#!/usr/bin/env bash
# fix_dominanostra_fail2ban_wordpress.sh  (v2 - path log robusto)
# DA ESEGUIRE SU DOMINANOSTRA (217.182.171.171) come utente con sudo.
# Crea la jail fail2ban 'wordpress' per bloccare brute-force su wp-login.php
# e abusi xmlrpc. READ-ONLY per Hermes: preparato da Hermes, eseguito da Stefano.
set -e

JAIL="/etc/fail2ban/jail.d/wordpress.local"

# Path log: default Debian/TinyCP, con verifica non-sudo (ls, non find sudo)
APACHE_LOG="/var/log/apache2/access.log"
if [ ! -f "$APACHE_LOG" ]; then
  ALT=$(ls /var/log/apache2/access.log* 2>/dev/null | head -1)
  if [ -n "$ALT" ]; then APACHE_LOG="$ALT"; fi
fi
echo "[*] Uso logpath: $APACHE_LOG"

echo "[*] Creo $JAIL ..."
sudo tee "$JAIL" >/dev/null <<EOF
[wordpress]
enabled  = true
port     = http,https,80,443
filter   = wordpress
logpath  = $APACHE_LOG
maxretry = 5
findtime = 10m
bantime  = 1h
backend  = auto
EOF
sudo chmod 0644 "$JAIL"

# Filtro wordpress: crealo solo se manca
if [ ! -f /etc/fail2ban/filter.d/wordpress.conf ]; then
  echo "[*] filtro wordpress.conf assente, lo creo..."
  sudo tee /etc/fail2ban/filter.d/wordpress.conf >/dev/null <<'FEOF'
[Definition]
failregex = ^<HOST> -.*"(GET|POST) /wp-login.php.*" 200
            ^<HOST> -.*"(GET|POST) /xmlrpc.php.*" 200
            ^<HOST> -.*"POST /wp-login.php.*" 403
ignoreregex =
FEOF
  sudo chmod 0644 /etc/fail2ban/filter.d/wordpress.conf
else
  echo "[*] filtro wordpress.conf gia' presente, ok"
fi

echo "[*] Ricarico fail2ban..."
sudo systemctl restart fail2ban

echo "[*] Verifica jail wordpress:"
sudo fail2ban-client status wordpress || echo "  jail non attiva, riprova tra 5s"

echo "[*] FATTO. Brute-force wp-login.php bannati dopo 5 fail (1h)."
echo "[*] Extra (non automatico): nascondere readme.html via .htaccess:"
echo '      <Files readme.html> Require all denied </Files>'