clear
#CheckIfRoot
if [ "$EUID" -ne 0 ]
  then echo "Please run as root!"
  exit  
fi
echo 'Prepare system' 
if [ -n "`which apt-get`" ]; then OS="Ubuntu"; clear;
elif [ -n "`which yum`" ]; then OS="CentOS"; clear;
fi

#Read Imformation From The User
echo "Welcome to Fail2ban!"
echo "--------------------"
echo "This Shell Script can protect your server from SSH attacks with the help of Fail2ban and iptables"
echo ""

while :; do echo
  read -p "Do you want to change your SSH Port? [y/n]: " IfChangeSSHPort
  if [ ${IfChangeSSHPort} == 'y' ]; then
    if [ -e "/etc/ssh/sshd_config" ];then
    [ -z "`grep ^Port /etc/ssh/sshd_config`" ] && ssh_port=22 || ssh_port=`grep ^Port /etc/ssh/sshd_config | awk '{print $2}'`
    while :; do echo
        read -p "Please input SSH port(Default: $ssh_port): " SSH_PORT
        [ -z "$SSH_PORT" ] && SSH_PORT=$ssh_port
        if [ $SSH_PORT -eq 22 >/dev/null 2>&1 -o $SSH_PORT -gt 1024 >/dev/null 2>&1 -a $SSH_PORT -lt 65535 >/dev/null 2>&1 ];then
            break
        else
            echo "${CWARNING}input error! Input range: 22,1025~65534${CEND}"
        fi
    done
    if [ -z "`grep ^Port /etc/ssh/sshd_config`" -a "$SSH_PORT" != '22' ];then
        sed -i "s@^#Port.*@&\nPort $SSH_PORT@" /etc/ssh/sshd_config
    elif [ -n "`grep ^Port /etc/ssh/sshd_config`" ];then
        sed -i "s@^Port.*@Port $SSH_PORT@" /etc/ssh/sshd_config
    fi
    fi
    break
  elif [ ${IfChangeSSHPort} == 'n' ]; then
    break
  else
    echo "${CWARNING}Input error! Please only input y or n!${CEND}"
  fi
done
ssh_port=$SSH_PORT
echo ""
	read -p "Input the attempts limit [2-10] (def 3):  " maxretry
echo ""
read -p "Input the lasting time for blocking a IP [hours] (def 24h):  " bantime
if [ ${maxretry} == ""]; then
	maxretry=3
fi
if [ ${bantime} == ""];then
	bantime=24
fi
((bantime=$bantime*60*60))
#Install
if [ ${OS} == CentOS ]; then
  yum -y install epel-release
  yum -y install fail2ban
fi

if [ ${OS} == Ubuntu ] || [ ${OS} == Debian ];then
  apt-get -y update
  apt-get -y install fail2ban
fi

#Configure
rm -rf /etc/fail2ban/jail.local
touch /etc/fail2ban/jail.local
if [ ${OS} == CentOS ]; then
cat <<EOF >> /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 86400
maxretry = 3
findtime = 1800

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/secure
maxretry = $maxretry
findtime = 3600
bantime = $bantime

[astra-iptables]
enabled = true
filter = astra
action = iptables[name=astra, port=8000, protocol=tcp]
logpath = /var/log/astra.log
maxretry = $maxretry
findtime = 3600
bantime = $bantime
EOF
else
cat <<EOF >> /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 86400
maxretry = $maxretry
findtime = 1800

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/auth.log
maxretry = $maxretry
findtime = 3600
bantime = $bantime

[astra-iptables]
enabled = true
filter = astra
action = iptables[name=astra, port=8000, protocol=tcp]
logpath = /var/log/astra.log
maxretry = $maxretry
findtime = 3600
bantime = $bantime
EOF
fi
rm -f /etc/fail2ban/filter.d/astra.conf
cat <<EOF >> /etc/fail2ban/filter.d/astra.conf
[Definition]
failregex = .*Authentication failed. Login:.*IP:<HOST>
ignoreregex =
EOF

#Start
if [ ${OS} == CentOS ]; then
    systemctl restart fail2ban
    systemctl enable fail2ban
    chkconfig fail2ban on
  fi
if [[ ${OS} =~ ^Ubuntu$|^Debian$ ]]; then
  service fail2ban restart
fi

#Finish
echo "Finish Installing ! Reboot the sshd now !"

if [ ${OS} == CentOS ]; then
    systemctl restart sshd
    service sshd restart
  fi
if [[ ${OS} =~ ^Ubuntu$|^Debian$ ]]; then
  service ssh restart
fi
echo ""

echo "Fail2ban is now runing on this server now!"
