Enable passwordless sudo if user password not set (#106)

Author: prashantsengar

du_setup.sh

@@ -1,8 +1,9 @@
 #!/bin/bash
 
 # Debian and Ubuntu Server Hardening Interactive Script
-# Version: 0.80.2 | 2026-03-01
+# Version: 0.80.3 | 2026-03-03
 # Changelog:
+# - v0.80.3: Warn about password-less sudo and offer to genrate password/
 # - v0.80.2: Added an optional install of netbird (https://netbird.io/) as an alternative to tailscale.
 # - v0.80.1: Added a safety check to trigger the SSH rollback function if user is disconnected during SSH port change, preventing lockout.
 #            Implement a check for a validated ssh key for the sudo user before revoking root access.
@@ -103,7 +104,7 @@
 set -euo pipefail
 
 # --- Update Configuration ---
-CURRENT_VERSION="0.80.2"
+CURRENT_VERSION="0.80.3"
 SCRIPT_URL="https://raw.githubusercontent.com/buildplan/du_setup/refs/heads/main/du_setup.sh"
 CHECKSUM_URL="${SCRIPT_URL}.sha256"
 
@@ -262,7 +263,7 @@ print_header() {
     printf '%s\n' "${CYAN}╔═════════════════════════════════════════════════════════════════╗${NC}"
     printf '%s\n' "${CYAN}║                                                                 ║${NC}"
     printf '%s\n' "${CYAN}║       DEBIAN/UBUNTU SERVER SETUP AND HARDENING SCRIPT           ║${NC}"
-    printf '%s\n' "${CYAN}║                      v0.80.2 | 2026-03-01                       ║${NC}"
+    printf '%s\n' "${CYAN}║                      v0.80.3 | 2026-03-03                       ║${NC}"
     printf '%s\n' "${CYAN}║                                                                 ║${NC}"
     printf '%s\n' "${CYAN}╚═════════════════════════════════════════════════════════════════╝${NC}"
     printf '\n'
@@ -3101,8 +3102,34 @@ setup_user() {
             printf '\n'
             if [[ -z "$PASS1" && -z "$PASS2" ]]; then
                 print_warning "Password skipped. Relying on SSH key authentication."
-                log "Password setting skipped for '$USERNAME'."
-                break
+                print_warning "Without a password, you will NOT be able to use 'sudo' for administrative tasks."
+                if confirm "Generate a secure random password for you? (Recommended)" "y"; then
+                    local RAND_PASS
+                    RAND_PASS=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 24)
+                    if echo "$USERNAME:$RAND_PASS" | chpasswd >/dev/null 2>&1; then
+                        print_success "Generated random password for '$USERNAME'."
+                        printf '\n%s\n' "${YELLOW}⚠ SAVE THIS PASSWORD FOR SUDO ACCESS:${NC}"
+                        printf '  %s\n\n' "${BOLD}$RAND_PASS${NC}"
+                        log "Generated random password for '$USERNAME'."
+                        break
+                    else
+                        print_error "Failed to set random password. Please try again."
+                        continue
+                    fi
+                elif confirm "Enable passwordless sudo? (WARNING: Security Risk)" "n"; then
+                    echo "$USERNAME ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/$USERNAME"
+                    chmod 0440 "/etc/sudoers.d/$USERNAME"
+                    print_warning "Passwordless sudo enabled for '$USERNAME'."
+                    log "Passwordless sudo explicitly enabled for '$USERNAME'."
+                    break
+                elif confirm "Would you like to manually type a password instead?" "y"; then
+                    print_info "Returning to password prompt..."
+                    continue
+                else
+                    print_warning "Proceeding with NO password and NO sudo rights for '$USERNAME'."
+                    log "Password setting skipped, no sudo rights for '$USERNAME'."
+                    break
+                fi
             elif [[ "$PASS1" == "$PASS2" ]]; then
                 if echo "$USERNAME:$PASS1" | chpasswd >/dev/null 2>&1; then
                     print_success "Password for '$USERNAME' updated."