from PyInquirer import prompt, Separator


def show_menu():
    questions = [
        {
            'type': 'checkbox',
            'message': 'Select CIS Points',
            'name': 'points',
            'choices': [
                Separator('------------> 1. Initial Setup'),
                Separator('-----> 1.1-Filesystem Configuration'),
                {'name': '1.1.1.1- Ensure mounting of cramfs filesystems is disabled (Scored)'},
                {'name': '1.1.1.2- Ensure mounting of freevxfs filesystems is disabled (Scored)'},
                {'name': '1.1.1.3- Ensure mounting of jffs2 filesystems is disabled (Scored)'},
                {'name': '1.1.1.4- Ensure mounting of hfs filesystems is disabled (Scored)'},
                {'name': '1.1.1.5- Ensure mounting of hfsplus filesystems is disabled (Scored)'},
                {'name': '1.1.1.6- Ensure mounting of squashfs filesystems is disabled (Scored)'},
                {'name': '1.1.1.7- Ensure mounting of udf filesystems is disabled (Scored)'},
                {'name': '1.1.1.8- Ensure mounting of FAT filesystems is limited (Not Scored)'},
                {'name': '1.1.2- Ensure /tmp is configured (Scored)'},
                {'name': '1.1.3- Ensure nodev option set on /tmp partition (Scored)'},
                {'name': '1.1.4- Ensure nosuid option set on /tmp partition (Scored)'},
                {'name': '1.1.5- Ensure noexec option set on /tmp partition (Scored)'},
                {'name': '1.1.6- Ensure separate partition exists for /var (Scored)'},
                {'name': '1.1.7- Ensure separate partition exists for /var/tmp (Scored)'},
                {'name': '1.1.8- Ensure nodev option set on /var/tmp partition (Scored)'},
                {'name': '1.1.9- Ensure nosuid option set on /var/tmp partition (Scored)'},
                {'name': '1.1.10- Ensure noexec option set on /var/tmp partition (Scored)'},
                {'name': '1.1.11- Ensure separate partition exists for /var/log (Scored)'},
                {'name': '1.1.12- Ensure separate partition exists for /var/log/audit (Scored)'},
                {'name': '1.1.13- Ensure separate partition exists for /home (Scored)'},
                {'name': '1.1.14- Ensure nodev option set on /home partition (Scored)'},
                {'name': '1.1.15- Ensure nodev option set on /dev/shm partition (Scored)'},
                {'name': '1.1.16- Ensure nosuid option set on /dev/shm partition (Scored)'},
                {'name': '1.1.17- Ensure noexec option set on /dev/shm partition (Scored)'},
                {'name': '1.1.18- Ensure nodev option set on removable media partitions (Not Scored)'},
                {'name': '1.1.19- Ensure nosuid option set on removable media partitions (Not Scored)'},
                {'name': '1.1.20- Ensure noexec option set on removable media partitions (Not Scored)'},
                {'name': '1.1.21- Ensure sticky bit is set on all world-writable directories (Scored)'},
                {'name': '1.1.22- Disable Automounting (Scored)'},
                {'name': '1.1.23- Disable USB Storage (Scored)'},
                Separator('-----> 1.2-Configure Software Updates'),
                {'name': '1.2.1- Ensure package manager repositories are configured (Not Scored)'},
                {'name': '1.2.2- Ensure GPG keys are configured (Not Scored)'},
                Separator('-----> 1.3-Configure sudo'),
                {'name': '1.3.1- Ensure sudo is installed (Scored)'},
                {'name': '1.3.2- Ensure sudo commands use pty (Scored)'},
                {'name': '1.3.3- Ensure sudo log file exists (Scored)'},
                Separator('-----> 1.4-Filesystem Integrity Checking'),
                {'name': '1.4.1- Ensure AIDE is installed (Scored)'},
                {'name': '1.4.2- Ensure filesystem integrity is regularly checked (Scored)'},
                Separator('-----> 1.5-Secure Boot Settings'),
                {'name': '1.5.1- Ensure permissions on bootloader config are configured (Scored)'},
                {'name': '1.5.2- Ensure bootloader password is set (Scored)'},
                {'name': '1.5.3- Ensure authentication required for single user mode (Scored)'},
                {'name': '1.5.4- Ensure interactive boot is not enabled (Not Scored)'},
                Separator('-----> 1.6-Additional Process Hardening'),
                {'name': '1.6.1- Ensure XD/NX support is enabled (Scored)'},
                {'name': '1.6.2- Ensure address space layout randomization (ASLR) is enabled (Scored)'},
                {'name': '1.6.3- Ensure prelink is disabled (Scored)'},
                {'name': '1.6.4- Ensure core dumps are restricted (Scored)'},
                Separator('-----> 1.7-Additional Process Hardening'),
                {'name': '1.7.1- Configure AppArmor'},
                {'name': '1.7.1.1- Ensure XD/NX support is enabled (Scored)'},
                {'name': '1.7.1.2- Ensure AppArmor is installed (Scored)'},
                {'name': '1.7.1.3- Ensure all AppArmor Profiles are in enforce or complain mode (Scored)'},
                {'name': '1.7.1.4- Ensure all AppArmor Profiles are enforcing (Scored)'},
                Separator('-----> 1.8-Warning Banners'),
                {'name': '1.8.1- Command Line Warning Banners'},
                {'name': '1.8.1.1- Ensure message of the day is configured properly (Scored)'},
                {'name': '1.8.1.2- Ensure local login warning banner is configured properly (Scored)'},
                {'name': '1.8.1.3- Ensure remote login warning banner is configured properly (Scored)'},
                {'name': '1.8.1.4- Ensure permissions on /etc/motd are configured (Scored)'},
                {'name': '1.8.1.5- Ensure permissions on /etc/issue are configured (Scored)'},
                {'name': '1.8.1.6- Ensure permissions on /etc/issue.net are configured (Scored)'},
                {'name': '1.8.2- Ensure GDM login banner is configured (Scored)'},
                Separator('-----> 1.9-Updates'),
                {'name': '1.9- Ensure updates, patches, and additional security software are installed (Not Scored)'},

