Update scripts and deploy with gnu stow

scripts/README.md

@@ -0,0 +1 @@
+# RHEL Management Scripts

scripts/script-deploy-manual

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# This script installs the Hartman Lab Server Manual to each user's desktop
+# Usage: script-deploy-manual USERNAME|--all
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+
+script-deploy-manual() {
+    local user_arg="$1"
+    local manual_url="https://docs.google.com/document/d/1K_KwAlv8Zljmy-enwmhT6gMTFutlAFglixvpLGBx0VY"
+    local remove=("manual.pdf" "manual.odt" "Notes.pdf" "Notes.odt" \
+        "README.html" "Link to Manual.desktop" "manual-images" \
+        "manual.html" "Manual.desktop" "manual.desktop")
+    local users=()
+
+    if [[ "$user_arg" == "--all" ]]; then
+        for d in /home/*; do [[ -d $d ]] && users+=("${d##*/}"); done
+    else
+        users+=("$user_arg")
+    fi
+
+    for user in "${users[@]}"; do
+        desktop="/home/$user/Desktop"
+        [[ -d $desktop ]] || continue
+        echo "Scanning $desktop for old manuals"
+        for f in "${remove[@]}"; do
+            if [[ -e $desktop/$f || -L $desktop/$f ]]; then
+                echo "Removing $desktop/$f"
+                rm -f "${desktop:?}/$f"
+            fi
+        done
+        echo "Installing manual to $desktop/manual.desktop"
+    cat <<-EOF > "$desktop/manual.desktop"
+					[Desktop Entry]
+					Encoding=UTF-8
+					Name=Hartman Lab Server Manual
+					Type=Link
+					URL=$manual_url
+					Icon=text-html
+				EOF
+  done
+}
+
+# Allow script to be safely sourced
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  script-deploy-manual "$@"
+  exit $?
+fi

scripts/script-deploy-scripts

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Adds the scripts directory to the global PATH 
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+script-deploy-scripts() {
+    local profile_file="/etc/profile.d/99-hartmanlab_server_scripts.sh"
+    echo "Adding $p to global PATH in $profile_file"
+    sudo bash -c "echo 'export PATH=\"\$PATH:$p\"' > '$profile_file'"
+}
+
+# Allow script to be safely sourced
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+	script-deploy-scripts
+	exit
+fi

scripts/script-drives-fix-btrfs-full

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Fix the btrfs out of space error
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+fs=( "/mnt/array" "/mnt/backup" )
+
+# Discard empty blocks
+for f in "${fs[@]}"; do
+    btrfs balance start -dusage=0 "$f"
+    btrfs balance start -musage=0 "$f"
+done

scripts/script-files-permissions-reset

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Smartly change permissions on selected directories
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+[[ $# -eq 0 ]] && DIRS=("/mnt/data") || DIRS=("$@")
+
+ask_ok "Reset permissions on ${DIRS[*]}?"
+
+if ! chgrp smbgrp -R "${DIRS[@]}"; then
+	echo "Failed to change group ownership" >&2
+	exit 1
+fi
+
+if ! chmod 6775 -R "${DIRS[@]}"; then
+	echo "Failed to change permissions" >&2
+	exit 1
+fi
+
+exit 0

