Configure Linux user and group management with useradd, usermod and advanced account security

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration variables
APP_USER="${1:-appuser}"
DEV_USER="${2:-devuser}"
SERVICE_USER="${3:-webservice}"

# Usage function
usage() {
    echo "Usage: $0 [app_user] [dev_user] [service_user]"
    echo "Default users: appuser, devuser, webservice"
    echo "Example: $0 myapp mydev myservice"
    exit 1
}

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Error handling and cleanup
cleanup() {
    log_warning "Script interrupted. Cleaning up..."
    # Remove any partially created users if they exist
    for user in "$APP_USER" "$DEV_USER" "$SERVICE_USER" tempuser; do
        if id "$user" &>/dev/null; then
            userdel -r "$user" 2>/dev/null || true
        fi
    done
    # Remove created groups
    for group in developers webadmins dbusers; do
        groupdel "$group" 2>/dev/null || true
    done
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PAM_PWQUALITY_CONF="/etc/security/pwquality.conf"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PAM_PWQUALITY_CONF="/etc/security/pwquality.conf"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PAM_PWQUALITY_CONF="/etc/security/pwquality.conf"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution (/etc/os-release not found)"
    exit 1
fi

log_info "Detected distribution: $ID using $PKG_MGR"

# Main installation process
echo "[1/10] Updating package manager and installing user management utilities..."
case "$PKG_MGR" in
    apt)
        apt update
        $PKG_INSTALL passwd adduser libpam-pwquality
        ;;
    dnf|yum)
        $PKG_INSTALL passwd shadow-utils libpwquality
        ;;
esac
log_success "User management utilities installed"

echo "[2/10] Creating groups for user organization..."
groupadd -g 2001 developers 2>/dev/null || log_warning "Group 'developers' already exists"
groupadd webadmins 2>/dev/null || log_warning "Group 'webadmins' already exists"
groupadd -g 3001 dbusers 2>/dev/null || log_warning "Group 'dbusers' already exists"
log_success "Groups created successfully"

echo "[3/10] Creating application user: $APP_USER..."
if ! id "$APP_USER" &>/dev/null; then
    useradd -m -s /bin/bash -c "Application User" "$APP_USER"
    echo "$APP_USER:$(openssl rand -base64 12)" | chpasswd
    usermod -aG developers,webadmins "$APP_USER"
    log_success "Application user $APP_USER created"
else
    log_warning "User $APP_USER already exists"
fi

echo "[4/10] Creating developer user: $DEV_USER..."
if ! id "$DEV_USER" &>/dev/null; then
    useradd -m -u 2001 -g developers -s /bin/bash -c "Developer Account" "$DEV_USER"
    echo "$DEV_USER:$(openssl rand -base64 12)" | chpasswd
    gpasswd -a "$DEV_USER" dbusers
    log_success "Developer user $DEV_USER created"
else
    log_warning "User $DEV_USER already exists"
fi

echo "[5/10] Creating system service user: $SERVICE_USER..."
if ! id "$SERVICE_USER" &>/dev/null; then
    useradd -r -s /usr/sbin/nologin -c "Web Service User" -d "/var/lib/$SERVICE_USER" "$SERVICE_USER"
    mkdir -p "/var/lib/$SERVICE_USER"
    chown "$SERVICE_USER:$SERVICE_USER" "/var/lib/$SERVICE_USER"
    chmod 755 "/var/lib/$SERVICE_USER"
    log_success "System service user $SERVICE_USER created"
else
    log_warning "User $SERVICE_USER already exists"
fi

echo "[6/10] Creating temporary user with expiration..."
if ! id tempuser &>/dev/null; then
    useradd -m -s /bin/bash -e 2024-12-31 -c "Temporary User" tempuser
    echo "tempuser:$(openssl rand -base64 12)" | chpasswd
    log_success "Temporary user created with expiration"
else
    log_warning "User tempuser already exists"
fi

echo "[7/10] Configuring password quality policies..."
if [ -f "$PAM_PWQUALITY_CONF" ]; then
    # Backup original config
    cp "$PAM_PWQUALITY_CONF" "$PAM_PWQUALITY_CONF.backup"
    
    # Configure password quality
    cat > "$PAM_PWQUALITY_CONF" << 'EOF'
# Minimum password length
minlen = 12
# Minimum number of character classes
minclass = 3
# Maximum number of repeated characters
maxrepeat = 2
# Maximum length of sequence
maxsequence = 3
# Require at least one digit
dcredit = -1
# Require at least one uppercase letter
ucredit = -1
# Require at least one lowercase letter
lcredit = -1
# Require at least one special character
ocredit = -1
# Enable dictionary check
dictcheck = 1
EOF
    chmod 644 "$PAM_PWQUALITY_CONF"
    log_success "Password quality policies configured"
else
    log_warning "Password quality config file not found at $PAM_PWQUALITY_CONF"
fi

echo "[8/10] Configuring password aging policies..."
chage -M 90 -m 7 -W 14 "$APP_USER" 2>/dev/null || true
chage -I 30 "$APP_USER" 2>/dev/null || true
chage -M 90 -m 7 -W 14 "$DEV_USER" 2>/dev/null || true
chage -I 30 "$DEV_USER" 2>/dev/null || true
log_success "Password aging policies configured"

echo "[9/10] Setting default user creation policies..."
# Backup original files
cp /etc/default/useradd /etc/default/useradd.backup 2>/dev/null || true
cp /etc/login.defs /etc/login.defs.backup 2>/dev/null || true

# Configure useradd defaults
cat > /etc/default/useradd << 'EOF'
GROUP=100
HOME=/home
INACTIVE=30
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes
EOF
chmod 644 /etc/default/useradd

# Configure login definitions
sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS 90/' /etc/login.defs
sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS 7/' /etc/login.defs
sed -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE 14/' /etc/login.defs
log_success "Default user creation policies configured"

echo "[10/10] Verifying configuration..."

# Verify users exist
for user in "$APP_USER" "$DEV_USER" "$SERVICE_USER" tempuser; do
    if id "$user" &>/dev/null; then
        log_success "User $user exists"
    else
        log_error "User $user not found"
    fi
done

# Verify groups exist
for group in developers webadmins dbusers; do
    if getent group "$group" &>/dev/null; then
        log_success "Group $group exists"
    else
        log_error "Group $group not found"
    fi
done

# Display group memberships
log_info "Group memberships:"
echo "  $APP_USER groups: $(groups $APP_USER 2>/dev/null || echo 'N/A')"
echo "  $DEV_USER groups: $(groups $DEV_USER 2>/dev/null || echo 'N/A')"

# Display password aging info
log_info "Password aging for $APP_USER:"
chage -l "$APP_USER" 2>/dev/null || log_warning "Cannot display aging info"

log_success "Linux user and group management configuration completed!"
log_info "Remember to:"
log_info "  - Set strong passwords for user accounts"
log_info "  - Review and adjust group memberships as needed"
log_info "  - Monitor account usage and disable unused accounts"
log_info "  - Regularly audit user permissions"

# Clean up trap on successful completion
trap - ERR