#!/bin/bash
##############################################
# 一键配置 fail2ban - SSH 防暴力破解
# 适用于 Debian 13 (或 Debian 系)
# 用法：sudo bash setup_fail2ban.sh
##############################################

# ========== 用户可自定义参数（修改这里） ==========
SSH_PORT="ssh"              # SSH端口，若改为非标准请写数字，如 "2222"
MAXRETRY="3"                # 最大允许失败次数
BANTIME="12h"               # 封禁时长，可写 "12h" 或秒数如 "43200"
FINDTIME="3m"              # 统计时间窗口，如 "10m"（10分钟）
IGNORE_IP="127.0.0.1/8 ::1" # 白名单IP，多个用空格隔开
# =================================================

# 检查 root 权限
if [[ $EUID -ne 0 ]]; then
   echo "错误：请使用 root 用户或 sudo 运行此脚本。" 
   exit 1
fi

echo "开始配置 fail2ban..."

# 1. 安装 fail2ban（若已安装则跳过）
if ! command -v fail2ban-client &> /dev/null; then
    echo "正在安装 fail2ban..."
    apt update && apt install -y fail2ban
else
    echo "fail2ban 已安装，将更新配置。"
fi

# 2. 备份现有 jail.local（如果存在）
if [[ -f /etc/fail2ban/jail.local ]]; then
    cp /etc/fail2ban/jail.local /etc/fail2ban/jail.local.bak.$(date +%Y%m%d%H%M%S)
    echo "已备份原有 jail.local 至 /etc/fail2ban/ 下"
fi

# 3. 生成 jail.local 配置
cat > /etc/fail2ban/jail.local <<EOF
[DEFAULT]
ignoreip = ${IGNORE_IP}
bantime  = ${BANTIME}
findtime = ${FINDTIME}
maxretry = ${MAXRETRY}

[sshd]
enabled  = true
port     = ${SSH_PORT}
logpath  = %(sshd_log)s
maxretry = ${MAXRETRY}
findtime = ${FINDTIME}
bantime  = ${BANTIME}
EOF

echo "已生成 /etc/fail2ban/jail.local"

# 4. 重启 fail2ban 服务
systemctl restart fail2ban
systemctl enable fail2ban

# 5. 检查状态
echo "-------------------------------------"
echo "fail2ban 服务状态："
systemctl status fail2ban --no-pager | head -5
echo "-------------------------------------"
echo "SSH jail 状态："
fail2ban-client status sshd

echo "-------------------------------------"
echo "✅ 配置完成！"
echo "当前参数："
echo "  端口          : ${SSH_PORT}"
echo "  最大重试次数  : ${MAXRETRY}"
echo "  封禁时长      : ${BANTIME}"
echo "  统计窗口      : ${FINDTIME}"
echo "  白名单IP      : ${IGNORE_IP}"
echo ""
echo "如需修改参数，请编辑 /etc/fail2ban/jail.local 后执行 systemctl restart fail2ban"
echo "查看封禁列表：fail2ban-client status sshd | grep 'Banned IP list'"