                Separator('------------> 2. Services'),
                Separator('-----> 2.1-inetd Services'),
                {'name': '2.1.1- Ensure xinetd is not installed (Scored)'},
                {'name': '2.1.2- Ensure openbsd-inetd is not installed (Scored)'},
                Separator('-----> 2.2-Special Purpose Services'),
                {'name': '2.2.1.1- Ensure time synchronization is in use (Scored)'},
                {'name': '2.2.1.2- Ensure systemd-timesyncd is configured (Not Scored)'},
                {'name': '2.2.1.3- Ensure chrony is configured (Scored)'},
                {'name': '2.2.1.4- Ensure ntp is configured (Scored)'},
                {'name': '2.2.2- Ensure X Window System is not installed (Scored)'},
                {'name': '2.2.3- Ensure Avahi Server is not enabled (Scored)'},
                {'name': '2.2.4- Ensure CUPS is not enabled (Scored)'},
                {'name': '2.2.5- Ensure DHCP Server is not enabled (Scored)'},
                {'name': '2.2.6- Ensure LDAP server is not enabled (Scored)'},
                {'name': '2.2.7- Ensure NFS and RPC are not enabled (Scored)'},
                {'name': '2.2.8- Ensure DNS Server is not enabled (Scored)'},
                {'name': '2.2.9- Ensure FTP Server is not enabled (Scored)'},
                {'name': '2.2.10- Ensure HTTP server is not enabled (Scored)'},
                {'name': '2.2.11- Ensure email services are not enabled (Scored)'},
                {'name': '2.2.12- Ensure Samba is not enabled (Scored)'},
                {'name': '2.2.13- Ensure HTTP Proxy Server is not enabled (Scored)'},
                {'name': '2.2.14- Ensure SNMP Server is not enabled (Scored)'},
                {'name': '2.2.15- Ensure mail transfer agent is configured for local-only mode (Scored)'},
                {'name': '2.2.16- Ensure rsync service is not enabled (Scored)'},
                {'name': '2.2.17- Ensure NIS Server is not enabled (Scored)'},
                Separator('-----> 2.3-Service Clients'),
                {'name': '2.3.1- Ensure NIS Client is not installed (Scored)'},
                {'name': '2.3.2- Ensure rsh client is not installed (Scored)'},
                {'name': '2.3.3- Ensure talk client is not installed (Scored)'},
                {'name': '2.3.4- Ensure telnet client is not installed (Scored)'},
                {'name': '2.3.5- Ensure LDAP client is not installed (Scored)'},

