#!/bin/bash

function Help()
{
	echo "om_chgsshalglevel.sh [-h] | [-s level]: set the security level of the SSH service encryption algorithm suite. -s specify the level, which can be default(default algorithm suite), safe(AES256-CTR, HMAC-SHA2-256, DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA256, SSH-ED25519, SSH-ED25519-CERT-V01@openssh.com, RSA-SHA2-256, and RSA-SHA2-512)."
	return 0
}

function sendAlarm()
{
    local USER_NAME=""
    local USER_IP=""
    local LEVEL=""
    local ERR_CODE=$2
    local PARAM=""
    local ALM_ID=""

    USER_NAME=$(who am i | awk -F "[ ]" '{print $1}')
    USER_IP=$(who am i | awk -F "[()]" '{print $2}')

	if [ "$1" == "default" ]; then
		LEVEL=1
	else
		LEVEL=0
	fi

    if [ -z $ERR_CODE ]; then
    	ALM_ID="35248850206831"
    	PARAM="$USER_NAME:$USER_IP,$LEVEL"
    else
    	ALM_ID="35248850206830"
    	PARAM="$USER_NAME:$USER_IP,$LEVEL,$ERR_CODE"
    fi

(
diagnose --auto &>/dev/null <<EOF
AlarmSendLongCmd sendLongAlarm $ALM_ID 0 $PARAM
quit
EOF
)|grep -vE "^Attach AppId<.*> success$|^..*:/diagnose>attach 12$"
	
	return 0;
}

KexAlgorithmsDefault="ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1"
KexAlgorithmsSafe="curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256"

CiphersDefault="aes128-ctr,aes192-ctr,aes256-ctr"
CiphersSafe="aes128-ctr,aes192-ctr,aes256-ctr"

MACsDefault="hmac-sha2-256,hmac-sha1"
MACsSafe="hmac-sha2-256,hmac-sha2-512"

function SetAlgLevel()
{
	local SSHD_CONF_FILE=/etc/ssh/sshd_config
	local SSH_ALG_CONF=/startup_disk/conf/conf_local/sshalg.conf

	if [ "$1" != "default" -a "$1" != "safe" ]; then
		echo "$1 para error"
		Help
		sendAlarm $1 0x3000003
		return 1
	fi

	cp ${SSHD_CONF_FILE} ${SSHD_CONF_FILE}.bak -f

	# default euler sshd alg
	if [ "$1" == "default" ]; then
		sed -i "/^KexAlgorithms/c KexAlgorithms $KexAlgorithmsDefault" ${SSHD_CONF_FILE}
		sed -i "/^MACs/c MACs $MACsDefault" ${SSHD_CONF_FILE}
		sed -i "/^Ciphers/c Ciphers $CiphersDefault" ${SSHD_CONF_FILE}
		
		echo "KexAlgorithms $KexAlgorithmsDefault" > $SSH_ALG_CONF
		echo "MACs $MACsDefault" >> $SSH_ALG_CONF
		echo "Ciphers $CiphersDefault" >> $SSH_ALG_CONF
	# product secure sshd alg
	elif [ "$1" == "safe" ]; then
		echo "You are about to set the encryption algorithm suite level of the SSH service to secure algorithms. This suite will remove non-secure encryption algorithms. This will lead to:"
		echo "1) Tools that do not support secure encryption algorithms, such as PuTTY, cannot be used to log in to the storage device."
		echo "2) The SUSE 11 and Red Hat 6 operating systems that do not support the secure encryption algorithm cannot be used to log in to the storage device."
		echo "3) Some import and export functions of the CLI are invalid, such as exporting performance statistics files and importing/exporting licenses."
		echo "Suggestion:"
		echo "1) Upgrade the PuTTY version."
		echo "2) Upgrade SUSE 11 and Red Hat 6."
		echo "3) Restore the default algorithm and run the related CLI commands."
		read -p "Have you read warning message carefully?(y/n)" CHOICE
		if [ -z ${CHOICE} ] || [ ${CHOICE} != "Y" -a ${CHOICE} != "y" ]; then
			exit 0
		fi
		sed -i "/^KexAlgorithms/c KexAlgorithms $KexAlgorithmsSafe" ${SSHD_CONF_FILE}
		sed -i "/^MACs/c MACs $MACsSafe" ${SSHD_CONF_FILE}
		sed -i "/^Ciphers/c Ciphers $CiphersSafe" ${SSHD_CONF_FILE}
		
		echo "KexAlgorithms $KexAlgorithmsSafe" > $SSH_ALG_CONF
		echo "MACs $MACsSafe" >> $SSH_ALG_CONF
		echo "Ciphers $CiphersSafe" >> $SSH_ALG_CONF
	fi

	systemctl restart sshd

	echo "Succeed in setting the security of the SSH service encryption algorithm suite to level $1."
	sendAlarm $1
	return 0
}

while getopts "hs:" options
do
	case "$options" in
		h)
			Help
			ret=$?
			;;
        s)
            SetAlgLevel $OPTARG
            ret=$?
            ;;
		*)
			Help
			ret=1
			;;
	esac
done

exit $ret


