# !/bin/bash
# ████████╗░█████╗░██╗░░██╗░█████╗░██╗░░░██╗██████╗░███╗░░██╗
# ╚══██╔══╝██╔══██╗██║░██╔╝██╔══██╗██║░░░██║██╔══██╗████╗░██║
# ░░░██║░░░██║░░██║█████═╝░██║░░██║╚██╗░██╔╝██████╔╝██╔██╗██║
# ░░░██║░░░██║░░██║██╔═██╗░██║░░██║░╚████╔╝░██╔═══╝░██║╚████║
# ░░░██║░░░╚█████╔╝██║░╚██╗╚█████╔╝░░╚██╔╝░░██║░░░░░██║░╚███║
# ░░░╚═╝░░░░╚════╝░╚═╝░░╚═╝░╚════╝░░░░╚═╝░░░╚═╝░░░░░╚═╝░░╚══╝

function send_log() {
DOMAIN_PART=$(cut -d '.' -f1 /etc/xray/domain | tr '[:lower:]' '[:upper:]')
FULL_DOMAIN=$(cat /etc/xray/domain)

# Cek apakah DOMAIN mengandung "SG"
if [[ "$DOMAIN_PART" == *"SG"* ]]; then
    FLAG="🇸🇬"
else
    FLAG="🇮🇩"
fi

# Konfigurasi informasi Telegram
CHATID=$(grep -E "^#bot# " "/etc/bot/.bot.db" | cut -d ' ' -f 3)
KEY=$(grep -E "^#bot# " "/etc/bot/.bot.db" | cut -d ' ' -f 2)
TIMEOUT="10"
URL="https://api.telegram.org/bot$KEY/sendMessage"
TEXT="
──────────────────────
🚫 Notifikasi Multilogin SSHWS
──────────────────────
<blockquote><code>SERVER $DOMAIN_PART $FLAG</code></blockquote>
<code>User  :</code> <code>$1</code>
<code>Login :</code> <code>$2 IP</code>
<code>Limit :</code> <code>$3 IP</code>
────────────────────── 
Notif "$4"X Multilogin: 3X Autolock
────────────────────── "

# Kirim pesan ke Telegram
# curl -s --max-time "$TIMEOUT" -d "chat_id=$CHATID&disable_web_page_preview=1&text=$TEXT&parse_mode=HTML&reply_to_message_id=2485" "$URL" >/dev/null
curl -s --max-time "$TIMEOUT" -d "chat_id=$CHATID&disable_web_page_preview=1&text=$TEXT&parse_mode=html" $URL >/dev/null
}

function send_logx() {
DOMAIN_PART=$(cut -d '.' -f1 /etc/xray/domain | tr '[:lower:]' '[:upper:]')
FULL_DOMAIN=$(cat /etc/xray/domain)

# Cek apakah DOMAIN mengandung "SG"
if [[ "$DOMAIN_PART" == *"SG"* ]]; then
    FLAG="🇸🇬"
else
    FLAG="🇮🇩"
fi

# Konfigurasi informasi Telegram
CHATID=$(grep -E "^#bot# " "/etc/bot/.bot.db" | cut -d ' ' -f 3)
KEY=$(grep -E "^#bot# " "/etc/bot/.bot.db" | cut -d ' ' -f 2)
TIMEOUT="10"
URL="https://api.telegram.org/bot$KEY/sendMessage"
TEXT="
──────────────────────
🚫 Notifikasi Multilogin SSHWS
──────────────────────
<blockquote><code>SERVER $DOMAIN_PART $FLAG</code></blockquote>
<code>User  :</code> <code>$1</code>
<code>Login :</code> <code>$2 IP</code>
<code>Limit :</code> <code>$3 IP</code>
────────────────────── 
Notif 3X Multilogin: Lock 15 Menit
────────────────────── "

# Kirim pesan ke Telegram
# curl -s --max-time "$TIMEOUT" -d "chat_id=$CHATID&disable_web_page_preview=1&text=$TEXT&parse_mode=HTML&reply_to_message_id=2485" "$URL" >/dev/null
curl -s --max-time "$TIMEOUT" -d "chat_id=$CHATID&disable_web_page_preview=1&text=$TEXT&parse_mode=html" $URL >/dev/null
}

function send_logx() {
DOMAIN_PART=$(cut -d '.' -f1 /etc/xray/domain | tr '[:lower:]' '[:upper:]')
FULL_DOMAIN=$(cat /etc/xray/domain)

