#!/bin/bash

TOKEN="8101319618:AAHboFVVgmLPccJB0MDr_R2g0K90hkGqkRw"
CHAT_ID="581059353"

PIS=("192.168.178.2" "192.168.178.3" "localhost")

STATE_FILE="/home/kai/.ssh-monitor-lastcheck"

if [ ! -f "$STATE_FILE" ]; then
    date --iso-8601=seconds > "$STATE_FILE"
fi

LAST_CHECK=$(cat "$STATE_FILE")
NOW=$(date --iso-8601=seconds)

for PI in "${PIS[@]}"
do
    if [ "$PI" == "localhost" ]; then
        LOG=$(journalctl -u ssh --since "$LAST_CHECK" --no-pager)
        HOST=$(hostname)
    else
        LOG=$(ssh -o ConnectTimeout=5 kai@$PI \
        "journalctl -u ssh --since \"$LAST_CHECK\" --no-pager")

        HOST=$(ssh kai@$PI hostname)
    fi

    FAILS=$(echo "$LOG" | grep "Failed password" | wc -l)

    if [ "$FAILS" -gt 0 ]; then

        IPS=$(echo "$LOG" | grep "Failed password" \
        | awk '{print $(NF-3)}' \
        | sort | uniq -c | sort -nr)

        MESSAGE="🚨 SSH Angriff erkannt!
Host: $HOST ($PI)
Fehlversuche: $FAILS

Top Angreifer:
$IPS"

        curl -s -X POST "https://api.telegram.org/bot$TOKEN/sendMessage" \
        -d chat_id="$CHAT_ID" \
        -d text="$MESSAGE"
    fi
done

echo "$NOW" > "$STATE_FILE"