#!/bin/bash
#=====================================================
# SSH 安全加固脚本 - 一键配置SSH安全策略
# 来源: 整合自社区安全最佳实践
# 用法: sudo ./ssh-hardening.sh
# 注意: 执行前请确保有备用登录方式！
#=====================================================

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

SSH_CONFIG="/etc/ssh/sshd_config"
BACKUP="${SSH_CONFIG}.bak.$(date +%Y%m%d%H%M%S)"

if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}请使用 root 或 sudo 执行${NC}"
    exit 1
fi

echo -e "${YELLOW}========================================${NC}"
echo -e "${YELLOW}    SSH 安全加固工具${NC}"
echo -e "${YELLOW}========================================${NC}"
echo ""
echo -e "${RED}警告: 此操作将修改SSH配置，请确保有备用登录方式！${NC}"
echo ""
read -p "确认继续? (yes/no): " CONFIRM

if [ "$CONFIRM" != "yes" ]; then
    echo "已取消"
    exit 0
fi

# 备份
cp "$SSH_CONFIG" "$BACKUP"
echo -e "${GREEN}[✓] 已备份到: $BACKUP${NC}"

# 加固函数
set_config() {
    local key=$1 value=$2
    if grep -q "^${key}\s" "$SSH_CONFIG"; then
        sed -i "s/^${key}\s.*/${key} ${value}/" "$SSH_CONFIG"
    elif grep -q "^#${key}\s" "$SSH_CONFIG"; then
        sed -i "s/^#${key}\s.*/${key} ${value}/" "$SSH_CONFIG"
    else
        echo "${key} ${value}" >> "$SSH_CONFIG"
    fi
    echo -e "  ${GREEN}[✓]${NC} ${key} = ${value}"
}

echo ""
echo "应用安全配置..."

# 基础安全配置
set_config "Port" "2222"                              # 修改默认端口
set_config "PermitRootLogin" "no"                     # 禁止root登录
set_config "PasswordAuthentication" "no"              # 禁止密码登录（仅密钥）
set_config "PubkeyAuthentication" "yes"               # 启用密钥认证
set_config "PermitEmptyPasswords" "no"                # 禁止空密码
set_config "MaxAuthTries" "3"                         # 最大重试次数
set_config "ClientAliveInterval" "300"                # 心跳间隔
set_config "ClientAliveCountMax" "2"                  # 心跳最大次数
set_config "X11Forwarding" "no"                       # 关闭X11转发
set_config "MaxStartups" "10:30:60"                   # 限制并发连接
set_config "LoginGraceTime" "30"                      # 登录超时
set_config "AllowTcpForwarding" "no"                  # 关闭TCP转发（除非需要）
set_config "Protocol" "2"                             # 仅使用SSHv2

# 可选：限制允许的用户
# echo "AllowUsers yourusername" >> "$SSH_CONFIG"

# 验证配置
echo ""
echo "验证配置..."
if sshd -t 2>&1; then
    echo -e "${GREEN}[✓] 配置验证通过${NC}"
else
    echo -e "${RED}[✗] 配置有误，正在恢复备份...${NC}"
    cp "$BACKUP" "$SSH_CONFIG"
    exit 1
fi

# 重启SSH
echo ""
read -p "重启SSH服务? (yes/no): " RESTART
if [ "$RESTART" = "yes" ]; then
    if command -v systemctl &>/dev/null; then
        systemctl restart sshd
    else
        service sshd restart
    fi
    echo -e "${GREEN}[✓] SSH服务已重启${NC}"
    echo -e "${YELLOW}注意: SSH端口已改为 2222，请用新端口测试连接！${NC}"
fi

echo ""
echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}  SSH 加固完成${NC}"
echo -e "${GREEN}  备份文件: $BACKUP${NC}"
echo -e "${GREEN}========================================${NC}"