##
# Cookbook:: irrigate-orchard_base
# Recipe:: password_suite
#
# Copyright: The Orchard
#

# Either load user hash from passwd ohai plugin or create it ourselves
if node.attribute?('etc')
  all_users = node['etc']['passwd']
else
  all_users = {}
  passwd_file = File.read('/etc/passwd')
  passwd_file.each_line do |line|
    user_array = line.split(':')
    all_users[user_array[0]] = {
      'uid' => user_array[2],
    }
  end
end

usermod_cmd = value_for_platform_family(
  'debian'  => '/usr/sbin/usermod',
  'default' => 'usermod'
)

all_users.each do |user, data|
  next unless data['uid'].to_i < 1000 && data['uid'].to_i > 0
  execute 'nologin' do
    command "#{usermod_cmd} -s /sbin/nologin #{user}"
  end
end

replace_or_add 'umask_bashrc' do
  path '/etc/bashrc'
  pattern 'umask [0-9][0-9][0-9]*'
  line "umask #{node['os-hardening']['env']['umask']}"
end

replace_or_add 'umask_profile' do
  path '/etc/profile'
  pattern 'umask [0-9][0-9][0-9]*'
  line "umask #{node['os-hardening']['env']['umask']}"
end