sshmonitor

#!/bin/bash

CONFIG="/opt/ssh-monitor/config.json"
SERVICE="ssh-monitor"

case "$1" in
    start)
        echo "Activation..."
        systemctl start "$SERVICE"
        ;;

    stop)
        echo "Désactivation..."
        systemctl stop "$SERVICE"
        ;;

    restart)
        echo "Redémarrage..."
        systemctl restart "$SERVICE"
        ;;

    status)
        get_version() {
            local f="$1"
            if [ ! -f "$f" ]; then
                echo ""
                return
            fi
            # read file, strip CRLF
            local content
            content=$(tr -d '\r' < "$f")

            if echo "$content" | grep -q "="; then
                echo "$content" | sed -n 's/^[[:space:]]*[Vv]ersion[[:space:]]*=\s*//p' | head -n1
            else
                echo "$content" | head -n1
            fi
        }

        ver=$(get_version /opt/ssh-monitor/version.txt)
        if [ -n "$ver" ]; then
            echo "Version: $ver"
        else
            echo "Version: inconnue"
        fi

        systemctl status "$SERVICE"
        ;;

    user)
        echo "Utilisateurs connectés :"

        python3 - <<'PY'
import subprocess, time, datetime, re
out = subprocess.check_output(['who','-u']).decode(errors='ignore')
now = time.time()
for line in out.splitlines():
    parts = line.split()
    if not parts: continue
    user = parts[0]
    # try to find host in parentheses
    host = ''
    for p in parts:
        if p.startswith('(') and p.endswith(')'):
            host = p[1:-1]
            break
    # find time token HH:MM and optional date YYYY-MM-DD
    time_token = None
    date_token = None
    for p in parts[1:]:
        if re.match(r'^\d{2}:\d{2}$', p) and time_token is None:
            time_token = p
        if re.match(r'^\d{4}-\d{2}-\d{2}$', p) and date_token is None:
            date_token = p
    if not time_token:
        # fallback: try second token
        if len(parts) > 2:
            time_token = parts[2]
    if not time_token:
        continue
    if not date_token:
        date_token = datetime.date.today().isoformat()
        dt = datetime.datetime.fromisoformat(date_token + ' ' + time_token)
        ts = dt.timestamp()
        if ts > now + 12*3600:
            dt -= datetime.timedelta(days=1)
            ts = dt.timestamp()
    else:
        dt = datetime.datetime.fromisoformat(date_token + ' ' + time_token)
        ts = dt.timestamp()
    dur = int(now - ts)
    h = dur // 3600
    m = (dur % 3600) // 60
    target = host if host else (parts[1] if len(parts) > 1 else '')
    print(f"{user}\t{target}\t{date_token} {time_token}\t{h:02d}h{m:02d}m")
PY
        ;;

    version)
        get_version() {
            local f="$1"
            if [ ! -f "$f" ]; then
                echo ""
                return
            fi
            local content
            content=$(tr -d '\r' < "$f")
            if echo "$content" | grep -q "="; then
                echo "$content" | sed -n 's/^[[:space:]]*[Vv]ersion[[:space:]]*=\s*//p' | head -n1
            else
                echo "$content" | head -n1
            fi
        }

        ver=$(get_version /opt/ssh-monitor/version.txt)
        if [ -z "$ver" ] && [ -f ./version.txt ]; then
            ver=$(get_version ./version.txt)
        fi

        if [ -n "$ver" ]; then
            echo "Version: $ver"
        else
            echo "Version introuvable."
        fi
        ;;

    add)
        if [ -z "$2" ]; then
            echo "Usage: sshmonitor add <ip>"
            exit 1
        fi

        if ! [[ "$2" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
            echo "Adresse IP invalide."
            exit 1
        fi

        jq --arg ip "$2" '
            if .whitelist | index($ip)
            then .
            else .whitelist += [$ip]
            end
        ' "$CONFIG" > /tmp/config.json && mv /tmp/config.json "$CONFIG"

        echo "IP $2 ajoutée à la whitelist."
        ;;

    remove)
        if [ -z "$2" ]; then
            echo "Usage: sshmonitor remove <ip>"
            exit 1
        fi

        jq --arg ip "$2" '
            .whitelist |= map(select(. != $ip))
        ' "$CONFIG" > /tmp/config.json && mv /tmp/config.json "$CONFIG"

        echo "IP $2 supprimée de la whitelist."
        ;;

    list)
        echo "Whitelist :"
        jq -r '.whitelist[]' "$CONFIG"
        ;;

    *)
        echo "Usage:"
        echo "  sshmonitor start           # start the service"
        echo "  sshmonitor stop            # stop the service"
        echo "  sshmonitor restart         # restart the service"
        echo "  sshmonitor status          # show service status and installed version"
        echo "  sshmonitor user            # list connected users with login time and duration"
        echo "  sshmonitor version         # show installed version"
        echo "  sshmonitor add <ip>        # add IP to whitelist"
        echo "  sshmonitor remove <ip>     # remove IP from whitelist"
        echo "  sshmonitor list            # display whitelist"
        exit 1
        ;;
esac