                Separator('------------> 3. Network Configuration'),
                Separator('-----> 3.1-Network Parameters (Host Only)'),
                {'name': '3.1.1- Ensure packet redirect sending is disabled (Scored)'},
                {'name': '3.1.2- Ensure IP forwarding is disabled (Scored)'},
                Separator('-----> 3.2-Network Parameters (Host and Router)'),
                {'name': '3.2.1- Ensure source routed packets are not accepted (Scored)'},
                {'name': '3.2.2- Ensure ICMP redirects are not accepted (Scored)'},
                {'name': '3.2.3- Ensure secure ICMP redirects are not accepted (Scored)'},
                {'name': '3.2.4- Ensure suspicious packets are logged (Scored)'},
                {'name': '3.2.5- Ensure broadcast ICMP requests are ignored (Scored)'},
                {'name': '3.2.6- Ensure bogus ICMP responses are ignored (Scored)'},
                {'name': '3.2.7- Ensure Reverse Path Filtering is enabled (Scored)'},
                {'name': '3.2.8- Ensure TCP SYN Cookies is enabled (Scored)'},
                {'name': '3.2.9- Ensure IPv6 router advertisements are not accepted (Scored)'},
                Separator('-----> 3.3-TCP Wrappers'),
                {'name': '3.3.1- Ensure TCP Wrappers is installed (Not Scored)'},
                {'name': '3.3.2- Ensure /etc/hosts.allow is configured (Not Scored)'},
                {'name': '3.3.3- Ensure /etc/hosts.deny is configured (Not Scored)'},
                {'name': '3.3.4- Ensure permissions on /etc/hosts.allow are configured (Scored)'},
                {'name': '3.3.5- Ensure permissions on /etc/hosts.deny are configured (Scored)'},
                Separator('-----> 3.4-Uncommon Network Protocols'),
                {'name': '3.4.1- Ensure DCCP is disabled (Scored)'},
                {'name': '3.4.2- Ensure SCTP is disabled (Scored)'},
                {'name': '3.4.3- Ensure RDS is disabled (Scored)'},
                {'name': '3.4.4- Ensure TIPC is disabled (Scored)'},
                Separator('-----> 3.5-Firewall Configuration'),
                {'name': '3.5.1.1- Ensure a Firewall package is installed (Scored)'},
                {'name': '3.5.2.1- Ensure ufw service is enabled (Scored)'},
                {'name': '3.5.2.2- Ensure default deny firewall policy (Scored)'},
                {'name': '3.5.2.3- Ensure loopback traffic is configured (Scored)'},
                {'name': '3.5.2.4- Ensure outbound connections are configured (Not Scored)'},
                {'name': '3.5.2.5- Ensure firewall rules exist for all open ports (Not Scored)'},
                Separator('-----> 3.6-Wireless'),
                {'name': '3.6- Ensure wireless interfaces are disabled (Scored)'},
                Separator('-----> 3.7-IPv6'),
                {'name': '3.7- Disable IPv6 (Not Scored)'},

                Separator('------------> 4. Logging and Auditing'),
                Separator('-----> 4.1-Configure System Accounting (auditd)'),
                {'name': '4.1.1.1- Ensure auditd is installed (Scored)'},
                {'name': '4.1.1.2- Ensure auditd service is enabled (Scored)'},
                {'name': '4.1.1.3- Ensure auditing for processes that start prior to auditd is enabled (Scored)'},
                {'name': '4.1.1.4- Ensure audit_backlog_limit is sufficient (Scored)'},
                {'name': '4.1.2.1- Ensure audit log storage size is configured (Scored)'},
                {'name': '4.1.2.2- Ensure audit logs are not automatically deleted (Scored)'},
                {'name': '4.1.2.3- Ensure system is disabled when audit logs are full (Scored)'},
                {'name': '4.1.3- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.4- Ensure events that modify user/group information are collected (Scored)'},
                {'name': '4.1.5- Ensure events that modify the systems network environment are collected (Scored)'},
                {
                    'name': '4.1.6- Ensure events that modify the systems Mandatory Access Controls are collected (Scored)'},
                {'name': '4.1.7- Ensure login and logout events are collected (Scored)'},
                {'name': '4.1.8- Ensure session initiation information is collected (Scored)'},
                {
                    'name': '4.1.9- Ensure discretionary access control permission modification events are collected (Scored)'},
                {'name': '4.1.10- Ensure unsuccessful unauthorized file access attempts are collected (Scored)'},
                {'name': '4.1.11- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.12- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.13- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.14- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.15- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.16- Ensure events that modify date and time information are collected (Scored)'},
                {'name': '4.1.17- Ensure events that modify date and time information are collected (Scored)'},

