#!/bin/bash
#
# /usr/sbin/internmetdaemon.sh
#

template_user=linuxadmin
servername=server
ad_domain=lmn.lan

user=$(who | awk '$2 ~ /:0/ {print $1}')
krbfile=$(find /tmp -user "$user" -name "krb5cc*" -type f)
i_member=$(ldbsearch -k yes --krb5-ccache=$krbfile -H ldaps://$servername.$ad_domain "(&(samaccountname=$user))" | grep -E "memberOf.*CN=internet")

if [[ -z "$i_member" ]]  && [[ -n "$user" ]] && [[ $user != $template_user ]]
then
iptables -A OUTPUT -p tcp --dport 3128 -j REJECT
# echo $(date)" ... Internet aus für "$user >> /var/log/i_on_off.log
else
iptables -D OUTPUT -p tcp --dport 3128 -j REJECT
# echo $(date)" ... Internet an für "$user >> /var/log/i_on_off.log
fi 

exit 0