scripts/script-files-permissions-set

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Intelligently change permissions on selected directories
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+if [[ $# -eq 0 ]]; then
+    echo "No arguments provided, using autodetection"
+    paths=("$PWD")
+    user=$(stat -c "%U" "$PWD")
+    group=$(stat -c "%G" "$PWD")
+elif [[ $# -eq 1 ]]; then
+    user="$1"
+    group="$1"
+    paths=("$PWD")
+elif [[ $# -eq 2 ]]; then
+    user="$1"
+    group="$2"
+    paths=("$PWD")
+elif [[ $# -gt 2 ]]; then
+    user="$1"
+    group="$2"
+    paths=("${@:3}")
+fi
+
+for path in "${paths[@]}"; do 
+    if [[ "$path" == "/" ]]; then
+        echo "You are trying to operate on the root partition!"
+        echo "This seems highly unusual!"
+        ask_ok "Continue?" || exit $?
+    fi
+    og_user=$(stat -c "%U" "$path")
+    og_group=$(stat -c "%G" "$path")
+    printf "%-20s %-10s %-10s\n" "PATH" "USER" "GROUP"
+    echo -e "$path\t$og_user\t$og_group"
+    if [[ "$group" != "smbgrp" || "$og_group" != "smbgrp" ]]; then
+        echo "$path is not world accessible by the smbgrp group"
+        ask_ok "Change $path group $og_group to smbgrp?" && group="smbgrp"
+    fi
+done
+
+ask_ok "Apply user: $user and group: $group to ${paths[*]} and all subdirs?" && \
+    chown -R "$user":"$group" "${paths[@]}"
+
+# Set mode based on group:
+# - 6775: Enables read/write/execute for owner and group, with setgid bit for group inheritance.
+# - 755: Enables read/write/execute for owner, and read/execute for group and others.
+[[ "$group" == "smbgrp" ]] && mode=6775 || mode=755
+    
+ask_ok "Apply chmod $mode to ${paths[*]} and all subdirs?" && \
+    chmod -R "$mode" "${paths[@]}"
+
+# Let's do it in less steps (see above) for now unless it becomes a problem
+# TODO: Implement setuid/setgid functionality to ensure files and directories inherit user/group permissions.
+# echo "Apply setuid/setgid bits to ${paths[*]} and all subdirs?"
+# ask_ok "Files/dirs will inherit their " && \
+#     chmod -R g+s,u+s "${paths[@]}"    

scripts/script-functions

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Common functions for the lab scripts
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+
+export INSTALL_DIR=/usr/local/bin
+
+prompt() { 
+    local user_input
+    read -r -p "Enter $1: " user_input
+    echo "$user_input"
+}
+
+ask_ok() {
+    declare response
+    ((YES_SWITCH)) && return 0
+    read -r -p "$* [y/N]: " response
+    [[ ${response,,} =~ ^(yes|y)$ ]]
+}
+
+is_root() {
+    [[ $EUID -gt 0 ]] && echo "Script must be run with sudo" && exit 1
+}
+

scripts/script-install-btrfsmaintenance

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Generic btrfsmaintenance install script
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+# Optionally provide the config directory manually
+if [[ $# -lt 1 ]]; then
+    if [[ -d /etc/sysconfig ]]; then
+        CONFDIR=/etc/sysconfig
+    elif [[ -d /etc/default ]]; then
+        CONFDIR=/etc/default
+    else
+        echo "Cannot detect sysconfig directory, please specify manually"
+        exit 1
+    fi
+else
+    CONFDIR="$1"
+fi
+
+# This is hardcoded by the btrfs maintenance scripts, change at your peril
+INSTALLDIR="/usr/share/btrfsmaintenance"
+
+# Backup existing installation
+if [[ -d "$INSTALLDIR" ]]; then
+    TEMPDIR="/tmp/btrfs-maintenance.bk"
+    echo "Moving existing $INSTALLDIR to $TEMPDIR"
+    [[ -d "$TEMPDIR" ]] && rm -rf "$TEMPDIR"
+    mv "$INSTALLDIR" "$TEMPDIR"
+fi
+
+git clone "https://github.com/kdave/btrfsmaintenance.git" "$INSTALLDIR"
+
+# Quirks
+if [[ -e "/etc/os-release" ]]; then
+    source "/etc/os-release"
+    if [[ "$ID" == "centos" && "$VERSION_ID" == "7" ]]; then
+        sed -i 's/flock --verbose/flock' "$INSTALLDIR"/btrfsmaintenance-functions
+    fi
+fi
+
+chmod 755 "$INSTALLDIR"/*.sh
+
+# Copy config file
+[[ ! -f "$CONFDIR"/btrfsmaintenance ]] && install -oroot -groot -m644 "$INSTALLDIR"/sysconfig.btrfsmaintenance "$CONFDIR"/btrfsmaintenance
+
+# Copy systemd files and reload
+for f in "$INSTALLDIR"/btrfs-*.{service,timer}; do
+    cp "$f" /usr/lib/systemd/system/
+done
+systemctl daemon-reload
+
+# Optionally, start and enable the services
+# systemctl enable --now btrfs-scrub