                Separator('-----> 4.2-Configure Logging'),
                {'name': '4.2.1.1- Ensure rsyslog is installed (Scored)'},
                {'name': '4.2.1.2- Ensure rsyslog Service is enabled (Scored)'},
                {'name': '4.2.1.3- Ensure logging is configured (Not Scored)'},
                {'name': '4.2.1.4- Ensure rsyslog default file permissions configured (Scored)'},
                {'name': '4.2.1.5- Ensure rsyslog is configured to send logs to a remote log host (Scored)'},
                {
                    'name': '4.2.1.6- Ensure remote rsyslog messages are only accepted on designated log hosts. (Not Scored)'},

                Separator('-----> 4.3-Logrotate'),
                {'name': '4.3- Ensure logrotate is configured (Not Scored)'},

                Separator('------------> 5. Access, Authentication and Authorization'),
                Separator('-----> 5.1-Configure cron'),
                {'name': '5.1.1- Ensure cron daemon is enabled (Scored)'},
                {'name': '5.1.2- Ensure permissions on /etc/crontab are configured (Scored)'},
                {'name': '5.1.3- Ensure permissions on /etc/cron.hourly are configured (Scored)'},
                {'name': '5.1.4- Ensure permissions on /etc/cron.daily are configured (Scored)'},
                {'name': '5.1.5- Ensure permissions on /etc/cron.weekly are configured (Scored)'},
                {'name': '5.1.6- Ensure permissions on /etc/cron.monthly are configured (Scored)'},
                {'name': '5.1.7- Ensure permissions on /etc/cron.d are configured (Scored)'},
                {'name': '5.1.8- Ensure at/cron is restricted to authorized users (Scored)'},

                Separator('-----> 5.2-SSH Server Configuration'),
                {'name': '5.2.1- Ensure permissions on /etc/ssh/sshd_config are configured (Scored)'},
                {'name': '5.2.2- Ensure permissions on SSH private host key files are configured (Scored)'},
                {'name': '5.2.3- Ensure permissions on SSH public host key files are configured (Scored)'},
                {'name': '5.2.4- Ensure SSH Protocol is not set to 1 (Scored)'},
                {'name': '5.2.5- Ensure SSH LogLevel is appropriate (Scored)'},
                {'name': '5.2.6- Ensure SSH X11 forwarding is disabled (Scored)'},
                {'name': '5.2.7- Ensure SSH MaxAuthTries is set to 4 or less (Scored)'},
                {'name': '5.2.8- Ensure SSH IgnoreRhosts is enabled (Scored)'},
                {'name': '5.2.9- Ensure SSH HostbasedAuthentication is disabled (Scored)'},
                {'name': '5.2.10- Ensure SSH root login is disabled (Scored)'},
                {'name': '5.2.11- Ensure SSH PermitEmptyPasswords is disabled (Scored)'},
                {'name': '5.2.12- Ensure SSH PermitUserEnvironment is disabled (Scored)'},
                {'name': '5.2.13- Ensure only strong Ciphers are used (Scored)'},
                {'name': '5.2.14- Ensure only strong MAC algorithms are used (Scored)'},
                {'name': '5.2.15- Ensure only strong Key Exchange algorithms are used (Scored)'},
                {'name': '5.2.16- Ensure SSH Idle Timeout Interval is configured (Scored)'},
                {'name': '5.2.17- Ensure SSH LoginGraceTime is set to one minute or less (Scored)'},
                {'name': '5.2.18- Ensure SSH access is limited (Scored)'},
                {'name': '5.2.19- Ensure SSH warning banner is configured (Scored)'},
                {'name': '5.2.20- Ensure SSH PAM is enabled (Scored)'},
                {'name': '5.2.21- Ensure SSH AllowTcpForwarding is disabled (Scored)'},
                {'name': '5.2.22- Ensure SSH MaxStartups is configured (Scored)'},
                {'name': '5.2.23- Ensure SSH MaxSessions is set to 4 or less (Scored)'},

                Separator('-----> 5.3-Configure PAM'),
                {'name': '5.3.1- Ensure password creation requirements are configured (Scored)'},
                {'name': '5.3.2- Ensure lockout for failed password attempts is configured (Scored)'},
                {'name': '5.3.3- Ensure password reuse is limited (Scored)'},
                {'name': '5.3.4- Ensure password hashing algorithm is SHA-512 (Scored)'},

