#!/bin/bash
#################################################################################
## DenyHosts installer by TheLinuxBug version 0.1k - Debian Installer          ##
#################################################################################
## 0.1a - Initial version                                                      ##
## 0.1b - Added prompts for e-mail address and modifying config                ##
## 0.1c - Code Cleanup assisted by CodyR, added yum check for wget             ##
## 0.1d - Removed downloaded configs and added prompts for important variables ##
## 0.1e - Cleaned up prompts and added extra instructions                      ##
## 0.1f - Cleaned up a lot of buggy code, added EDITOR variable                ##
## 0.1g - Fixed regex problem with entering log name (Thanks to CodyR)         ##
## 0.1h - Updated variable EDITOR to detect preset variable, changed symlink   ##
##        code for linking the service (Thanks to siska for his help)          ##
## 0.1i - Updated code from new CentOS version to work with Debian sepcific    ##
##        configurations. Also added a few other tweaks.                       ##
## 0.1j - Changed it to user service denyhosts restart to start to prevent     ##
##        error messages when reconfiguring the service with this script.      ##
## 0.1k - Added variable $initdfile, controlfile editor is now $EDITOR         ##
#################################################################################

echo "Welcome to Denyhosts installer 0.1k - Debian installer"
echo "Note: if for some reason you do not get the configurations correct on first run, you can re-run this anytime to reconfigure."
echo ""
echo "Press any key to begin install..."
read -n 1

#Let's set the path for bash and some other variables
export PATH=/bin:/usr/bin:/usr/local/bin:/sbin
configfile=/usr/share/denyhosts/denyhosts.cfg
controlfile=/usr/share/denyhosts/daemon-control
initdfile=/etc/init.d/denyhosts
[ -z "$EDITOR" ] && EDITOR="vi"

#Let's make sure all needed packages are installed
echo "Making sure that prerequisites are installed..."
apt-get -q -y install python wget unzip > /dev/null 2>&1

#Successful?
if [ ${?} -ne 0 ]; then
	echo "Failed to install required packages, exiting"
	exit 1
fi

#Let's set the tmp directory
TMPDIR=$(mktemp -d)

#Let's download DenyHosts
echo "Downloading DenyHosts from sourceforge..."
wget -O ${TMPDIR}/DenyHosts-2.6.tar.gz "http://sourceforge.net/projects/denyhosts/files/denyhosts/2.6/DenyHosts-2.6.tar.gz/download#" --no-check-certificate
tar -zxvf ${TMPDIR}/DenyHosts-2.6.tar.gz -C ${TMPDIR}

#Time to install
echo "Installing DenyHosts..."
cd ${TMPDIR}/DenyHosts-2.6/ ; python setup.py install
cd -

#Let's put the default configuration files in place
cp -a /usr/share/denyhosts/daemon-control-dist $controlfile
cp -a /usr/share/denyhosts/denyhosts.cfg-dist $configfile

#Let's clear the screen before moving forward
echo "Press any key to continue..."
read -n 1
clear

#We are going to now make initial changes to the config file
# Change the e-mail address that notices are being sent to
echo "This section will let you change some of the default configuration values, entering nothing at the prompts will retain default settings"
echo ""
echo "What e-mail address do you want notices sent to? Example: james@smith.com (Leaving blank will cause it not to send e-mails)"
read input
if [ -z "$input" ] ; then
    echo "Not setting an e-mail address...you will not receive e-mails..."
  else
    sed -i "s/ADMIN_EMAIL =/ADMIN_EMAIL = $input/g" $configfile
fi

# Change the location of the secure log
echo ""
echo "SECURE_LOG: the log file that contains sshd logging info"
echo "In most cases on Debian this is /var/log/auth.log"
read securelog
if [ -z "$securelog" ] ; then
    echo "Default settings left in place"
  else
    echo "Setting SECURE_LOG = $securelog"
    sed -i "s+SECURE_LOG = /var/log/secure+SECURE_LOG = $securelog+g" $configfile
fi

#Change the DENY_THRESHOLD_INVALID
echo ""
echo "DENY_THRESHOLD_INVALID: block each host after the number of failed login attempts has exceeded this value."
echo "The default is 5 if left unchanged"
read denyinvalid
if [ -z "$denyinvalid" ] ; then
    echo "Default settings left in place"
  else
    echo "Setting DENY_THRESHOLD_INVALID = $denyinvalid"
    sed -i "s/DENY_THRESHOLD_INVALID = 5/DENY_THRESHOLD_INVALID = $denyinvalid/g" $configfile
fi

#Change the PURGE_THRESHOLD
echo ""
echo "PURGE_THRESHOLD: defines the maximum times a host will be purged."
echo "The default is to not set a maximum, I suggest setting this to a number from 2-5"
read pthresh
if [ -z "$pthresh" ] ; then
    echo "Default settings left in place"
  else
    echo "Setting PURGE_THRESHOLD = $pthresh"
    sed -i "s/#PURGE_THRESHOLD = 2/PURGE_THRESHOLD = $pthresh/g" $configfile
fi

