# Additional materials:
# https://andreyex.ru/linux/komandy-linux-i-komandy-shell/bash-heredoc/ - usage of heredoc
# Telegram - checking of curl command syntax (can be changed)
# Made by 

#!/bin/bash


# base options
PATHTOFAILCONF="/etc/fail2ban/jail.local"
PATHTOBOT="/etc/profile.d/spytrick.sh"

# install depend (need to wright check nad if statement)
apt-get install curl 
apt-get install wget
apt-get install fail2ban
apt-get install sudo # used for install sysdig sometimes not installed :))
apt-get install -y gnupg2 gnupg gnupg1 # used for install sysdig


# clear config files 
clear ()
{
	> $PATHTOFAILCONF
	> $PATHTOBOT
}

# fail2ban config for ssh
configfile ()
{
tee -a $PATHTOFAILCONF <<-"EOF"
[ssh]
enabled = true
port = ssh
filter = sshd
action = iptables[name=sshd, port=ssh, protocol=tcp]
logpath = /var/log/auth.log
maxretry = 2
bantime = 1800

[ssh-ddos]
enabled = true
port = ssh
filter = sshd-ddos
logpath = /var/log/auth.log
maxretry = 2
EOF
}

enableservice ()
{
	systemctl enable fail2ban
	systemctl restart fail2ban
}

# config file for bot (install in /etc/profile.d)
botfile ()
{
tee -a $PATHTOBOT <<-"EOF"
#!/bin/bash
TOKEN='1322235264:AAE7QI-f1GtAF_huVz8E5IBdb5JbWIIiGKI'
MSG_URL='https://api.telegram.org/bot'$TOKEN'/sendMessage'
ID_MSG='1121093080'
gg=$(who) #получаем список сессий
hostname=$(hostname)
lastlog=$(lastlog | grep -E "1")

trap '' INT TSTP

send_message ()
{
  res=$(curl -s -X POST $MSG_URL -d chat_id=$ID_MSG -d text="HOST:$hostname KEYWORD:$item DATA:$lastlog" &)
}

echo -n "Enter your ID "

read item

case $item in
    *) echo "Done"
       send_message
esac
EOF

}

# sysdig install
sysdig ()
{
curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | sudo apt-key add -
curl -s -o /etc/apt/sources.list.d/draios.list https://s3.amazonaws.com/download.draios.com/stable/deb/draios.list
apt-get update
apt-get -y install sysdig
}



main ()
{
    clear
    configfile
    enableservice
    botfile
    #sysdig
}

main
