#!/bin/bash
#
# Cockpit TLS Hardening Script for CentOS 7 based StarWind Virtual Storage Appliance
# This script disables TLSv1.1, TLSv1.0, SSLv3 and removes weak ciphers
# Tested on: CentOS 7 with Cockpit 195.12 and GnuTLS 3.3.29
#

set -e

echo "========================================"
echo "Cockpit TLS Hardening Script"
echo "========================================"
echo ""

# Check if running as root, if not re-execute with sudo
if [[ $EUID -ne 0 ]]; then
   echo "This script requires root privileges."
   echo "Re-executing with sudo..."
   exec sudo "$0" "$@"
   exit $?
fi

# Check if Cockpit is installed
if ! rpm -q cockpit-ws &>/dev/null; then
    echo "ERROR: Cockpit is not installed"
    exit 1
fi

echo "[1/6] Backing up existing configuration..."

# Backup existing files if they exist
if [[ -f /etc/cockpit/cockpit.conf ]]; then
    cp /etc/cockpit/cockpit.conf /etc/cockpit/cockpit.conf.backup.$(date +%Y%m%d-%H%M%S)
    echo "  ✓ Backed up /etc/cockpit/cockpit.conf"
fi

if [[ -d /etc/systemd/system/cockpit.service.d ]]; then
    cp -r /etc/systemd/system/cockpit.service.d /etc/systemd/system/cockpit.service.d.backup.$(date +%Y%m%d-%H%M%S)
    echo "  ✓ Backed up systemd overrides"
fi

echo ""
echo "[2/6] Creating GnuTLS priority configuration..."

# Create GnuTLS priority file
cat > /etc/cockpit/gnutls-priority.conf << 'EOF'
SECURE128:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-3DES-CBC:-ARCFOUR-128
EOF

echo "  ✓ Created /etc/cockpit/gnutls-priority.conf"
echo "  Priority string: SECURE128:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-3DES-CBC:-ARCFOUR-128"

echo ""
echo "[3/6] Creating Cockpit configuration file..."

# Create/update cockpit.conf
cat > /etc/cockpit/cockpit.conf << 'EOF'
[WebService]
# TLS Configuration
# This uses GnuTLS priority strings via environment variable
# Actual TLS settings are enforced through systemd service override
AllowUnencrypted = false
EOF

echo "  ✓ Created /etc/cockpit/cockpit.conf"

echo ""
echo "[4/6] Creating systemd service override..."

# Create systemd override directory
mkdir -p /etc/systemd/system/cockpit.service.d

# Create systemd override file
cat > /etc/systemd/system/cockpit.service.d/override.conf << 'EOF'
[Service]
Environment="G_TLS_GNUTLS_PRIORITY=SECURE128:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-3DES-CBC:-ARCFOUR-128"
Environment="GNUTLS_DEBUG_LEVEL=2"
EOF

echo "  ✓ Created /etc/systemd/system/cockpit.service.d/override.conf"

echo ""
echo "[5/6] Reloading systemd and restarting Cockpit..."

# Reload systemd
systemctl daemon-reload
echo "  ✓ Reloaded systemd"

# Restart Cockpit
systemctl stop cockpit.service 2>/dev/null || true
systemctl stop cockpit.socket
sleep 2
systemctl start cockpit.socket
sleep 3

# Check if service started
if systemctl is-active --quiet cockpit.socket; then
    echo "  ✓ Cockpit restarted successfully"
else
    echo "  ✗ WARNING: Cockpit socket failed to start"
    echo "  Check logs with: journalctl -u cockpit.socket -u cockpit.service --no-pager"
fi

echo ""
echo "[6/6] Verifying configuration..."

# Show applied configuration
echo ""
echo "Applied TLS Configuration:"
echo "-------------------------"
systemctl show cockpit.service | grep "Environment=" | grep G_TLS

echo ""
echo "Service Status:"
echo "---------------"
systemctl status cockpit.socket --no-pager | head -5

echo ""
echo "========================================"
echo "Configuration Complete!"
echo "========================================"
echo ""
echo "What was changed:"
echo "  • Disabled: SSLv3, TLSv1.0, TLSv1.1"
echo "  • Enabled: TLSv1.2 only"
echo "  • Removed weak ciphers: 3DES, RC4"
echo "  • Enforced strong cipher suites"
echo ""
echo "To verify externally, run from another machine:"
echo "  sslscan <server-ip>:9090"
echo ""
echo "To test TLS versions:"
echo "  openssl s_client -connect <server-ip>:9090 -tls1_1  # Should FAIL"
echo "  openssl s_client -connect <server-ip>:9090 -tls1_2  # Should SUCCEED"
echo ""
echo "To rollback changes:"
echo "  1. Restore: /etc/cockpit/cockpit.conf.backup.*"
echo "  2. Restore: /etc/systemd/system/cockpit.service.d.backup.*"
echo "  3. Remove: /etc/cockpit/gnutls-priority.conf"
echo "  4. Run: systemctl daemon-reload && systemctl restart cockpit.socket"
echo ""
echo "Logs location:"
echo "  journalctl -u cockpit.service -u cockpit.socket --since '5 minutes ago'"
echo ""