scripts/script-install-motd

@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+# Install and generate motd
+# Copyright 2019-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+set -euo pipefail
+
+PROG_NAME="$(basename "$0")"
+INSTALL_PATH="/usr/local/bin/$PROG_NAME"
+SERVICE_UNIT="/usr/lib/systemd/system/motd.service"
+TIMER_UNIT="/usr/lib/systemd/system/motd.timer"
+
+usage() {
+  cat <<-EOF
+		Usage: $PROG_NAME [--motd | --install] [--help]
+
+		Options:
+		  --motd       Output MOTD to stdout (used by systemd)
+		  --install    Instal motd systemd service and timer
+		  -h, --help   Show this help message
+EOF
+}
+
+print_motd() {
+  # ANSI color codes
+  local default='\033[0m' green='\033[0;32m' red='\033[0;31m'
+  local dim='\033[2m' undim='\033[22m'
+
+  cat <<-'EOF'
+		 _    _            _                           _           _     
+		| |  | |          | |                         | |         | |    
+		| |__| | __ _ _ __| |_ _ __ ___   __ _ _ __   | |     __ _| |__  
+		|  __  |/ _` | `__| __| `_ ` _ \ / _` | `_ \  | |    / _` | `_ \ 
+		| |  | | (_| | |  | |_| | | | | | (_| | | | | | |___| (_| | |_) |
+		|_|  |_|\__,_|_|   \__|_| |_| |_|\__,_|_| |_| |______\__,_|_.__/ 
+	EOF
+
+  # System info
+  read -r LOAD1 LOAD5 LOAD15 < <(awk '{print $1, $2, $3}' /proc/loadavg)
+  read -r USED AVAIL TOTAL < <(free -htm | awk '/^Mem:/ {print $3, $7, $2}')
+
+  local ROOT_PROCS NONROOT_PROCS TOTAL_PROCS
+  ROOT_PROCS=$(pgrep -u root | wc -l)
+  NONROOT_PROCS=$(( $(ps -eo user= | wc -l) - ROOT_PROCS ))
+  TOTAL_PROCS=$(( ROOT_PROCS + NONROOT_PROCS ))
+
+  local CPU_MODEL CPU_COUNT
+  CPU_MODEL=$(awk -F': ' '/model name/ {print $2; exit}' /proc/cpuinfo)
+  CPU_COUNT=$(grep -c '^processor' /proc/cpuinfo)
+
+  . /etc/os-release
+  local DISTRO="$PRETTY_NAME"
+  local KERNEL; KERNEL="$(uname -sr)"
+  local UPTIME; UPTIME="$(uptime -p)"
+
+  # Load
+  printf "\n"
+  printf "  Distro......: %s\n" "$DISTRO"
+  printf "  Kernel......: %s\n" "$KERNEL"
+  printf "  Uptime......: %s\n" "$UPTIME"
+  printf "  Load........: %b%s%b (1m), %b%s%b (5m), %b%s%b (15m)\n" \
+    "$green" "$LOAD1" "$default" \
+    "$green" "$LOAD5" "$default" \
+    "$green" "$LOAD15" "$default"
+  printf "  Processes...: %b%d%b (root), %b%d%b (user), %b%d%b (total)\n" \
+    "$green" "$ROOT_PROCS" "$default" \
+    "$green" "$NONROOT_PROCS" "$default" \
+    "$green" "$TOTAL_PROCS" "$default"
+  printf "  CPU.........: %s (%b%d%b vCPU)\n" \
+    "$CPU_MODEL" "$green" "$CPU_COUNT" "$default"
+  printf "  Memory......: %b%s%b used, %b%s%b avail, %b%s%b total\n" \
+    "$green" "$USED" "$default" \
+    "$green" "$AVAIL" "$default" \
+    "$green" "$TOTAL" "$default"
+
+  # Disks
+  echo -e "\n  Disk usage"
+  local max_usage=90 bar_width=50
+  while read -r target pcent size; do
+    local use=${pcent%\%}
+    local filled=$(( use * bar_width / 100 ))
+    local bar="["
+
+    local col=$green
+    (( use >= max_usage )) && col=$red
+
+    bar+="$col"
+    for ((i=0;i<filled;i++)); do bar+="="; done
+    bar+="$default$dim"
+    for ((i=filled;i<bar_width;i++)); do bar+="="; done
+    bar+="$undim]"
+
+    printf "    %-25s %3s of %-6s\n" "$target" "$pcent" "$size"
+    printf "    %b\n" "$bar"
+  done < <(
+    df -H -x zfs -x squashfs -x tmpfs -x devtmpfs -x overlay \
+      --output=target,pcent,size | tail -n +2
+  )
+
+  # Services
+  echo -e "\n  Services"
+  local services=(
