kitsune-kit 0.4.1 → 0.6.0

data/lib/kitsune/kit/scripts/firewall.sh

@@ -0,0 +1,210 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+action="${1:?action is required}"
+ssh_port="${2:?SSH port is required}"
+shift 2
+allowed_cidrs=("$@")
+backup_dir="/var/lib/kitsune/backups/firewall"
+added_file="${backup_dir}/rules-added"
+pending_file="${backup_dir}/rules-pending"
+apt_options=(-o DPkg::Lock::Timeout=120 -o Acquire::Retries=3)
+
+apt_get() {
+  DEBIAN_FRONTEND=noninteractive apt-get "${apt_options[@]}" "$@"
+}
+
+validate() {
+  [[ "${ssh_port}" =~ ^[0-9]+$ ]] && (( ssh_port >= 1 && ssh_port <= 65535 ))
+  for cidr in "${allowed_cidrs[@]}"; do
+    [[ "${cidr}" =~ ^[0-9a-fA-F:.]+/[0-9]{1,3}$ ]] || {
+      echo "invalid CIDR: ${cidr}" >&2
+      exit 2
+    }
+  done
+}
+
+global_rule_exists() {
+  local port="$1"
+  ufw status | grep -Eq "^${port}/tcp[[:space:]]+ALLOW"
+}
+
+owned_global_rule_exists() {
+  local port="$1"
+  local comment="$2"
+  ufw status | grep -E "^${port}/tcp[[:space:]]+ALLOW" | grep -Fq "# ${comment}"
+}
+
+cidr_rule_exists() {
+  local port="$1"
+  local cidr="$2"
+  ufw status | grep -F "${port}/tcp" | grep -Fq "${cidr}"
+}
+
+owned_cidr_rule_exists() {
+  local port="$1"
+  local cidr="$2"
+  local comment="$3"
+  ufw status | grep -F "${port}/tcp" | grep -F "${cidr}" | grep -Fq "# ${comment}"
+}
+
+ensure_global_rule() {
+  local port="$1"
+  local comment="$2"
+  local next_file="$3"
+  local ownership="global|${port}"
+  if grep -Fxq "${ownership}" "${added_file}"; then
+    owned_global_rule_exists "${port}" "${comment}" || ufw allow "${port}/tcp" comment "${comment}"
+    printf '%s\n' "${ownership}" >> "${next_file}"
+  elif ! global_rule_exists "${port}"; then
+    ufw allow "${port}/tcp" comment "${comment}"
+    printf '%s\n' "${ownership}" >> "${next_file}"
+  fi
+}
+
+ensure_cidr_rule() {
+  local port="$1"
+  local cidr="$2"
+  local comment="$3"
+  local next_file="$4"
+  local ownership="cidr|${port}|${cidr}"
+  if grep -Fxq "${ownership}" "${added_file}"; then
+    owned_cidr_rule_exists "${port}" "${cidr}" "${comment}" || \
+      ufw allow from "${cidr}" to any port "${port}" proto tcp comment "${comment}"
+    printf '%s\n' "${ownership}" >> "${next_file}"
+  elif ! cidr_rule_exists "${port}" "${cidr}"; then
+    ufw allow from "${cidr}" to any port "${port}" proto tcp comment "${comment}"
+    printf '%s\n' "${ownership}" >> "${next_file}"
+  fi
+}
+
+delete_rule() {
+  local kind="$1"
+  local port="$2"
+  local cidr="${3:-}"
+  local comment="kitsune:ssh"
+  if [[ "${kind}" == "global" ]]; then
+    [[ "${port}" == "80" ]] && comment="kitsune:http"
+    [[ "${port}" == "443" ]] && comment="kitsune:https"
+    ufw --force delete allow "${port}/tcp" comment "${comment}" || true
+  else
+    ufw --force delete allow from "${cidr}" to any port "${port}" proto tcp comment "${comment}" || true
+  fi
+}
+
+remove_stale_owned_rules() {
+  local next_file="$1"
+  local kind port cidr ownership
+  while IFS='|' read -r kind port cidr; do
+    [[ -z "${kind}" ]] && continue
+    ownership="${kind}|${port}"
+    [[ -n "${cidr}" ]] && ownership+="|${cidr}"
