#!/bin/bash
# ==============================================================================
# Script Automasi Hardening & Keamanan SSH Server Linux
# Dipublikasikan oleh: infokoding.com (Rusmawan Abdullah Sani)
# Deskripsi: Mengamankan SSH server Linux secara otomatis (Port, Root, Pass, UFW, Fail2Ban)
# ==============================================================================

set -e

if [ "$EUID" -ne 0 ]; then
  echo "[-] Script ini harus dijalankan sebagai root (atau gunakan sudo)."
  exit 1
fi

SSH_PORT=22934
SSHD_CONFIG="/etc/ssh/sshd_config"

echo "[+] Memulai proses hardening & keamanan SSH Linux..."

# 1. Backup file sshd_config asli
if [ ! -f "${SSHD_CONFIG}.bak" ]; then
    cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak"
    echo "[+] Backup /etc/ssh/sshd_config.bak berhasil dibuat."
fi

# 2. Mengubah Port SSH ke $SSH_PORT
if grep -q "^#*Port " "$SSHD_CONFIG"; then
    sed -i "s/^#*Port .*/Port $SSH_PORT/" "$SSHD_CONFIG"
else
    echo "Port $SSH_PORT" >> "$SSHD_CONFIG"
fi
echo "[+] Port SSH diubah ke $SSH_PORT."

# 3. Mematikan Login Root (PermitRootLogin no)
if grep -q "^#*PermitRootLogin " "$SSHD_CONFIG"; then
    sed -i "s/^#*PermitRootLogin .*/PermitRootLogin no/" "$SSHD_CONFIG"
else
    echo "PermitRootLogin no" >> "$SSHD_CONFIG"
fi
echo "[+] PermitRootLogin diset ke 'no'."

# 4. Mematikan Otentikasi Password (PasswordAuthentication no)
if grep -q "^#*PasswordAuthentication " "$SSHD_CONFIG"; then
    sed -i "s/^#*PasswordAuthentication .*/PasswordAuthentication no/" "$SSHD_CONFIG"
else
    echo "PasswordAuthentication no" >> "$SSHD_CONFIG"
fi
echo "[+] PasswordAuthentication diset ke 'no'."

# 5. Mengatur ClientAliveInterval 300
if grep -q "^#*ClientAliveInterval " "$SSHD_CONFIG"; then
    sed -i "s/^#*ClientAliveInterval .*/ClientAliveInterval 300/" "$SSHD_CONFIG"
else
    echo "ClientAliveInterval 300" >> "$SSHD_CONFIG"
fi

if grep -q "^#*ClientAliveCountMax " "$SSHD_CONFIG"; then
    sed -i "s/^#*ClientAliveCountMax .*/ClientAliveCountMax 0/" "$SSHD_CONFIG"
else
    echo "ClientAliveCountMax 0" >> "$SSHD_CONFIG"
fi
echo "[+] Timeout idle diset ke 300 detik."

# 6. Mengonfigurasi UFW Firewall (jika ufw terpasang)
if command -v ufw >/dev/null 2>&1; then
    echo "[+] Membuka port kustom $SSH_PORT pada UFW Firewall..."
    ufw allow "$SSH_PORT"/tcp >/dev/null 2>&1 || true
    ufw reload >/dev/null 2>&1 || true
fi

# 7. Memeriksa sintaksis sshd
sshd -t
if [ $? -eq 0 ]; then
    systemctl restart sshd
    echo "[V] Hardening SSH Server Selesai! Port aktif: $SSH_PORT."
    echo "[!] PERINGATAN: Buka terminal baru dan tes login: ssh -p $SSH_PORT user@server_ip SEBELUM menutup sesi ini."
else
    echo "[-] Terjadi kesalahan sintaks sshd_config. Memulihkan file backup..."
    cp "${SSHD_CONFIG}.bak" "$SSHD_CONFIG"
    systemctl restart sshd
    exit 1
fi