#!/bin/bash

## =============================
## Check vulnerabilities
##
#echo "polkit vulnerability"
#ls -l /usr/bin/pkexec
#
#echo "NFS share vulnerability"
#exportfs -v
#
##echo "Unsecured Redis vulnerability"
##tsinode on
##redis-cli auth ROSSTSI4000

# =============================
# Get Files from the server
#
tsi_app_debian="tsi-app-1.12.176.deb"
redis_secure_debian="tsi-redis-6.2.5.deb"
tsi_upgrade="tsi-upgrade-2.4.deb"
tsi_run="tsi-run-2.0.deb"

installServer=/media/installServer
mountpoint -q $installServer || umount $installServer
mkdir -p $installServer

# =============================
# Get credentials
#
echo Please enter username
read username
echo Please enter password
read -s pass	
sudo mount -t cifs -o username=$username,password=$pass,uid=1000,gid=1000,vers=2.0 //10.162.0.12/usr /media/installServer

# =============================
echo "* * * * * * * * * * * * * * * * * * * * * "
echo "* Installing TSI Infrastrure Upgrade"
echo "* * * * * * * * * * * * * * * * * * * * * "
cp $installServer/Transfer/TSI-4000/Executable_file/$tsi_upgrade /opt/app/
cd /opt/app
dpkg -i $tsi_upgrade 2> /dev/null

# =============================
echo "* * * * * * * * * * * * * * * * * * * * * "
echo "* Installing Latest Node.js"
echo "* * * * * * * * * * * * * * * * * * * * * "
cp $installServer/Transfer/TSI-4000/Executable_file/$tsi_app_debian /opt/app/
cd /opt/app
dpkg -i $tsi_app_debian 2> /dev/null

# =============================
# This will address the unsecured Redis server vulnerability
# Redis now requires Tally Console to use a password to access Redis
#
echo "* * * * * * * * * * * * * * * * * * * * * "
echo "* Installing Secure Redis"
echo "* * * * * * * * * * * * * * * * * * * * * "
cp $installServer/Transfer/from_gerry/Production/TSI-4000/$redis_secure_debian /opt/app/
cd /opt/app
dpkg -i $redis_secure_debian 2> /dev/null
#tsinode off

#
# Updates .profile to address the NFS Exported Share Information Disclosure
# TSI will need to be rebooted for this patch to take effect
#
echo "* * * * * * * * * * * * * * * * * * * * * "
echo "* Installing TSI-Run Update"
echo "* * * * * * * * * * * * * * * * * * * * * "
cp $installServer/Transfer/TSI-4000/Executable_file/$tsi_run /opt/app/
cd /opt/app
dpkg -i $tsi_run 2> /dev/null

# =============================
# This will address the NFS Exported Share Information Disclosure
# TSI will need to be rebooted for this patch to take effect
#
# cp $installServer/Transfer/TSI-4000/Executable_file/.profile /root/

# =============================
# temp workaround for the POLKIT vulnerability
#
echo "* * * * * * * * * * * * * * * * * * * * * * * * "
echo "* Installing POLKIT vulnerability work-around"
chmod 0755 /usr/bin/pkexec

echo "* Testing patches..."
echo "* * * * * * * * * * * * * * * * * * * * * * * * "
/opt/tsicheck.sh
