auth: add Debian/Ubuntu PAM service skd

scripts/install.sh

@@ -56,6 +56,40 @@ if [[ ! -f "${ENV_FILE}" ]]; then
   sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}"
 fi
 
+is_debian_like() {
+  if [[ ! -r /etc/os-release ]]; then
+    return 1
+  fi
+  # shellcheck disable=SC1091
+  . /etc/os-release
+  if [[ "${ID:-}" == "ubuntu" || "${ID:-}" == "debian" ]]; then
+    return 0
+  fi
+  if [[ "${ID_LIKE:-}" == *"ubuntu"* || "${ID_LIKE:-}" == *"debian"* ]]; then
+    return 0
+  fi
+  return 1
+}
+
+if is_debian_like; then
+  PAM_DIR="/etc/pam.d"
+  PAM_SERVICE_NAME="skd"
+  PAM_SERVICE_FILE="${PAM_DIR}/${PAM_SERVICE_NAME}"
+  if [[ -d "${PAM_DIR}" && ! -f "${PAM_SERVICE_FILE}" ]]; then
+    log "Creating PAM service ${PAM_SERVICE_NAME} for Debian/Ubuntu..."
+    sudo tee "${PAM_SERVICE_FILE}" >/dev/null <<'EOF'
+# PAM configuration for Safe Kiddo Daemon
+auth    include   common-auth
+account include   common-account
+password include  common-password
+session include   common-session
+EOF
+  fi
+  if ! sudo grep -q "^SKD_AUTH_PAM_SERVICE=" "${ENV_FILE}"; then
+    echo "SKD_AUTH_PAM_SERVICE=${PAM_SERVICE_NAME}" | sudo tee -a "${ENV_FILE}" >/dev/null
+  fi
+fi
+
 log "Ensuring minimal ENV defaults (PAM always on, allowed user)..."
 DEFAULT_USER="${SUDO_USER:-}"
 if [[ -n "${DEFAULT_USER}" ]]; then