+    grep -Fxq "${ownership}" "${next_file}" || delete_rule "${kind}" "${port}" "${cidr}"
+  done < "${added_file}"
+}
+
+cleanup_new_rules() {
+  [[ -n "${next_file:-}" && -f "${next_file}" ]] || return
+  local kind port cidr ownership
+  while IFS='|' read -r kind port cidr; do
+    [[ -z "${kind}" ]] && continue
+    ownership="${kind}|${port}"
+    [[ -n "${cidr}" ]] && ownership+="|${cidr}"
+    grep -Fxq "${ownership}" "${added_file}" || delete_rule "${kind}" "${port}" "${cidr}"
+  done < "${next_file}"
+  rm -f "${next_file}"
+}
+
+apply() {
+  validate
+  install -d -m 0700 "${backup_dir}"
+  touch "${added_file}"
+  if [[ -f "${pending_file}" ]]; then
+    merged_file="$(mktemp "${backup_dir}/rules-owned.XXXXXX")"
+    sort -u "${added_file}" "${pending_file}" > "${merged_file}"
+    mv "${merged_file}" "${added_file}"
+    rm -f "${pending_file}"
+  fi
+  if [[ ! -f "${backup_dir}/snapshot-complete" ]]; then
+    if ufw status | grep -Fq "Status: active"; then
+      touch "${backup_dir}/active-before"
+    fi
+    touch "${backup_dir}/snapshot-complete"
+  fi
+  if ! dpkg-query -W -f='${Status}' ufw 2>/dev/null | grep -q "ok installed"; then
+    apt_get update
+    apt_get install --yes ufw
+    touch "${backup_dir}/package-created"
+  fi
+
+  next_file="$(mktemp "${backup_dir}/rules-next.XXXXXX")"
+  trap cleanup_new_rules ERR INT TERM
+  if (( ${#allowed_cidrs[@]} == 0 )); then
+    ensure_global_rule "${ssh_port}" "kitsune:ssh" "${next_file}"
+  else
+    for cidr in "${allowed_cidrs[@]}"; do
+      ensure_cidr_rule "${ssh_port}" "${cidr}" "kitsune:ssh" "${next_file}"
+    done
+  fi
+  ensure_global_rule 80 "kitsune:http" "${next_file}"
+  ensure_global_rule 443 "kitsune:https" "${next_file}"
+  # Keep stale access until Kitsune Kit verifies a fresh SSH connection through
+  # the desired rules. The separate finalize action removes it afterward.
+  mv "${next_file}" "${pending_file}"
+  trap - ERR INT TERM
+  ufw --force enable
+}
+
+verify() {
+  validate
+  ufw status | grep -Fq "Status: active"
+  ufw status | grep -Eq '^80/tcp[[:space:]]+ALLOW'
+  ufw status | grep -Eq '^443/tcp[[:space:]]+ALLOW'
+  if (( ${#allowed_cidrs[@]} == 0 )); then
+    global_rule_exists "${ssh_port}"
+  else
+    for cidr in "${allowed_cidrs[@]}"; do
+      cidr_rule_exists "${ssh_port}" "${cidr}"
+    done
+  fi
+}
+
+finalize() {
+  validate
+  [[ -f "${pending_file}" ]] || {
+    echo "no pending firewall rule set to finalize" >&2
+    exit 4
+  }
+  remove_stale_owned_rules "${pending_file}"
+  mv "${pending_file}" "${added_file}"
+}
+
+verify_final() {
+  verify
+  [[ ! -f "${pending_file}" ]]
+}
+
+rollback() {
+  if [[ -f "${added_file}" || -f "${pending_file}" ]]; then
+    while IFS='|' read -r kind port cidr; do
+      [[ -z "${kind}" ]] && continue
+      delete_rule "${kind}" "${port}" "${cidr}"
+    done < <(cat "${added_file}" "${pending_file}" 2>/dev/null | sort -u)
+  fi
+  if [[ ! -f "${backup_dir}/active-before" ]]; then
+    ufw --force disable || true
+  fi
+  if [[ -f "${backup_dir}/package-created" ]]; then
+    apt_get remove --yes ufw || true
+  fi
+  rm -rf "${backup_dir}"
+}
+
+case "${action}" in
+  apply) apply ;;
+  verify) verify ;;
