#!/usr/bin/env bash
set -euo pipefail

LOGIN_USER="${1:-user}"
[ "$(id -u)" -eq 0 ] || {
  printf 'ERROR: run after sudo -i so sshd effective policy can be evaluated\n' >&2
  exit 1
}

USER_EFFECTIVE="$(sshd -T -C "user=${LOGIN_USER},host=$(hostname),addr=127.0.0.1")"
ROOT_EFFECTIVE="$(sshd -T -C "user=root,host=$(hostname),addr=127.0.0.1")"

getent passwd "$LOGIN_USER" >/dev/null
id -nG "$LOGIN_USER" | tr ' ' '\n' | grep -qx sudo
grep -qx 'passwordauthentication yes' <<<"$USER_EFFECTIVE"
grep -Eq '^permitrootlogin (no|prohibit-password|without-password)$' <<<"$ROOT_EFFECTIVE"
sudo -l -U "$LOGIN_USER" | grep -Eq '\(ALL([[:space:]]*:[[:space:]]*ALL)?\)[[:space:]]+ALL'

printf 'PASS\tlogin_user=%s\n' "$LOGIN_USER"
printf 'PASS\tuser_password_authentication=yes\n'
printf 'PASS\troot_password_authentication=disabled\n'
printf 'PASS\tsudo_i_path=available_with_user_password\n'
printf 'NOTE\tthis script does not modify SSH and does not prove a second remote session\n'