                Separator('-----> 5.4-Configure Logging'),
                {'name': '5.4.1.1- Ensure password expiration is 365 days or less (Scored)'},
                {'name': '5.4.1.2- Ensure minimum days between password changes is configured (Scored)'},
                {'name': '5.4.1.3- Ensure password expiration warning days is 7 or more (Scored)'},
                {'name': '5.4.1.4- Ensure inactive password lock is 30 days or less (Scored)'},
                {'name': '5.4.1.5- Ensure all users last password change date is in the past (Scored)'},
                {'name': '5.4.2- Ensure system accounts are secured (Scored)'},
                {'name': '5.4.3- Ensure default group for the root account is GID 0 (Scored)'},
                {'name': '5.4.4- Ensure default user umask is 027 or more restrictive (Scored)'},
                {'name': '5.4.5- Ensure default user shell timeout is 900 seconds or less (Scored)'},

                Separator('-----> 5.5-Ensure root login is restricted to system console'),
                {'name': '5.5- Ensure root login is restricted to system console (Not Scored)'},

                Separator('-----> 5.6-Ensure access to the su command is restricted (Scored)'),
                {'name': '5.6- Ensure access to the su command is restricted (Scored)'},

                Separator('------------> 6. System Maintenance'),
                Separator('-----> 6.1-System File Permissions'),
                {'name': '6.1.1- Audit system file permissions (Not Scored)'},
                {'name': '6.1.2- Ensure permissions on /etc/passwd are configured (Scored)'},
                {'name': '6.1.3- Ensure permissions on /etc/gshadow- are configured (Scored)'},
                {'name': '6.1.4- Ensure permissions on /etc/shadow are configured (Scored)'},
                {'name': '6.1.5- Ensure permissions on /etc/group are configured (Scored)'},
                {'name': '6.1.6- Ensure permissions on /etc/passwd- are configured (Scored)'},
                {'name': '6.1.7- Ensure permissions on /etc/shadow- are configured (Scored)'},
                {'name': '6.1.8- Ensure permissions on /etc/group- are configured (Scored)'},
                {'name': '6.1.9- Ensure permissions on /etc/gshadow are configured (Scored)'},
                {'name': '6.1.10- Ensure no world writable files exist (Scored)'},
                {'name': '6.1.11- Ensure no unowned files or directories exist (Scored)'},
                {'name': '6.1.12- Ensure no ungrouped files or directories exist (Scored)'},
                {'name': '6.1.13- Audit SUID executables (Not Scored)'},
                {'name': '6.1.14- Audit SGID executables (Not Scored)'},

                Separator('-----> 6.2-User and Group Settings'),
                {'name': '6.2.1- Ensure password fields are not empty (Scored)'},
                {'name': '6.2.2- Ensure no legacy "+" entries exist in /etc/passwd (Scored)'},
                {'name': '6.2.3- Ensure all users home directories exist (Scored)'},
                {'name': '6.2.4- Ensure no legacy "+" entries exist in /etc/shadow (Scored)'},
                {'name': '6.2.5- Ensure no legacy "+" entries exist in /etc/group (Scored)'},
                {'name': '6.2.6- Ensure root is the only UID 0 account (Scored)'},
                {'name': '6.2.7- Ensure root PATH Integrity (Scored)'},
                {'name': '6.2.8- Ensure users home directories permissions are 750 or more restrictive (Scored)'},
                {'name': '6.2.9- Ensure users own their home directories (Scored)'},
                {'name': '6.2.10- Ensure users dot files are not group or world writable (Scored)'},
                {'name': '6.2.11- Ensure no users have .forward files (Scored)'},
                {'name': '6.2.12- Ensure no users have .netrc files (Scored)'},
                {'name': '6.2.13- Ensure users .netrc Files are not group or world accessible (Scored)'},
                {'name': '6.2.14- Ensure no users have .rhosts files (Scored)'},
                {'name': '6.2.15- Ensure all groups in /etc/passwd exist in /etc/group (Scored)'},
                {'name': '6.2.16- Ensure no duplicate UIDs exist (Scored)'},
                {'name': '6.2.17- Ensure no duplicate GIDs exist (Scored)'},
                {'name': '6.2.18- Ensure no duplicate user names exist (Scored)'},
                {'name': '6.2.19- Ensure no duplicate group names exist (Scored)'},
                {'name': '6.2.20- Ensure shadow group is empty (Scored)'},
            ]
        }
    ]
    answers = prompt(questions)
    points = ['rule_{}'.format(x.split('-')[0]) for x in answers['points']]
    return points
