alpha 0.1

lib/ssh.sh

@@ -0,0 +1,48 @@
+secure_ssh() {
+    CONF="/etc/ssh/sshd_config"
+    PROFILE="/opt/server-ultimate/config/ssh-hardening.conf"
+
+    SNAP=$(backup_create ssh "$CONF")
+
+    echo ""
+    read -p "Отключить вход по паролю? (y/N): " DISABLE_PASS
+
+    if [[ "$DISABLE_PASS" == "y" ]]; then
+        confirm_ssh_key_works || {
+            err "Ключ не подтверждён. Операция отменена."
+            pause
+            return
+        }
+    fi
+
+    # Удаляем старые параметры
+    sed -i '/^PermitRootLogin/d
+            /^PasswordAuthentication/d
+            /^PubkeyAuthentication/d
+            /^MaxAuthTries/d
+            /^ClientAliveInterval/d
+            /^ClientAliveCountMax/d
+            /^X11Forwarding/d
+            /^AllowTcpForwarding/d
+            /^TCPKeepAlive/d
+            /^UseDNS/d' "$CONF"
+
+    # Применяем профиль
+    cat "$PROFILE" >> "$CONF"
+
+    # Пароль — по выбору
+    if [[ "$DISABLE_PASS" != "y" ]]; then
+        sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/' "$CONF"
+    fi
+
+    if sshd -t; then
+        systemctl restart sshd
+        log "SSH security профиль применён"
+    else
+        err "Ошибка SSH → rollback"
+        cp "$SNAP/sshd_config" "$CONF"
+        systemctl restart sshd
+    fi
+
+    pause
+}