+  finalize) finalize ;;
+  verify_final) verify_final ;;
+  rollback) rollback ;;
+  *) echo "unknown action: ${action}" >&2; exit 2 ;;
+esac

data/lib/kitsune/kit/scripts/metrics.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+action="${1:?action is required}"
+expected_sha256="${2:?installer SHA-256 is required}"
+backup_dir="/var/lib/kitsune/backups/metrics"
+apt_options=(-o DPkg::Lock::Timeout=120 -o Acquire::Retries=3)
+
+apt_get() {
+  DEBIAN_FRONTEND=noninteractive apt-get "${apt_options[@]}" "$@"
+}
+
+validate() {
+  [[ "${expected_sha256}" =~ ^[a-f0-9]{64}$ ]] || {
+    echo "invalid installer SHA-256" >&2
+    exit 2
+  }
+}
+
+apply() {
+  validate
+  install -d -m 0700 "${backup_dir}"
+  if dpkg-query -W -f='${Status}' do-agent 2>/dev/null | grep -q "ok installed"; then
+    touch "${backup_dir}/package-existed"
+    return
+  fi
+  installer="$(mktemp)"
+  trap 'rm -f "${installer}"' EXIT
+  curl --fail --silent --show-error --location \
+    https://repos.insights.digitalocean.com/install.sh --output "${installer}"
+  test -s "${installer}"
+  printf '%s  %s\n' "${expected_sha256}" "${installer}" | sha256sum --check --status
+  bash -n "${installer}"
+  bash "${installer}"
+  rm -f "${installer}"
+  trap - EXIT
+  touch "${backup_dir}/package-created"
+}
+
+verify() {
+  validate
+  dpkg-query -W -f='${Status}' do-agent 2>/dev/null | grep -q "ok installed"
+  systemctl is-active --quiet do-agent
+}
+
+rollback() {
+  if [[ -f "${backup_dir}/package-created" ]]; then
+    systemctl disable --now do-agent || true
+    apt_get remove --purge --yes do-agent || true
+  fi
+  rm -rf "${backup_dir}"
+}
+
+case "${action}" in
+  apply) apply ;;
+  verify) verify ;;
+  rollback) rollback ;;
+  *) echo "unknown action: ${action}" >&2; exit 2 ;;
+esac

data/lib/kitsune/kit/scripts/ssh.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+action="${1:?action is required}"
+user="${2:?user is required}"
+config_file="/etc/ssh/sshd_config.d/90-kitsune.conf"
+backup_dir="/var/lib/kitsune/backups/ssh"
+backup_file="${backup_dir}/90-kitsune.conf.before"
+
+validate_user() {
+  [[ "${user}" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || {
+    echo "invalid user name" >&2
+    exit 2
+  }
+}
+
+reload_ssh() {
+  sshd -t
+  systemctl reload ssh 2>/dev/null || systemctl reload sshd
+}
+
+write_policy() {
+  local root_policy="$1"
+  local temporary
+  temporary="$(mktemp)"
+  trap 'rm -f "${temporary}"' EXIT
+  cat > "${temporary}" <<EOF
+# Managed by Kitsune Kit. Local changes will be replaced.
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin ${root_policy}
+AllowUsers ${user}
+EOF
+  install -o root -g root -m 0644 "${temporary}" "${config_file}"
+  rm -f "${temporary}"
+  trap - EXIT
+  reload_ssh
+}
+
+apply() {
+  validate_user
+  install -d -m 0700 "${backup_dir}"
+  if [[ ! -f "${backup_dir}/snapshot-complete" ]]; then
+    if [[ -f "${config_file}" ]]; then
+      cp --preserve=mode,ownership "${config_file}" "${backup_file}"
+    else
+      touch "${backup_dir}/absent-before"
+    fi
+    touch "${backup_dir}/snapshot-complete"
+  fi
+
+  # Keep key-based root recovery until Kitsune Kit verifies a fresh deploy login.
