#!/bin/bash

# 安装和配置fail2ban脚本
# 用于防止SSH暴力破解攻击

set -e

echo "=================================================================================="
echo "🛡️  安装和配置 fail2ban - SSH暴力破解防护"
echo "=================================================================================="

# 检测操作系统
if [ -f /etc/redhat-release ]; then
    OS="centos"
    PKG_MANAGER="dnf"
elif [ -f /etc/debian_version ]; then
    OS="debian"
    PKG_MANAGER="apt-get"
else
    echo "❌ 不支持的操作系统"
    exit 1
fi

echo "检测到操作系统: $OS"

# 安装fail2ban
echo ""
echo "📦 安装 fail2ban..."
if [ "$OS" = "centos" ]; then
    dnf install -y epel-release || true
    dnf install -y fail2ban fail2ban-systemd
elif [ "$OS" = "debian" ]; then
    apt-get update
    apt-get install -y fail2ban
fi

# 创建本地配置文件
echo ""
echo "⚙️  配置 fail2ban..."

# 备份原始配置
if [ -f /etc/fail2ban/jail.local ]; then
    cp /etc/fail2ban/jail.local /etc/fail2ban/jail.local.bak.$(date +%Y%m%d_%H%M%S)
fi

# 创建jail.local配置文件
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
# 禁止时间（秒）：1小时 = 3600秒
bantime = 3600

# 查找时间窗口（秒）：10分钟
findtime = 600

# 最大失败次数
maxretry = 5

# 忽略的IP地址（本地网络）
ignoreip = 127.0.0.1/8 ::1

# 邮件通知（可选）
# destemail = admin@example.com
# sendername = Fail2Ban
# mta = sendmail

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 5
bantime = 3600
findtime = 600

# 如果使用systemd日志
[sshd-systemd]
enabled = true
port = ssh
backend = systemd
maxretry = 5
bantime = 3600
findtime = 600
EOF

# 启动并启用fail2ban服务
echo ""
echo "🚀 启动 fail2ban 服务..."
systemctl enable fail2ban
systemctl restart fail2ban

# 检查服务状态
if systemctl is-active --quiet fail2ban; then
    echo "✅ fail2ban 服务已启动"
else
    echo "❌ fail2ban 服务启动失败"
    exit 1
fi

# 显示当前状态
echo ""
echo "📊 fail2ban 状态："
fail2ban-client status

echo ""
echo "📊 SSH jail 状态："
fail2ban-client status sshd 2>/dev/null || fail2ban-client status sshd-systemd 2>/dev/null || echo "SSH jail 尚未激活"

echo ""
echo "=================================================================================="
echo "✅ fail2ban 安装和配置完成！"
echo "=================================================================================="
echo ""
echo "📋 常用命令："
echo "  - 查看状态: fail2ban-client status"
echo "  - 查看SSH jail: fail2ban-client status sshd"
echo "  - 手动封禁IP: fail2ban-client set sshd banip <IP地址>"
echo "  - 手动解封IP: fail2ban-client set sshd unbanip <IP地址>"
echo "  - 查看日志: tail -f /var/log/fail2ban.log"
echo "=================================================================================="