+    btrfs-balance.timer btrfs-scrub.timer backup.timer btrbk.timer fstrim.timer
+    fail2ban firewalld smb nmb motion smartd cockpit.socket
+    dnf-automatic.timer motd.timer
+  )
+  for ((i=0; i<${#services[@]}; i+=2)); do
+    local s1=${services[i]} s2=${services[i+1]:-}
+    local st1 st2 c1 c2
+    st1=$(systemctl is-active "$s1" 2>/dev/null || echo inactive)
+    st2=$(systemctl is-active "$s2" 2>/dev/null || echo inactive)
+    [[ $st1 == active ]] && c1="${green}$st1${default}" || c1="${red}$st1${default}"
+    [[ $st2 == active ]] && c2="${green}$st2${default}" || c2="${red}$st2${default}"
+    printf "    %-15s : %b    %-15s : %b\n" \
+      "${s1%.*}" "$c1" "${s2%.*}" "$c2"
+  done
+
+	# Fail2Ban
+	read -r -a jails <<< "$(fail2ban-client status | grep "Jail list:" | sed "s/ //g" | awk '{split($2,a,",");for(i in a) print a[i]}')"
+
+	out="jail,failed,total,banned,total\n"
+
+	for jail in "${jails[@]}"; do
+		# Slow because fail2ban-client has to be called for every jail (~70ms per jail)
+		status=$(fail2ban-client status "$jail")
+		failed=$(echo "$status" | grep -ioP '(?<=Currently failed:\t)[[:digit:]]+')
+		totalfailed=$(echo "$status" | grep -ioP '(?<=Total failed:\t)[[:digit:]]+')
+		banned=$(echo "$status" | grep -ioP '(?<=Currently banned:\t)[[:digit:]]+')
+		totalbanned=$(echo "$status" | grep -ioP '(?<=Total banned:\t)[[:digit:]]+')
+		out+="$jail,$failed,$totalfailed,$banned,$totalbanned\n"
+	done
+
+	printf "\nFail2ban\n"
+	printf "%b\n" "$out" | column -ts $',' | sed -e 's/^/  /'
+
+  # Help links
+  cat <<-EOF
+
+		Links (ctrl+click to follow)
+		  Server Manual.........: https://tinyurl.com/jjz9h6fr
+		  Cockpit (for admins)..: http://localhost:9090
+		  Robot Camera..........: http://localhost:9999
+		  JupyterLab............: http://localhost:8888
+		  RStudio Server........: http://localhost:8787
+		  Robot Computer........: vnc://192.168.16.101:5900
+		  Windows 10 VM.........: vnc://localhost:5900 (pw: hartman)
+	EOF
+
+	# Scheduled reboot
+	if systemctl is-active scheduled-reboot.timer &>/dev/null; then
+		echo -n "Next scheduled reboot: "
+		time=$(systemctl cat scheduled-reboot.timer | grep OnCalendar=)
+		time=${time#*=}
+		echo "$time"
+	fi
+
+  if systemctl is-active scheduled-reboot.timer &>/dev/null; then
+    echo -n "  Next reboot  : "
+    systemctl show -p OnCalendar scheduled-reboot.timer | cut -d= -f2
+  fi
+
+  printf "\n"
+}
+
+install_services() {
+  # Write the service unit
+  cat >"$SERVICE_UNIT" <<-EOF
+		[Unit]
+		Description=Generate MoTD
+
+		[Service]
+		Type=oneshot
+		ExecStart=$INSTALL_PATH --motd > /etc/motd
+
+		[Install]
+		WantedBy=multi-user.target
+	EOF
+
+  # Write the timer unit
+  cat >"$TIMER_UNIT" <<-EOF
+		[Unit]
+		Description=Generate MoTD every minute
+
+		[Timer]
+		OnCalendar=*:0/1
+		OnBootSec=10s
+
+		[Install]
+		WantedBy=timers.target
+	EOF
+
+  chmod +x "$INSTALL_PATH"
+  systemctl daemon-reload
+  systemctl enable --now motd.timer
+  echo "Installed and started motd.timer → $SERVICE_UNIT, $TIMER_UNIT"
+}
+
+main() {
+  if [[ ${1:-} == --motd ]]; then
+    print_motd
+    exit 0
+  fi
+
+  if [[ ${1:-} == --install ]]; then
+    if [[ $EUID -ne 0 ]]; then
+      echo "Error: Must run as root to install." >&2
+      exit 1
+    fi
+    cp -f "$0" "$INSTALL_PATH"
+    install_services
+  fi
+
+  if [[ ${1:-} =~ ^(-h|--help)$ ]]; then
+    usage
+    exit 0
+  fi
+
+
+}
+
+main "$@"

