#!/bin/bash

BASE_URL="https://autoscript.interflazz.my.id/v2"
BRAND="INTERFLAZZ.MY.ID"
WHATSAPP="https://wa.me/6285956131443"
TELEGRAM="https://t.me/interflazz"

if [ -f "/root/.vars" ]; then
    source "/root/.vars"
fi

if [ -e "/var/log/auth.log" ]; then
    LOG_FILE="/var/log/auth.log"
elif [ -e "/var/log/secure" ]; then
    LOG_FILE="/var/log/secure"
else
    echo "File log SSH tidak ditemukan."
    exit 1
fi

if [ ! -f "/etc/ssh/.ssh.db" ]; then
    mkdir -p /etc/ssh
    touch /etc/ssh/.ssh.db
fi

rm -f \
    /tmp/ssh_log_limit \
    /tmp/login-db-ssh.txt \
    /tmp/login-db-dropbear.txt \
    /tmp/login-db-pid-ssh.txt \
    /tmp/login-db-pid-dropbear.txt

touch /tmp/ssh_log_limit

cleanup() {
    rm -f \
        /tmp/ssh_log_limit \
        /tmp/login-db-ssh.txt \
        /tmp/login-db-dropbear.txt \
        /tmp/login-db-pid-ssh.txt \
        /tmp/login-db-pid-dropbear.txt
}

trap cleanup EXIT

send_telegram() {
    local message="$1"

    if [ -z "${bot_token:-}" ] || [ -z "${telegram_id:-}" ]; then
        return 1
    fi

    curl -s \
        --connect-timeout 10 \
        --max-time 20 \
        -X POST \
        "https://api.telegram.org/bot${bot_token}/sendMessage" \
        --data-urlencode "chat_id=${telegram_id}" \
        --data-urlencode "parse_mode=HTML" \
        --data-urlencode "text=${message}" \
        >/dev/null 2>&1
}

tampilkan_info_pengguna() {
    local file="$1"
    local user
    local ip_count
    local ip_limit
    local ip_list
    local account_status
    local message

    if [ ! -s "$file" ]; then
        return
    fi

    mapfile -t user_list < <(
        grep '^### ' /etc/ssh/.ssh.db 2>/dev/null |
            awk '{print $2}' |
            sort -u
    )

    for user in "${user_list[@]}"; do
        [ -z "$user" ] && continue

        ip_count=$(
            awk -v target="$user" '$2 == target {print $3}' "$file" |
                sort -u |
                grep -c .
        )

        ip_limit=$(cat "/etc/ssh/${user}" 2>/dev/null)

        if ! [[ "$ip_limit" =~ ^[0-9]+$ ]]; then
            ip_limit=0
        fi

        if [ "$ip_limit" -eq 0 ]; then
            continue
        fi

        if [ "$ip_count" -le "$ip_limit" ]; then
            continue
        fi

        ip_list=$(
            awk -v target="$user" '$2 == target {print $3}' "$file" |
                sort -u |
                paste -sd ', ' -
        )

        if id "$user" >/dev/null 2>&1; then
            account_status=$(passwd -S "$user" 2>/dev/null | awk '{print $2}')

            if [ "$account_status" != "L" ]; then
                passwd -l "$user" >/dev/null 2>&1

                message="<b>━━━━━━━━━━━━━━━━━━━━</b>
<b>INTERFLAZZ.MY.ID</b>
<b>NOTIFIKASI SSH</b>
<b>━━━━━━━━━━━━━━━━━━━━</b>

<b>🚫 MULTI LOGIN TERDETEKSI</b>

<b>👤 Username :</b> <code>${user}</code>
<b>📊 Total IP :</b> <code>${ip_count}</code>
<b>🔒 Batas IP :</b> <code>${ip_limit}</code>
<b>🌐 IP Login :</b> <code>${ip_list}</code>

<b>━━━━━━━━━━━━━━━━━━━━</b>
<b>🔐 STATUS : AKUN DIKUNCI</b>
<b>━━━━━━━━━━━━━━━━━━━━</b>

<b>INTERFLAZZ.MY.ID</b>
<b>WhatsApp :</b> ${WHATSAPP}
<b>Telegram :</b> ${TELEGRAM}"

                send_telegram "$message"
            fi
        fi
    done
}

tampilkan_info_ssh_dropbear() {
    grep -i "sshd" "$LOG_FILE" 2>/dev/null |
        grep -i "Accepted password for" \
        >/tmp/login-db-ssh.txt

    grep -i "dropbear" "$LOG_FILE" 2>/dev/null |
        grep -i "Password auth succeeded" \
        >/tmp/login-db-dropbear.txt

    mapfile -t ssh_pids < <(
        pgrep sshd 2>/dev/null
    )

    mapfile -t dropbear_pids < <(
        pgrep dropbear 2>/dev/null
    )

    for ssh_pid in "${ssh_pids[@]}"; do
        [ -z "$ssh_pid" ] && continue

        if grep -q "sshd\[$ssh_pid\]" /tmp/login-db-ssh.txt 2>/dev/null; then
            grep "sshd\[$ssh_pid\]" \
                /tmp/login-db-ssh.txt \
                >/tmp/login-db-pid-ssh.txt

            ssh_user=$(
                grep -oP '(?<=for )\w+' \
                    /tmp/login-db-pid-ssh.txt |
                    tail -1
            )

            ssh_ip=$(
                grep -oP '(?<=from )\d+\.\d+\.\d+\.\d+' \
                    /tmp/login-db-pid-ssh.txt |
                    tail -1
            )

            if [ -n "$ssh_user" ] && [ -n "$ssh_ip" ]; then
                echo "$ssh_pid $ssh_user $ssh_ip" >>/tmp/ssh_log_limit
            fi
        fi
    done

    for dropbear_pid in "${dropbear_pids[@]}"; do
        [ -z "$dropbear_pid" ] && continue

        if grep -q "dropbear\[$dropbear_pid\]" /tmp/login-db-dropbear.txt 2>/dev/null; then
            grep "dropbear\[$dropbear_pid\]" \
                /tmp/login-db-dropbear.txt \
                >/tmp/login-db-pid-dropbear.txt

            dropbear_user=$(
                grep -oP "(?<=for ')\w+(?=' from)" \
                    /tmp/login-db-pid-dropbear.txt |
                    tail -1 |
                    sed "s/'//g"
            )

            dropbear_ip=$(
                grep -oP '(?<=from )\d+\.\d+\.\d+\.\d+' \
                    /tmp/login-db-pid-dropbear.txt |
                    tail -1 |
                    cut -d ':' -f1
            )

            if [ -n "$dropbear_user" ] && [ -n "$dropbear_ip" ]; then
                echo "$dropbear_pid $dropbear_user $dropbear_ip" >>/tmp/ssh_log_limit
            fi
        fi
    done

    if [ -s /tmp/ssh_log_limit ]; then
        sort -u /tmp/ssh_log_limit -o /tmp/ssh_log_limit
        tampilkan_info_pengguna "/tmp/ssh_log_limit"
    fi
}

tampilkan_info_ssh_dropbear

exit 0