# Cek apakah DOMAIN mengandung "SG"
if [[ "$DOMAIN_PART" == *"SG"* ]]; then
    FLAG="🇸🇬"
else
    FLAG="🇮🇩"
fi

# Konfigurasi informasi Telegram
CHATID=$(grep -E "^#bot# " "/etc/bot/.bot.db" | cut -d ' ' -f 3)
KEY=$(grep -E "^#bot# " "/etc/bot/.bot.db" | cut -d ' ' -f 2)
TIMEOUT="10"
URL="https://api.telegram.org/bot$KEY/sendMessage"
TEXT="
──────────────────────
🚫 Notifikasi Multilogin SSHWS
──────────────────────
<blockquote><code>SERVER $DOMAIN_PART $FLAG</code></blockquote>
<code>User  :</code> <code>$1</code>
<code>Login :</code> <code>$2 IP</code>
<code>Limit :</code> <code>$3 IP</code>
────────────────────── 
Notif 4X Multilogin: Locked!
────────────────────── "

# Kirim pesan ke Telegram
# curl -s --max-time "$TIMEOUT" -d "chat_id=$CHATID&disable_web_page_preview=1&text=$TEXT&parse_mode=HTML&reply_to_message_id=2485" "$URL" >/dev/null
curl -s --max-time "$TIMEOUT" -d "chat_id=$CHATID&disable_web_page_preview=1&text=$TEXT&parse_mode=html" $URL >/dev/null
}

# Menentukan file log berdasarkan OS yang digunakan
if [ -e "/var/log/auth.log" ]; then
    OS=1;
    LOG="/var/log/auth.log";
elif [ -e "/var/log/secure" ]; then
    OS=2;
    LOG="/var/log/secure";
else
    echo "Log file tidak ditemukan.";
    exit 1;
fi

while true; do
    echo "Memulai proses monitoring SSHWS."
    # Mendapatkan daftar pengguna
    cat /etc/passwd | grep "/home/" | cut -d":" -f1 > /tmp/userssh.txt
    username1=( `cat "/tmp/userssh.txt" `);
    i="0";
    for user in "${username1[@]}"
    do
        username[$i]=`echo $user | sed 's/'\''//g'`;
        jumlah[$i]=0;
        i=$i+1;
    done

    # Array untuk menyimpan kombinasi unik user dan IP
    declare -A login_session

    # Memproses pengguna dari file log Dropbear
    grep -i "Password auth succeeded" "$LOG" | grep -i dropbear > /tmp/log-db.txt
    for PID in $(ps aux | grep -i dropbear | awk '{print $2}'); do
        if grep -q "dropbear\[$PID\]" /tmp/log-db.txt; then
            USER=$(grep "dropbear\[$PID\]" /tmp/log-db.txt | awk '{print $10}' | sed 's/'\''//g')
            IP=$(grep "dropbear\[$PID\]" /tmp/log-db.txt | awk '{print $12}')

            if [[ -z "${login_session[$USER-$IP]}" ]]; then
                for i in "${!username[@]}"; do
                    if [[ "${username[$i]}" == "$USER" ]]; then
                        jumlah[$i]=$((jumlah[$i] + 1))
                        pid[$i]+="$PID "
                    fi
                done
                login_session["$USER-$IP"]=1
            fi
        fi
    done

    # Memproses pengguna dari file log SSHD
    grep -i "Accepted password for" "$LOG" | grep -i sshd > /tmp/log-db.txt
    for PID in $(ps aux | grep "\[priv\]" | awk '{print $2}'); do
        if grep -q "sshd\[$PID\]" /tmp/log-db.txt; then
            USER=$(grep "sshd\[$PID\]" /tmp/log-db.txt | awk '{print $9}')
            IP=$(grep "sshd\[$PID\]" /tmp/log-db.txt | awk '{print $11}')