scripts/script-system-scheduled-restart

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Update and restart the system
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+[[ $# -eq 0 ]] && time='*-*-* 01:30:00' # 1:30AM
+[[ $# -gt 1 ]] && time="$*"
+
+script-system-update
+
+ask_ok "Set a scheduled reboot for $time?" || exit 1
+
+cat <<- EOF > "/usr/lib/systemd/system/scheduled-reboot.timer"
+	[Unit]
+	Description=Scheduled reboot
+
+	[Timer]
+	OnCalendar=$time
+	Unit=reboot.target
+
+	[Install]
+	WantedBy=timers.target
+EOF
+
+systemctl daemon-reload
+systemctl start scheduled-reboot.timer
+
+# Current date
+dt=$(date '+%d/%m/%Y %H:%M:%S');
+
+msg_part1="System restart scheduled for $time."
+msg_part2="The current time is $dt."
+msg_part3="Make sure all changes are saved."
+message="$msg_part1 $msg_part2 $msg_part3"
+
+# Graphical notification
+IFS=$'\n'
+for LINE in $(w -hs); do
+    USER=$(echo "$LINE" | awk '{print $1}')
+    USER_ID=$(id -u "$USER")
+    DISP_ID=$(echo "$LINE" | awk '{print $8}')
+    sudo -u "$USER" DISPLAY="$DISP_ID" DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/"$USER_ID"/bus notify-send "$message" --icon=dialog-warning
+done
+
+# Wall notification
+wall -n "$message"

scripts/script-system-update

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Update the system
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+ask_ok "Security updates are automatically installed, perform a full system update?" || exit $?
+
+dnf update --refresh

