check_script=/var/scripts/root_expires
check_file_dir=/var/run
check_file1=${check_file_dir}/check_root_passwd_check_file1
check_file2=${check_file_dir}/check_root_passwd_check_file2.log
warndays=7
alertdays=-1

# force the check dir to exist with the right permissions
if [[ ! -d ${check_file_dir} ]]
then
    mkdir -p ${check_file_dir} > /dev/null 2> /dev/null
    chmod 755 ${check_file_dir} > /dev/null 2> /dev/null
    chown root:system ${check_file_dir} > /dev/null 2> /dev/null
fi

# make sure check_script exists
if [[ -x ${check_script} ]]
then
        # make sure the check file directory exists
        if [[ -d ${check_file_dir} ]]
        then
            # in theory, all pre-reqs in place let's go

            daystoexpire=$(${check_script}) # get the number of days to expire
            daysrc=$?                      # get the return code from the check_script command

            if [[ -f ${check_file1} ]]
            then
            #    echo "checkfile found"
                checkfileexists=yes
            else
            #    echo "checkfile NOT found"
                checkfileexists=no
            fi

            if [[ ${daysrc} -ne 0 ]]
            then
                echo "${check_script} returned non-zero return code, abort!" >&2
                exit 1
            fi

            if [[ "${daystoexpire}" = "" ]]
            then
                # nothing to do, password will not expire but remove a check file if it exists
                echo "password does not expire"
                if [[ ${checkfileexists} = "yes" ]]
                then
                    rm -f ${check_file1} > /dev/null 2> /dev/null
                        >${check_file2}  
                fi
            elif [[ ${daystoexpire} -le ${alertdays} ]]
            then
                echo "account expired"
                # if we have no checkfile, create one, generate full alert
                # if we have a checkfile, check the status, if it was warning, generate full alert and update checkfile
                # otherwise do nothing

                if [[ ${checkfileexists} = "no" ]]
                then
                    echo "updating checkfile with alert"
                    echo "alert" > ${check_file1}
                    echo "$(date +"%a %b %d %r %Z %Y") CRITICAL ALERT $(hostname) root password has expired - it required changing immediately."  > ${check_file2}
                else
                    alerttype=$(cat ${check_file1} 2>/dev/null)
                    if [[ $? -eq 0 ]]
                    then
                        if [[ ${alerttype} = "warning" ]]
                        then
                            echo "updating checkfile with alert"
                            echo "alert" > ${check_file1}
                    echo "$(date +"%a %b %d %r %Z %Y") CRITICAL ALERT $(hostname) root password has expired - it required changing immediately."  > ${check_file2}
                
                        fi
                    else
                        echo "could not read status from ${check_file1}, abort!" >&2
                        exit 1
                    fi
                fi
            elif [[ ${daystoexpire} -le ${warndays} ]]
            then
                echo "account below warning period"
                # if we have no checkfile, create one and generate a warning
                # if we have a checkfile, do nothing (this may cause an issue, if the checkfile is an alert type
                # then we may have missed out some runs and may not generate e-mail but it's safer than sending too
                # many alerts)

                if [[ ${checkfileexists} = "no" ]]
                then
                    echo "updating checkfile with warning"
                    echo "warning" > ${check_file1}
                echo "$(date +"%a %b %d %r %Z %Y") WARNING ALERT $(hostname) root password expires in ${daystoexpire} day(s) (0 means today).  Please change the root password immediately "  > ${check_file2}
                  
                fi
            else
                echo "account ok"
                # if the checkfile exists, remove it, otherwise do nothing
                if [[ ${checkfileexists} = "yes" ]]
                then
                    rm -f ${check_file1} > /dev/null 2> /dev/null
                    >${check_file2}
                fi
            fi
        else
            echo "${check_file_dir} not found, abort!" >&2
            exit 1
        fi
else
    echo "${check_script} not found, abort!" >&2
    exit 1
fi