+  write_policy "prohibit-password"
+}
+
+verify() {
+  validate_user
+  sshd -t
+  grep -Fxq "PasswordAuthentication no" "${config_file}"
+  grep -Fxq "PermitRootLogin prohibit-password" "${config_file}"
+  grep -Fxq "AllowUsers ${user}" "${config_file}"
+}
+
+finalize() {
+  validate_user
+  write_policy "no"
+}
+
+verify_final() {
+  validate_user
+  sshd -t
+  grep -Fxq "PasswordAuthentication no" "${config_file}"
+  grep -Fxq "PermitRootLogin no" "${config_file}"
+  grep -Fxq "AllowUsers ${user}" "${config_file}"
+}
+
+rollback() {
+  if [[ -f "${backup_file}" ]]; then
+    cp --preserve=mode,ownership "${backup_file}" "${config_file}"
+  elif [[ -f "${backup_dir}/absent-before" ]]; then
+    rm -f "${config_file}"
+  fi
+  reload_ssh
+  rm -rf "${backup_dir}"
+}
+
+case "${action}" in
+  apply) apply ;;
+  verify) verify ;;
+  finalize) finalize ;;
+  verify_final) verify_final ;;
+  rollback) rollback ;;
+  *) echo "unknown action: ${action}" >&2; exit 2 ;;
+esac

data/lib/kitsune/kit/scripts/swap.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+action="${1:?action is required}"
+size_gb="${2:?size is required}"
+swappiness="${3:?swappiness is required}"
+swap_file="/swapfile"
+sysctl_file="/etc/sysctl.d/90-kitsune-swap.conf"
+backup_dir="/var/lib/kitsune/backups/swap"
+sysctl_backup="${backup_dir}/90-kitsune-swap.conf.before"
+
+validate() {
+  [[ "${size_gb}" =~ ^[0-9]+$ ]] && (( size_gb >= 0 && size_gb <= 64 ))
+  [[ "${swappiness}" =~ ^[0-9]+$ ]] && (( swappiness >= 0 && swappiness <= 100 ))
+}
+
+apply() {
+  validate
+  install -d -m 0700 "${backup_dir}"
+  if [[ ! -f "${backup_dir}/sysctl-snapshot" ]]; then
+    if [[ -f "${sysctl_file}" ]]; then
+      cp --preserve=mode,ownership "${sysctl_file}" "${sysctl_backup}"
+    else
+      touch "${backup_dir}/sysctl-absent"
+    fi
+    touch "${backup_dir}/sysctl-snapshot"
+  fi
+  active=false
+  swapon --show=NAME --noheadings | grep -Fxq "${swap_file}" && active=true
+  if (( size_gb == 0 )) && [[ -f "${backup_dir}/swap-created" ]]; then
+    [[ "${active}" == true ]] && swapoff "${swap_file}"
+    rm -f "${swap_file}"
+    sed -i '\|/swapfile none swap sw 0 0|d' /etc/fstab
+    rm -f "${backup_dir}/current-size"
+  elif [[ "${active}" == true ]] && [[ ! -f "${backup_dir}/swap-created" ]]; then
+    touch "${backup_dir}/swap-existed"
+  elif (( size_gb > 0 )) && [[ -e "${swap_file}" && ! -f "${backup_dir}/swap-created" ]]; then
+    echo "refusing to overwrite unmanaged ${swap_file}" >&2
+    exit 3
+  elif (( size_gb > 0 )) && { [[ "${active}" == false ]] || \
+       [[ "$(cat "${backup_dir}/current-size" 2>/dev/null || true)" != "${size_gb}" ]]; }; then
+    [[ "${active}" == true ]] && swapoff "${swap_file}"
+    fallocate -l "${size_gb}G" "${swap_file}"
+    touch "${backup_dir}/swap-created"
+    chmod 0600 "${swap_file}"
+    mkswap "${swap_file}"
+    swapon "${swap_file}"
+    grep -Fq "${swap_file} none swap sw 0 0" /etc/fstab || printf '%s none swap sw 0 0\n' "${swap_file}" >> /etc/fstab
+    printf '%s\n' "${size_gb}" > "${backup_dir}/current-size"
+  fi
+  printf 'vm.swappiness=%s\n' "${swappiness}" > "${sysctl_file}"
+  sysctl --load "${sysctl_file}"
+}
+
+verify() {
+  validate
+  if (( size_gb > 0 )); then
+    swapon --show=NAME --noheadings | grep -Fxq "${swap_file}"
+    if [[ -f "${backup_dir}/swap-created" ]]; then
+      test "$(stat -c '%s' "${swap_file}")" -ge "$((size_gb * 1024 * 1024 * 1024))"