scripts/script-user-add

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Add a user to the Hartman Lab server
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+echo "Usage: $0 [username] [password]"
+
+case $# in
+  0) prompt user; prompt password ;;
+  1) user="$1"; prompt password ;;
+  2) user="$1"; password="$2" ;;
+  *) echo "Too many arguments provided"; exit 1 ;;
+esac
+
+useradd_cmd=(useradd -m -U)
+group_str=""
+
+if id -u "$user" &>/dev/null; then
+  ask_ok "User $user exists. Run script-user-remove first?" || exit $?
+  "$p/script-user-remove" "$user" || exit $?
+fi
+
+ask_ok "Create user $user with password $password?" || exit $?
+
+restore=0
+if [[ -d /mnt/array/home-retired/$user ]]; then
+  ask_ok "Restore user $user's files from /mnt/array/home-retired/$user?" && restore=1
+fi
+
+samba=0
+ask_ok "Enable shared file access for user $user?" && group_str="smbgrp" && samba=1
+ask_ok "Make $user an admin?" && group_str+=",wheel"
+
+[[ -n $group_str ]] && useradd_cmd+=("-G" "$group_str")
+useradd_cmd+=("$user")
+
+"${useradd_cmd[@]}"
+echo "$user:$password" | chpasswd
+
+if (( restore )); then
+  if rsync -av --progress=info2 "/mnt/array/home-retired/$user/" "/home/$user/"; then
+    ask_ok "User $user's files successfully restored, remove backup at /mnt/array/home-retired/$user?" && \
+      rm -rf "/mnt/array/home-retired/$user"
+  fi
+fi
+
+if (( samba )); then
+  (echo "$password"; echo "$password") | smbpasswd -a -s "$user"
+fi
+
+ask_ok "Prompt user to reset password on next login?" &&
+  passwd --expire "$user" &&
+  echo "NOTE: The file sharing (smbpasswd) will not be changed"
+
+# Copy manual to user desktop
+desktop="/home/$user/Desktop"
+mkdir -p "$desktop"
+"$p/script-deploy-manual" "$user"
+
+exit 0

scripts/script-user-remove

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Remove a user from the server
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+echo "This script supports one optional argument, a username"
+
+if [[ $# -eq 1 ]]; then
+  user="$1"
+else
+  prompt user
+fi
+
+if ! id -u "$user" &>/dev/null; then
+  echo "User $user does not exist"
+  exit 1
+fi
+
+ask_ok "Remove user $user?" || exit 1
+
+# Kill user processes
+killall -u "$user"
+
+# Optional backup
+if ask_ok "Backup /home/$user?" && [[ -d /home/$user ]]; then
+  backup_dir="/mnt/array/home-retired/$user"
+  if [[ ! -d $backup_dir ]]; then 
+    btrfs subvolume create "$backup_dir" || exit 1
+  fi
+  rsync -av "/home/$user/" "$backup_dir/" || exit 1
+fi
+
+# Remove from Samba and subuid/subgid
+smbpasswd -x "$user"
+sed -i "/^$user:/d" /etc/subuid
+sed -i "/^$user:/d" /etc/subgid
+
+# Remove user and home directory
+if ! userdel -fr "$user"; then
+  ask_ok "Userdel failed, kill processes again and retry?" || exit 1
+  killall -u "$user" -s SIGKILL
+  userdel -fr "$user"
+fi
+

scripts/script-user-reset-desktop

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Reset default desktop preferences
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+echo "This script will only work for the current user"
+
+[[ $EUID -eq 0 ]] && echo "Do not run as root (do not use sudo)" && exit 1
+
+to_reset=(
+  /org/mate/panel/
+  /org/mate/panel/objects/
+  /org/mate/desktop/background/
+  /org/mate/desktop/font-rendering/
+  /org/mate/desktop/interface/
+  /org/mate/desktop/screensaver/
+  /org/mate/desktop/media-handling/
+  /org/mate/desktop/screensaver/
+  /org/mate/mate-menu/
+  /org/mate/marco/general/
+  /org/mate/caja/desktop/
+  /org/mate/caja/preferences/
+  /org/mate/notification-daemon/
+)
+
+echo "Resetting desktop for user $(whoami)"
+for p in "${to_reset[@]}"; do
+  dconf reset -f "$p"
+done
+
+mate-panel --reset

