#!/usr/bin/env bash
# Audit konfigurasi dasar (hanya-baca): izin berkas sensitif, SSH root login, firewall aktif.
set -u
warn=0
check() { printf '%-55s %s\n' "$1" "$2"; [[ "$2" == OK* ]] || warn=1; }
perm() { [[ -e "$1" ]] && stat -c '%a' "$1" || echo "-"; }
p=$(perm /etc/shadow); [[ "$p" == "-" || "$p" =~ ^(0|40|400|600|640)$ ]] && check "/etc/shadow izin ($p)" "OK" || check "/etc/shadow izin ($p)" "PERIKSA: terlalu longgar"
if [[ -r /etc/ssh/sshd_config ]]; then
  grep -Eiq '^\s*PermitRootLogin\s+(no|prohibit-password)' /etc/ssh/sshd_config && check "SSH PermitRootLogin" "OK" || check "SSH PermitRootLogin" "PERIKSA: root login mungkin diizinkan"
fi
if command -v ufw >/dev/null 2>&1; then ufw status 2>/dev/null | grep -q "Status: active" && check "Firewall ufw" "OK" || check "Firewall ufw" "PERIKSA: tidak aktif"; fi
exit $warn