+    fi
+  fi
+  test "$(sysctl -n vm.swappiness)" = "${swappiness}"
+}
+
+rollback() {
+  if [[ -f "${backup_dir}/swap-created" ]]; then
+    swapoff "${swap_file}" || true
+    rm -f "${swap_file}"
+    sed -i '\|/swapfile none swap sw 0 0|d' /etc/fstab
+  fi
+  if [[ -f "${sysctl_backup}" ]]; then
+    cp --preserve=mode,ownership "${sysctl_backup}" "${sysctl_file}"
+  elif [[ -f "${backup_dir}/sysctl-absent" ]]; then
+    rm -f "${sysctl_file}"
+  fi
+  sysctl --system >/dev/null
+  rm -rf "${backup_dir}"
+}
+
+case "${action}" in
+  apply) apply ;;
+  verify) verify ;;
+  rollback) rollback ;;
+  *) echo "unknown action: ${action}" >&2; exit 2 ;;
+esac

data/lib/kitsune/kit/scripts/unattended.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+action="${1:?action is required}"
+config_file="/etc/apt/apt.conf.d/20auto-upgrades"
+backup_dir="/var/lib/kitsune/backups/unattended"
+backup_file="${backup_dir}/20auto-upgrades.before"
+packages=(unattended-upgrades apt-listchanges)
+apt_options=(-o DPkg::Lock::Timeout=120 -o Acquire::Retries=3)
+
+apt_get() {
+  DEBIAN_FRONTEND=noninteractive apt-get "${apt_options[@]}" "$@"
+}
+
+snapshot() {
+  [[ -f "${backup_dir}/snapshot-complete" ]] && return
+  : > "${backup_dir}/packages-before"
+  for package in "${packages[@]}"; do
+    if dpkg-query -W -f='${Status}' "${package}" 2>/dev/null | grep -q "ok installed"; then
+      printf '%s\n' "${package}" >> "${backup_dir}/packages-before"
+    fi
+  done
+  systemctl is-enabled --quiet unattended-upgrades.service && touch "${backup_dir}/enabled-before"
+  systemctl is-active --quiet unattended-upgrades.service && touch "${backup_dir}/active-before"
+  if [[ -f "${config_file}" ]]; then
+    cp --preserve=mode,ownership "${config_file}" "${backup_file}"
+  else
+    touch "${backup_dir}/config-absent"
+  fi
+  touch "${backup_dir}/snapshot-complete"
+}
+
+apply() {
+  install -d -m 0700 "${backup_dir}"
+  snapshot
+  apt_get update
+  apt_get install --yes "${packages[@]}"
+  cat > "${config_file}" <<'EOF'
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+EOF
+  systemctl enable --now unattended-upgrades.service
+}
+
+verify() {
+  test -f "${config_file}"
+  systemctl is-enabled --quiet unattended-upgrades.service
+  systemctl is-active --quiet unattended-upgrades.service
+}
+
+restore_service_state() {
+  if [[ -f "${backup_dir}/enabled-before" ]]; then
+    systemctl enable unattended-upgrades.service || true
+  else
+    systemctl disable unattended-upgrades.service || true
+  fi
+  if [[ -f "${backup_dir}/active-before" ]]; then
+    systemctl start unattended-upgrades.service || true
+  else
+    systemctl stop unattended-upgrades.service || true
+  fi
+}
+
+rollback() {
+  if [[ -f "${backup_file}" ]]; then
+    cp --preserve=mode,ownership "${backup_file}" "${config_file}"
+  elif [[ -f "${backup_dir}/config-absent" ]]; then
+    rm -f "${config_file}"
+  fi
+  restore_service_state
+  for package in "${packages[@]}"; do
+    if ! grep -Fxq "${package}" "${backup_dir}/packages-before" 2>/dev/null; then
+      apt_get remove --yes "${package}" || true
+    fi
+  done
+  rm -rf "${backup_dir}"
+}
+
+case "${action}" in
+  apply) apply ;;
+  verify) verify ;;
+  rollback) rollback ;;
+  *) echo "unknown action: ${action}" >&2; exit 2 ;;
+esac

data/lib/kitsune/kit/scripts/user.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+action="${1:?action is required}"
