#!/usr/bin/env bash
# Real demos for P033 "SSH Keys vs Passwords: Which Is Safer for Security?" (Cybersecurity for Beginners, episode 5).
# Three Ubuntu 24.04 LXD system containers on render01's private lxdbr0 network, deleted at the end:
#   shop      Ana's shop server: OpenSSH server, systemd, journald. Launched like a cloud server whose image
#             allows password logins (cloud-init `ssh_pwauth: true` writes sshd_config.d/50-cloud-init.conf).
#             Accounts: ana (admin) and test (a forgotten test account with a weak password).
#   laptop    Ana's laptop: the OpenSSH client.
#   thief-pc  a stranger's machine that tries common user/password pairs, as bots do (lab/guess.sh + sshpass).
# Every terminal is a real interactive login shell in a pty (demo_driver.py); passwords and passphrases are typed
# at the real prompts and never shown. Nothing outside these three containers is touched.
#
# Needs: the LXD snap on render01 (sudo snap install lxd && sudo lxd init --auto), internet for the Ubuntu archive.
set -euo pipefail
cd "$(dirname "$0")"
P=ce-p033
cleanup() { for b in shop laptop thief; do lxc delete -f $P-$b >/dev/null 2>&1 || true; done; }
cleanup
[ -n "${KEEP:-}" ] || trap cleanup EXIT

ud() { printf '#cloud-config\nhostname: %s\n%s' "$1" "${2:-}"; }
lxc launch -q ubuntu:24.04 $P-shop -c user.user-data="$(ud shop 'ssh_pwauth: true
')"
lxc launch -q ubuntu:24.04 $P-laptop -c user.user-data="$(ud laptop)"
lxc launch -q ubuntu:24.04 $P-thief -c user.user-data="$(ud thief-pc)"
for b in shop laptop thief; do lxc exec $P-$b -- cloud-init status --wait >/dev/null; done
lxc file push -q lab/guess.sh $P-thief/usr/local/bin/guess --mode 0755
lxc file push -q lab/common-logins.txt $P-thief/root/common-logins.txt
python3 - "$P" <demo_driver.py