Network & firewall ----
    echo -e "\n=== LISTENING SOCKETS ==="
    cat "${AUDIT_DIR}/listening_sockets.txt"

    echo -e "\n=== ACTIVE NETWORK CONNECTIONS ==="
    cat "${AUDIT_DIR}/active_connections.txt"

    echo -e "\n=== FIREWALL RULES ==="
    if [ -f "${AUDIT_DIR}/firewall_ufw.txt" ]; then
        cat "${AUDIT_DIR}/firewall_ufw.txt"
    else
        cat "${AUDIT_DIR}/firewall_iptables.txt"
    fi

    echo -e "\n=== ROUTING TABLE ==="
    cat "${AUDIT_DIR}/routing_table.txt"

    echo -e "\n=== NETWORK INTERFACES ==="
    cat "${AUDIT_DIR}/interfaces.txt"

    # ---- Storage & filesystem ----
    echo -e "\n=== DISK USAGE ==="
    cat "${AUDIT_DIR}/disk_usage.txt"

    echo -e "\n=== MOUNTED FILESYSTEMS ==="
    cat "${AUDIT_DIR}/mounts.txt"

    echo -e "\n=== TOP 10 LARGEST FILES ==="
    cat "${AUDIT_DIR}/largest_files.txt"

    echo -e "\n=== MODIFIED DEB PACKAGE FILES (debsums) ==="
    cat "${AUDIT_DIR}/modified_deb_files.txt"
} > "${AUDIT_DIR}/audit_report.txt"

echo "Audit completed. Report saved to ${AUDIT_DIR}/audit_report.txt"