+user="${2:?user is required}"
+backup_dir="/var/lib/kitsune/backups/user-${user}"
+sudoers_file="/etc/sudoers.d/${user}"
+ssh_dir="/home/${user}/.ssh"
+authorized_keys="${ssh_dir}/authorized_keys"
+
+validate_user() {
+  [[ "${user}" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || {
+    echo "invalid user name" >&2
+    exit 2
+  }
+}
+
+snapshot_existing_user() {
+  touch "${backup_dir}/existed-before"
+  id -nG "${user}" | tr ' ' '\n' | grep -Fxq sudo && touch "${backup_dir}/sudo-before"
+  if [[ -f "${sudoers_file}" ]]; then
+    cp --preserve=mode,ownership "${sudoers_file}" "${backup_dir}/sudoers.before"
+  else
+    touch "${backup_dir}/sudoers-absent"
+  fi
+  if [[ -d "${ssh_dir}" ]]; then
+    touch "${backup_dir}/ssh-dir-before"
+    stat -c '%a' "${ssh_dir}" > "${backup_dir}/ssh-dir-mode"
+  fi
+  if [[ -f "${authorized_keys}" ]]; then
+    cp --preserve=mode,ownership "${authorized_keys}" "${backup_dir}/authorized_keys.before"
+  else
+    touch "${backup_dir}/authorized-keys-absent"
+  fi
+}
+
+apply() {
+  validate_user
+  if [[ ! -s /root/.ssh/authorized_keys ]]; then
+    echo "root authorized_keys is missing or empty" >&2
+    exit 1
+  fi
+  install -d -m 0700 "${backup_dir}"
+  if [[ ! -f "${backup_dir}/snapshot-complete" ]]; then
+    if id "${user}" >/dev/null 2>&1; then
+      snapshot_existing_user
+    else
+      useradd --create-home --shell /bin/bash "${user}"
+      touch "${backup_dir}/created"
+    fi
+    touch "${backup_dir}/snapshot-complete"
+  fi
+
+  usermod -aG sudo "${user}"
+  temporary="$(mktemp)"
+  trap 'rm -f "${temporary}"' EXIT
+  printf '%s ALL=(ALL) NOPASSWD:ALL\n' "${user}" > "${temporary}"
+  chmod 0440 "${temporary}"
+  visudo -cf "${temporary}" >/dev/null
+  install -o root -g root -m 0440 "${temporary}" "${sudoers_file}"
+  rm -f "${temporary}"
+  trap - EXIT
+
+  install -d -o "${user}" -g "${user}" -m 0700 "${ssh_dir}"
+  install -o "${user}" -g "${user}" -m 0600 /root/.ssh/authorized_keys "${authorized_keys}"
+}
+
+verify() {
+  validate_user
+  id "${user}" >/dev/null
+  test -s "${authorized_keys}"
+  test "$(stat -c '%a' "${ssh_dir}")" = "700"
+  test "$(stat -c '%a' "${authorized_keys}")" = "600"
+  visudo -cf "${sudoers_file}" >/dev/null
+}
+
+restore_existing_user() {
+  if [[ ! -f "${backup_dir}/sudo-before" ]]; then
+    gpasswd -d "${user}" sudo || true
+  fi
+  if [[ -f "${backup_dir}/sudoers.before" ]]; then
+    cp --preserve=mode,ownership "${backup_dir}/sudoers.before" "${sudoers_file}"
+  elif [[ -f "${backup_dir}/sudoers-absent" ]]; then
+    rm -f "${sudoers_file}"
+  fi
+  if [[ -f "${backup_dir}/authorized_keys.before" ]]; then
+    cp --preserve=mode,ownership "${backup_dir}/authorized_keys.before" "${authorized_keys}"
+  elif [[ -f "${backup_dir}/authorized-keys-absent" ]]; then
+    rm -f "${authorized_keys}"
+  fi
+  if [[ -f "${backup_dir}/ssh-dir-before" ]]; then
+    chmod "$(< "${backup_dir}/ssh-dir-mode")" "${ssh_dir}"
+  else
+    rm -rf "${ssh_dir}"
+  fi
+}
+
+rollback() {
+  validate_user
+  if [[ -f "${backup_dir}/created" ]]; then
+    rm -f "${sudoers_file}"
+    userdel --remove "${user}" || true
+  elif [[ -f "${backup_dir}/existed-before" ]]; then
+    restore_existing_user
+  fi
+  rm -rf "${backup_dir}"
+}
+
+case "${action}" in
+  apply) apply ;;
+  verify) verify ;;
+  rollback) rollback ;;
+  *) echo "unknown action: ${action}" >&2; exit 2 ;;
+esac