#!/bin/sh
# Run as root on a customer-owned Ubuntu, Debian or CentOS host.
set -eu

if [ "$(id -u)" -ne 0 ]; then echo '请使用 sudo sh audit-account.sh'; exit 1; fi
if ! command -v sshd >/dev/null 2>&1; then echo '未找到 OpenSSH 服务器 sshd'; exit 1; fi

printf '临时审计用户名（仅小写字母、数字、下划线；默认 idc_audit）：'
read -r AUDIT_USER
AUDIT_USER=${AUDIT_USER:-idc_audit}
case "$AUDIT_USER" in *[!a-z0-9_]*|'') echo '用户名格式不正确'; exit 1;; esac
if id "$AUDIT_USER" >/dev/null 2>&1; then echo '用户名已存在，请换一个'; exit 1; fi
printf '临时密码（输入时不显示）：'
stty -echo
read -r AUDIT_PASS
stty echo
printf '\n'
if [ "${#AUDIT_PASS}" -lt 16 ]; then echo '密码至少 16 位'; exit 1; fi

AUDIT_SCRIPT="/usr/local/sbin/idc-readonly-audit-${AUDIT_USER}"
AUDIT_CONFIG=/etc/ssh/sshd_config
AUDIT_MARK="# IDC_AUDIT_${AUDIT_USER}"
if grep -Fq "$AUDIT_MARK" "$AUDIT_CONFIG"; then echo '此用户名已有审计配置'; exit 1; fi

cat > "$AUDIT_SCRIPT" <<'EOF'
#!/bin/sh
# Fixed read-only diagnostics. Ignore SSH_ORIGINAL_COMMAND.
PATH=/usr/sbin:/usr/bin:/sbin:/bin
printf 'IDC_AUDIT_V1\n'
printf 'hostname='; hostname 2>/dev/null | head -c 120; printf '\n'
printf 'kernel='; uname -r 2>/dev/null | head -c 120; printf '\n'
if [ -r /etc/os-release ]; then
  printf 'os='; sed -n 's/^PRETTY_NAME="\{0,1\}\([^"]*\)"\{0,1\}$/\1/p' /etc/os-release | head -1 | head -c 160; printf '\n'
fi
printf 'uid='; id -u
printf 'listening_tcp='; (ss -lnt 2>/dev/null || netstat -lnt 2>/dev/null || true) | tail -n +2 | head -30 | tr '\n' ';'; printf '\n'
printf 'ssh_config_readable='; if [ -r /etc/ssh/sshd_config ]; then printf 'yes\n'; else printf 'no\n'; fi
printf 'END_IDC_AUDIT_V1\n'
EOF
chmod 755 "$AUDIT_SCRIPT"
useradd -M -s /bin/sh "$AUDIT_USER"
printf '%s:%s\n' "$AUDIT_USER" "$AUDIT_PASS" | chpasswd
chage -E "$(date -d '+2 days' +%Y-%m-%d)" "$AUDIT_USER"
unset AUDIT_PASS

cp "$AUDIT_CONFIG" "${AUDIT_CONFIG}.idc-audit-backup-$(date +%Y%m%d%H%M%S)"
cat >> "$AUDIT_CONFIG" <<EOF

$AUDIT_MARK
Match User $AUDIT_USER
    ForceCommand $AUDIT_SCRIPT
    PasswordAuthentication yes
    PermitTTY no
    AllowTcpForwarding no
    AllowAgentForwarding no
    AllowStreamLocalForwarding no
    X11Forwarding no
    PermitTunnel no
    GatewayPorts no
# END_IDC_AUDIT_${AUDIT_USER}
EOF

if ! sshd -t; then
  sed -i.bak "/^$AUDIT_MARK/,/^# END_IDC_AUDIT_${AUDIT_USER}/d" "$AUDIT_CONFIG"
  userdel "$AUDIT_USER"
  rm -f "$AUDIT_SCRIPT"
  echo 'sshd 配置检查失败，已回滚账户及配置；请检查 sshd_config'
  exit 1
fi
if command -v systemctl >/dev/null 2>&1; then
  systemctl reload sshd 2>/dev/null || systemctl reload ssh
else
  service sshd reload 2>/dev/null || service ssh reload
fi
printf '\n账号创建成功。服务器 SSH 主机密钥指纹：\n'
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub -E sha256 2>/dev/null || true
printf '\n审计结束后删除账号：\n'
printf "sudo userdel '%s' && sudo sed -i.bak '/^# IDC_AUDIT_%s/,/^# END_IDC_AUDIT_%s/d' /etc/ssh/sshd_config && sudo sshd -t && (sudo systemctl reload sshd || sudo systemctl reload ssh) && sudo rm -f '/usr/local/sbin/idc-readonly-audit-%s'\n" "$AUDIT_USER" "$AUDIT_USER" "$AUDIT_USER" "$AUDIT_USER"
printf '账号会在约 48 小时后自动过期；仍需执行上面的删除命令清理配置。\n'