Add script for seting up media center

bin/admin/single-user

@@ -0,0 +1,65 @@
+#!/bin/bash
+## This script make autologin. If user has phisical access
+## to the device we can trust him, otherwiese we require password
+## for remote access
+
+
+# Parameters
+USERNAME="user"
+
+# Sanity check
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Please run this script as root."
+    exit 1
+fi
+
+if ! id "$USERNAME" &>/dev/null; then
+    echo "User '$USERNAME' does not exist."
+    exit 1
+fi
+
+echo "Setting up passwordless sudo for physical access for user: $USERNAME"
+echo
+
+# 1. Configure sudoers: allow passwordless sudo
+echo "Configuring sudoers for $USERNAME..."
+echo "Defaults:$USERNAME !authenticate" >> /etc/sudoers.d/00-$USERNAME-nopasswd
+chmod 440 /etc/sudoers.d/00-$USERNAME-nopasswd
+
+# 2. Modify PAM for sudo to allow password only on non-physical ttys
+echo "Configuring PAM for sudo tty check..."
+PAM_FILE="/etc/pam.d/sudo"
+BACKUP_FILE="/etc/pam.d/sudo.bak"
+
+if ! grep -q "pam_succeed_if.so tty" "$PAM_FILE"; then
+    echo "Creating backup of $PAM_FILE to $BACKUP_FILE"
+    cp "$PAM_FILE" "$BACKUP_FILE"
+
+    sed -i '1iauth [success=1 default=ignore] pam_succeed_if.so tty =~ /dev/tty[0-9]*' "$PAM_FILE"
+    echo "PAM modified to restrict passwordless sudo to physical TTYs."
+else
+    echo "PAM sudo already appears configured."
+fi
+
+# 3. Enable autologin on tty1
+echo "Configuring systemd autologin on tty1 for $USERNAME..."
+mkdir -p /etc/systemd/system/getty@tty1.service.d
+AUTOLOGIN_CONF="/etc/systemd/system/getty@tty1.service.d/override.conf"
+
+cat > "$AUTOLOGIN_CONF" <<EOF
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty --autologin $USERNAME --noclear %I \$TERM
+EOF
+
+# Reload systemd and apply change
+echo "Reloading systemd and restarting tty1..."
+systemctl daemon-reexec
+systemctl daemon-reload
+systemctl restart getty@tty1
+
+echo
+echo "All done."
+echo "User '$USERNAME' will now auto-login on tty1 and can use sudo without a password if physically present."
+echo "Remote users (SSH) will still need to enter a password for sudo."
+