            if [[ -z "${login_session[$USER-$IP]}" ]]; then
                for i in "${!username[@]}"; do
                    if [[ "${username[$i]}" == "$USER" ]]; then
                        jumlah[$i]=$((jumlah[$i] + 1))
                        pid[$i]+="$PID "
                    fi
                done
                login_session["$USER-$IP"]=1
            fi
        fi
    done

    for i in ${!username[*]}
    do
        if [ -e "/etc/kyt/limit/ssh/ip/${username[$i]}" ]; then
            iplimit=$(cat /etc/kyt/limit/ssh/ip/${username[$i]})
            MAX=$((iplimit * 2))
        else
            MAX=2
            echo "2" > /etc/kyt/limit/ssh/ip/${username[$i]}
        fi

        if [ "$MAX" -eq 0 ]; then
            MAX=2
            echo "2" > /etc/kyt/limit/ssh/ip/${username[$i]}
        fi

        STATUS=$(passwd -S ${username[$i]} | awk '{print $2}')
        if [ "$STATUS" == "L" ]; then
        echo "User ${username[$i]} terkunci, melewati proses."
        continue
        fi

        echo "Memproses User : [Login: ${jumlah[$i]}, Limit: $((MAX / 2))] ${username[$i]}"
        if [ ${jumlah[$i]} -gt $MAX ]; then

            echo "${username[$i]}" >> /tmp/lockipssh.txt

            if [[ $(grep -c "${username[$i]}" /tmp/lockipssh.txt) -gt 3 ]]; then
            
            echo "Lock ${username[$i]} 4X Multilogin."
            passwd -l ${username[$i]};
            sed -i "/${username[$i]}/d" /tmp/lockipssh.txt
            send_logxx "${username[$i]}" "${jumlah[$i]}" "$((MAX / 2))"
            echo "Notifikasi terkirim ke telegram."

            if [ ${jumlah[$i]} -gt 5 ]; then
            truncate -s 0 /var/log/auth.log
            systemctl restart ssh > /dev/null 2>&1;
            systemctl restart sshd > /dev/null 2>&1;
            # systemctl restart ws > /dev/null 2>&1;
            fi

            if [ $OS -eq 1 ]; then
                systemctl restart ssh > /dev/null 2>&1;
            elif [ $OS -eq 2 ]; then
                systemctl restart sshd > /dev/null 2>&1;
            fi

            continue
            fi

            if [[ $(grep -c "${username[$i]}" /tmp/lockipssh.txt) -gt 2 ]]; then
            
            echo "User ${username[$i]} melebihi batas login, unlock 15 menit."
            echo "unlocklimitip ssh ${username[$i]}" | at now + 15 minutes &> /dev/null
            passwd -l ${username[$i]};
            send_logx "${username[$i]}" "${jumlah[$i]}" "$((MAX / 2))"
            echo "Notifikasi terkirim ke telegram."

            if [ ${jumlah[$i]} -gt 5 ]; then
            truncate -s 0 /var/log/auth.log
            systemctl restart ssh > /dev/null 2>&1;
            systemctl restart sshd > /dev/null 2>&1;
            # systemctl restart ws > /dev/null 2>&1;
            fi

            if [ $OS -eq 1 ]; then
                systemctl restart ssh > /dev/null 2>&1;
            elif [ $OS -eq 2 ]; then
                systemctl restart sshd > /dev/null 2>&1;
            fi

            continue
            fi

            echo "User ${username[$i]} melebihi batas login, send notif!"
            jumx=$(grep -c "${username[$i]}" /tmp/lockipssh.txt)
            send_log "${username[$i]}" "${jumlah[$i]}" "$((MAX / 2))" "$jumx"

            if [ ${jumlah[$i]} -gt 5 ]; then
            truncate -s 0 /var/log/auth.log
            systemctl restart ssh > /dev/null 2>&1;
            systemctl restart sshd > /dev/null 2>&1;
            # systemctl restart ws > /dev/null 2>&1;
            fi

            if [ $OS -eq 1 ]; then
                systemctl restart ssh > /dev/null 2>&1;
            elif [ $OS -eq 2 ]; then
                systemctl restart sshd > /dev/null 2>&1;
            fi

            jumlah[$i]=0;
            pid[$i]="";
        fi
        sleep 2
    done

    echo "Siklus monitoring selesai. sleep 120 detik!"
    sleep 120
done