setup-ssh-admin.sh

#!/usr/bin/env bash
set -euo pipefail

# 用法:
#   sudo chmod +x setup-ssh-admin.sh
#   sudo ./setup-ssh-admin.sh [用户名，默认 root]
#
# 警告:
#   1. 此脚本会修改 SSH 配置并设置密码，存在安全风险，请仅在受信任网络使用。
#   2. 建议使用强密码，并在配置完成后考虑改用密钥登录。
#   3. 操作前会自动备份 /etc/ssh/sshd_config。

ADMIN_USER="${1:-root}"
SSHD_CONFIG="/etc/ssh/sshd_config"
BACKUP_SUFFIX=".bak.$(date +%Y%m%d%H%M%S)"

if [[ "$EUID" -ne 0 ]]; then
    echo "错误: 此脚本需要 root 权限，请使用 sudo 运行。"
    exit 1
fi

echo ""
echo "========================================"
echo "警告: 即将启用 $ADMIN_USER 的 SSH 密码登录"
echo "========================================"
echo ""
echo "这会带来以下影响:"
echo "  - 如未安装，会自动安装 OpenSSH 服务器"
echo "  - 修改 $SSHD_CONFIG"
echo "  - 设置/修改 $ADMIN_USER 的密码"
echo "  - 重启 SSH 服务"
echo ""
read -rp "确定要继续吗? (yes/no): " CONFIRM
if [[ "$CONFIRM" != "yes" ]]; then
    echo "已取消操作。"
    exit 0
fi

# 安装 OpenSSH 服务器
install_ssh_server() {
    echo "==> 检查并安装 OpenSSH 服务器..."

    if command -v sshd &>/dev/null && [[ -f "$SSHD_CONFIG" ]]; then
        echo "==> OpenSSH 服务器已安装。"
        return 0
    fi

    if command -v apt-get &>/dev/null; then
        apt-get update
        apt-get install -y openssh-server
    elif command -v dnf &>/dev/null; then
        dnf install -y openssh-server
    elif command -v yum &>/dev/null; then
        yum install -y openssh-server
    elif command -v pacman &>/dev/null; then
        pacman -S --noconfirm openssh
    elif command -v zypper &>/dev/null; then
        zypper install -y openssh
    else
        echo "错误: 无法识别包管理器，请手动安装 openssh-server。"
        exit 1
    fi

    # 启用并启动服务
    if command -v systemctl &>/dev/null; then
        systemctl enable sshd 2>/dev/null || systemctl enable ssh 2>/dev/null || true
        systemctl start sshd 2>/dev/null || systemctl start ssh 2>/dev/null || true
    elif command -v service &>/dev/null; then
        service sshd start 2>/dev/null || service ssh start 2>/dev/null || true
    fi
}

install_ssh_server

# 备份原配置
echo "==> 备份 $SSHD_CONFIG ..."
cp "$SSHD_CONFIG" "${SSHD_CONFIG}${BACKUP_SUFFIX}"

# 设置/修改密码
echo "==> 设置 $ADMIN_USER 的密码..."
if [[ "$ADMIN_USER" == "root" ]]; then
    passwd
else
    passwd "$ADMIN_USER"
fi

# 修改 SSH 配置
echo "==> 修改 SSH 配置..."

# 确保配置项存在，先注释掉所有旧的，再追加新的
sed -i 's/^[[:space:]]*#*[[:space:]]*PermitRootLogin.*/#PermitRootLogin commented by script/' "$SSHD_CONFIG" || true
sed -i 's/^[[:space:]]*#*[[:space:]]*PasswordAuthentication.*/#PasswordAuthentication commented by script/' "$SSHD_CONFIG" || true
sed -i 's/^[[:space:]]*#*[[:space:]]*ChallengeResponseAuthentication.*/#ChallengeResponseAuthentication commented by script/' "$SSHD_CONFIG" || true
sed -i 's/^[[:space:]]*#*[[:space:]]*UsePAM.*/#UsePAM commented by script/' "$SSHD_CONFIG" || true

cat >> "$SSHD_CONFIG" <<EOF

# Added by setup-ssh-admin.sh
PasswordAuthentication yes
ChallengeResponseAuthentication yes
UsePAM yes
EOF

if [[ "$ADMIN_USER" == "root" ]]; then
    cat >> "$SSHD_CONFIG" <<EOF
PermitRootLogin yes
EOF
else
    cat >> "$SSHD_CONFIG" <<EOF
PermitRootLogin prohibit-password
EOF
fi

# 重启 SSH 服务
echo "==> 重启 SSH 服务..."
if command -v systemctl &>/dev/null; then
    systemctl restart sshd || systemctl restart ssh
elif command -v service &>/dev/null; then
    service sshd restart || service ssh restart
else
    echo "警告: 无法自动重启 SSH 服务，请手动重启。"
    exit 1
fi

echo ""
echo "==> SSH 配置完成。"
echo "备份文件: ${SSHD_CONFIG}${BACKUP_SUFFIX}"
echo ""
echo "当前生效配置:"
sshd -T 2>/dev/null | grep -E '^(permitrootlogin|passwordauthentication|challengeresponseauthentication|usepam)' || true