#Change the DENY_THRESHOLD_ROOT
echo ""
echo "DENY_THRESHOLD_ROOT: block each host after the number of failed login attempts has exceeded this value for root."
echo "The default is 1, I usually use 3"
read dthresh
if [ -z "$dthresh" ] ; then
    echo "Default settings left in place"
  else
    echo "Setting DENY_THRESHOLD_ROOT = $dthresh"
    sed -i "s/DENY_THRESHOLD_ROOT = 1/DENY_THRESHOLD_ROOT = $dthresh/g" $configfile
fi

#Change the DENY_THRESHOLD_ROOT
echo ""
echo "DENY_THRESHOLD_ROOT: block each host after the number of failed login attempts has exceeded this value for root."
echo "The default is 1, I usually use 3"
read dthresh
if [ -z "$dthresh" ] ; then
    echo "Default settings left in place"
  else
    echo "Setting DENY_THRESHOLD_ROOT = $dthresh"
    sed -i "s/DENY_THRESHOLD_ROOT = 1/DENY_THRESHOLD_ROOT = $dthresh/g" $configfile
fi

#Change the SMTP_FROM
echo ""
echo "SMTP_FROM: you can specify the From: address in messages sent from DenyHosts when it reports thwarted abuse attempts."
echo "The default is DenyHosts <nobody@localhost> - Just enter the e-mail address below:"
read smtpf
if [ -z "$smtpf" ] ; then
    echo "Default settings left in place"
  else
    echo "Setting SMTP_FROM = DenyHosts <$smtpf>"
    sed -i "s/SMTP_FROM = DenyHosts <nobody@localhost>/SMTP_FROM = DenyHosts <$smtpf>/g" $configfile
fi

# Let's create the symlink to the daemon-control file, it requires we cd to the /etc/init.d directory first or will not work.
echo "Making changes for compatibility with Debian.."
sed -i "s+DENYHOSTS_BIN   = \"/usr/bin/denyhosts.py\"+DENYHOSTS_BIN   = \"/usr/local/bin/denyhosts.py\"+g" $controlfile
sed -i "s+DENYHOSTS_LOCK  = \"/var/lock/subsys/denyhosts\"+DENYHOSTS_LOCK  = \"/var/run/denyhosts.pid\"+g" $controlfile
sed -i "s+LOCK_FILE = /var/lock/subsys/denyhosts+LOCK_FILE = /var/run/denyhosts.pid+g" $configfile
ln -sf $controlfile $initdfile

# Now we are going to setup denyhosts as a service so we can set it to start at server boot
echo "Setting up Denyhosts to start at boot..."
chkconfig --add denyhosts

#Lets see if they want to add a host to /etc/hosts.allow
echo ""
echo "You should add a host which you always want to be allowed to connect just in case of problems"
echo "Would you like to add a host now? [Y/N]?"
read host
  if [ "$host" = "Y" ] || [ "$host" = "y" ] ; then
    echo "Please type the ip you would like to add to the hosts.allow:"
    read allow
      if [ -z "$allow" ] ; then
        echo "No host was sepcified..so not adding any hosts"
      else
        echo "SSHD: $allow" >> /etc/hosts.allow
        echo "Added $allow to the hosts.allow"
        echo "Press any key to continue..."
        read -n 1
      fi
  else
    echo "Skipping adding of ip to of hosts.allow"
  fi
#Now that everything is installed and running, lets see if they want to make any changes to the config file
clear
echo "Please remember to check /usr/share/denyhosts/denyhosts.cfg to insure it is setup how you would like"
echo "You may also wish to check the settings in the daemon-control file, depending on your install you may have to make some modifications to this file for things to work"
echo "Press any key to continue..."
read -n 1

#Now lets allow them to edit the configuration files
echo "Would you like to modify the config file now? [Y/N]"
read config
  if [ "$config" = "Y" ] || [ "$config" = "y" ] ; then
    $EDITOR $configfile
    #Let's give the user a chance to modify the daemon-control script
    clear
    echo "Would you like to modify the daemon-control file now? [Y/N]"
    read control
    if [ "$control" = "Y" ] || [ "$control" = "y" ] ; then
      $EDITOR $controlfile
      echo "Cleaning up...."
      rm -rf ${TMPDIR}
      #Now lets start DenyHosts
      echo "Starting denyhosts for the first time..."
      service denyhosts restart
      exit 0;
    else
      echo "Cleaning up...."
      rm -rf ${TMPDIR}
      #Now lets start DenyHosts
      echo "Starting denyhosts for the first time..."
      service denyhosts restart
      exit 0;
    fi
  else
    #Let's give the user a chance to modify the daemon-control script
    echo "Would you like to modify the daemon-control file now? [Y/N]"
    read control
    if [ "$control" = "Y" ] || [ "$control" = "y" ] ; then
      $EDITOR $controlfile
      echo "Cleaning up...."
      rm -rf ${TMPDIR}
      #Now lets start DenyHosts
      echo "Starting denyhosts for the first time..."
      /usr/sbin/service denyhosts restart
      exit 0;
    else
      echo "Cleaning up...."
      rm -rf ${TMPDIR}
      #Now lets start DenyHosts
      echo "Starting denyhosts for the first time..."
      /usr/sbin/service denyhosts restart
      exit 0;
    fi
  fi
