#!/bin/bash

# 服务器SSH配置检查脚本
# 请在服务器上运行此脚本来检查SSH配置

echo "=========================================="
echo "服务器SSH配置检查"
echo "=========================================="
echo ""

# 检查SSH服务状态
echo "1. 检查SSH服务状态..."
if systemctl is-active --quiet sshd || systemctl is-active --quiet ssh; then
    echo "✅ SSH服务正在运行"
    systemctl status sshd 2>/dev/null || systemctl status ssh 2>/dev/null | head -5
else
    echo "❌ SSH服务未运行"
    echo "启动命令: systemctl start sshd 或 systemctl start ssh"
fi
echo ""

# 检查SSH端口监听
echo "2. 检查SSH端口监听..."
if netstat -tlnp 2>/dev/null | grep -E ':22\s' || ss -tlnp 2>/dev/null | grep -E ':22\s'; then
    echo "✅ SSH正在监听端口22"
    netstat -tlnp 2>/dev/null | grep :22 || ss -tlnp 2>/dev/null | grep :22
else
    echo "❌ SSH未监听端口22"
fi
echo ""

# 检查防火墙状态
echo "3. 检查防火墙状态..."
if command -v ufw &> /dev/null; then
    echo "UFW防火墙状态:"
    ufw status
    echo ""
    echo "如果22端口未开放，运行: ufw allow 22/tcp"
elif command -v firewall-cmd &> /dev/null; then
    echo "firewalld防火墙状态:"
    firewall-cmd --list-all
    echo ""
    echo "如果22端口未开放，运行: firewall-cmd --permanent --add-service=ssh && firewall-cmd --reload"
elif command -v iptables &> /dev/null; then
    echo "iptables规则:"
    iptables -L -n | grep -E '22|ssh' || echo "未找到SSH相关规则"
    echo ""
    echo "如果22端口未开放，运行: iptables -A INPUT -p tcp --dport 22 -j ACCEPT"
else
    echo "未检测到防火墙工具"
fi
echo ""

# 检查SSH配置文件
echo "4. 检查SSH配置文件..."
if [ -f /etc/ssh/sshd_config ]; then
    echo "SSH配置文件: /etc/ssh/sshd_config"
    echo "端口配置:"
    grep -E "^Port|^#Port" /etc/ssh/sshd_config | head -1
    echo "允许root登录:"
    grep -E "^PermitRootLogin|^#PermitRootLogin" /etc/ssh/sshd_config | head -1
    echo ""
    echo "如果需要修改配置，编辑后运行: systemctl restart sshd"
else
    echo "❌ 未找到SSH配置文件"
fi
echo ""

# 检查网络接口
echo "5. 检查网络接口..."
ip addr show | grep -E "inet " | head -5
echo ""

# 检查云服务器安全组（提示）
echo "=========================================="
echo "重要提示："
echo "=========================================="
echo "如果是云服务器，还需要检查："
echo "1. 云控制台的安全组规则 - 确保开放22端口"
echo "2. 云控制台的防火墙规则 - 确保允许SSH连接"
echo "3. 如果使用阿里云/腾讯云等，检查安全组入站规则"
echo "=========================================="