Set up SSH bastion host with jump server configuration for secure network access

#!/usr/bin/env bash

set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
SCRIPT_NAME="$(basename "$0")"
SSH_PORT="${1:-2222}"
BASTION_USERS=("bastion-admin" "bastion-dev")

# Usage
usage() {
    echo "Usage: $SCRIPT_NAME [SSH_PORT]"
    echo "  SSH_PORT: Custom SSH port (default: 2222)"
    echo ""
    echo "Example: $SCRIPT_NAME 2222"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    log_error "Installation failed. Performing cleanup..."
    systemctl stop sshd 2>/dev/null || true
    if [ -f /etc/ssh/sshd_config.backup ]; then
        mv /etc/ssh/sshd_config.backup /etc/ssh/sshd_config
    fi
}

trap cleanup ERR

# Validate arguments
if [[ $# -gt 1 ]] || [[ "${1:-}" =~ ^(-h|--help)$ ]]; then
    usage
fi

if ! [[ "$SSH_PORT" =~ ^[0-9]+$ ]] || [ "$SSH_PORT" -lt 1024 ] || [ "$SSH_PORT" -gt 65535 ]; then
    log_error "Invalid SSH port. Must be between 1024-65535"
    exit 1
fi

# Check prerequisites
echo "[1/10] Checking prerequisites..."
if [ "$EUID" -ne 0 ]; then
    log_error "This script must be run as root"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            FIREWALL_CMD="ufw"
            SERVICE_MGR="systemctl"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            FIREWALL_CMD="firewall-cmd"
            SERVICE_MGR="systemctl"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            FIREWALL_CMD="firewall-cmd"
            SERVICE_MGR="systemctl"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution"
    exit 1
fi

log_info "Detected distribution: $ID"

# Update system and install packages
echo "[2/10] Updating system and installing packages..."
$PKG_UPDATE

if [ "$PKG_MGR" = "apt" ]; then
    $PKG_INSTALL openssh-server fail2ban ufw
else
    $PKG_INSTALL openssh-server fail2ban firewalld
fi

# Create bastion user accounts
echo "[3/10] Creating bastion user accounts..."
for user in "${BASTION_USERS[@]}"; do
    if ! id "$user" &>/dev/null; then
        useradd -m -s /bin/bash "$user"
        log_info "Created user: $user"
    else
        log_warn "User $user already exists"
    fi
    
    mkdir -p "/home/$user/.ssh"
    chmod 700 "/home/$user/.ssh"
    chown "$user:$user" "/home/$user/.ssh"
    touch "/home/$user/.ssh/authorized_keys"
    chmod 600 "/home/$user/.ssh/authorized_keys"
    chown "$user:$user" "/home/$user/.ssh/authorized_keys"
done

# Backup SSH config
echo "[4/10] Configuring SSH server..."
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# Configure SSH hardening
cat > /etc/ssh/sshd_config << EOF
Port $SSH_PORT
Protocol 2
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes

ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
MaxStartups 3:30:10

AllowUsers ${BASTION_USERS[*]}

X11Forwarding no
AllowTcpForwarding yes
GatewayPorts no
PermitTunnel no

SyslogFacility AUTH
LogLevel VERBOSE

Banner /etc/ssh/banner
EOF

# Create SSH banner
echo "[5/10] Creating SSH banner..."
cat > /etc/ssh/banner << 'EOF'
#######################################################################
#                      AUTHORIZED ACCESS ONLY                        #
#                                                                     #
#  This system is for authorized users only. All activities are      #
#  monitored and logged. Unauthorized access is strictly prohibited. #
#######################################################################
EOF

# Create bastion session script
echo "[6/10] Creating session logging script..."
mkdir -p /usr/local/bin /var/log/bastion-sessions
cat > /usr/local/bin/bastion-session << 'EOF'
#!/bin/bash
SESSION_LOG="/var/log/bastion-sessions/$(whoami)-$(date +%Y%m%d-%H%M%S).log"
echo "Session started: $(date)" >> "$SESSION_LOG"
echo "User: $(whoami)" >> "$SESSION_LOG"
echo "Client: ${SSH_CLIENT:-unknown}" >> "$SESSION_LOG"
echo "Command: $SSH_ORIGINAL_COMMAND" >> "$SESSION_LOG"
echo "---" >> "$SESSION_LOG"

if [ -n "$SSH_ORIGINAL_COMMAND" ]; then
    echo "$SSH_ORIGINAL_COMMAND" >> "$SESSION_LOG"
    exec $SSH_ORIGINAL_COMMAND
else
    script -a -f "$SESSION_LOG" -c /bin/bash
fi
EOF

chmod 755 /usr/local/bin/bastion-session

# Configure user shells
echo "[7/10] Configuring user shells..."
for user in "${BASTION_USERS[@]}"; do
    chsh -s /usr/local/bin/bastion-session "$user"
done

# Configure Fail2ban
echo "[8/10] Configuring Fail2ban..."
cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = $SSH_PORT
logpath = /var/log/auth.log
EOF

# Configure firewall
echo "[9/10] Configuring firewall..."
if [ "$FIREWALL_CMD" = "ufw" ]; then
    ufw --force reset
    ufw default deny incoming
    ufw default allow outgoing
    ufw allow "$SSH_PORT"/tcp
    ufw --force enable
else
    systemctl enable --now firewalld
    firewall-cmd --permanent --remove-service=ssh 2>/dev/null || true
    firewall-cmd --permanent --add-port="$SSH_PORT"/tcp
    firewall-cmd --reload
fi

# Start and enable services
systemctl enable --now sshd
systemctl enable --now fail2ban

# Test SSH configuration
echo "[10/10] Verifying configuration..."
if ! sshd -t; then
    log_error "SSH configuration test failed"
    exit 1
fi

systemctl restart sshd

# Final checks
if ! systemctl is-active --quiet sshd; then
    log_error "SSH service is not running"
    exit 1
fi

if ! systemctl is-active --quiet fail2ban; then
    log_error "Fail2ban service is not running"
    exit 1
fi

if ! ss -tuln | grep -q ":$SSH_PORT"; then
    log_error "SSH is not listening on port $SSH_PORT"
    exit 1
fi

log_info "SSH Bastion host setup completed successfully!"
echo ""
echo "Next steps:"
echo "1. Add SSH public keys to user authorized_keys files:"
for user in "${BASTION_USERS[@]}"; do
    echo "   sudo tee /home/$user/.ssh/authorized_keys < your_public_key.pub"
done
echo ""
echo "2. Test connection: ssh -p $SSH_PORT username@$(hostname -I | awk '{print $1}')"
echo "3. Configure client SSH config for ProxyJump"
echo ""
echo "Logs located at:"
echo "- SSH auth: /var/log/auth.log"
echo "- Session logs: /var/log/bastion-sessions/"
echo "- Fail2ban: sudo fail2ban-client status sshd"