scripts/script-user-reset-password

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Reset a user password on the server
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+echo "Usage: $0 [username] [password]"
+
+case $# in
+  0)
+    prompt user
+    prompt password
+    ;;
+  1)
+    user="$1"
+    prompt password
+    ;;
+  2)
+    user="$1"
+    password="$2"
+    ;;
+  *)
+    echo "Too many arguments provided"
+    exit 1
+    ;;
+esac
+
+if ! id -u "$user" &>/dev/null; then
+  echo "User $user does not exist"
+  exit 1
+fi
+
+if ask_ok "Change user $user's password to $password?"; then
+  echo "$user:$password" | chpasswd
+  (echo "$password"; echo "$password") | smbpasswd -a -s "$user"
+fi
+
+ask_ok "Prompt user to reset password on next login?" &&
+  passwd --expire "$user" &&
+  echo "NOTE: The file sharing (smbpasswd) will not be changed"
+
+exit 0

scripts/script-user-reset-x2go

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# This script will reset x2go sessions to a working state
+# Use --all to reset all user X2Go sessions
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+echo "Usage: $0 [username|--all]"
+
+USER_LIST=()
+if [[ $EUID -gt 0 ]]; then
+    echo "Run as root for all users. Running in user mode for: $(whoami)"
+    USER_LIST+=("$(whoami)")
+else
+    if [[ $1 == "--all" ]]; then
+        for d in /home/*; do [[ -d $d ]] && USER_LIST+=("${d##*/}"); done
+    elif [[ -n $1 ]]; then
+        USER_LIST+=("$1")
+    else
+        prompt user
+        USER_LIST+=("$user")
+        unset user
+    fi
+fi
+
+for user in "${USER_LIST[@]}"; do
+    # Remove X2Go cache files
+    shopt -s nullglob
+    caches=(/home/"$user"/.x2go/C-"$user"-* /home/"$user"/.xsession-x2go-*)
+    shopt -u nullglob
+    if (( ${#caches[@]} )); then
+        ask_ok "Remove X2Go cache files for $user?" &&
+        rm -rf "${caches[@]}" &&
+        echo "Removed: ${caches[*]} for $user"
+    fi
+
+    # Terminate X2Go sessions
+    if [[ $EUID -gt 0 ]]; then
+        mapfile -t sessions < <(x2golistsessions | grep "$user" | cut -f2 -d'|')
+    else
+        mapfile -t sessions < <(x2golistsessions_root | grep "$user" | cut -f2 -d'|')
+    fi
+    if (( ${#sessions[@]} )); then
+        ask_ok "Terminate X2Go sessions for $user?" &&
+        for session in "${sessions[@]}"; do
+            x2goterminate-session "$session" &&
+            echo "Terminated: $session for $user"
+        done
+    fi
+done

scripts/script-user-unban

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Unbans a fail2ban IP
+# Copyright 2021-2025 Bryan C. Roessler
+# Licensed under the Apache License, Version 2.0
+p="${BASH_SOURCE[0]%/*}"; [[ -r $p/script-functions ]] && . "$p"/script-functions || exit 1
+
+is_root
+
+echo "This script supports one optional argument, an IP address"
+
+if [[ $# -eq 1 ]]; then
+    ip_address="$1"
+else
+    prompt ip_address
+fi
+
+if fail2ban-client set sshd unbanip "$ip_address"; then
+  echo "IP address $ip_address unbanned"
+fi
+
+exit $?