#!/bin/bash

# 配置
NEW_PORT=10028
NEW_PASSWD="super44EE7168ee"

# 获取当前SSH端口
OLD_PORT=$(grep -E '^#?Port' /etc/ssh/sshd_config | grep -v '^#' | awk '{print $2}' | head -1)
[ -z "$OLD_PORT" ] && OLD_PORT=22

echo "当前 SSH 端口: $OLD_PORT"
echo "将修改为新端口: $NEW_PORT"
echo "将修改 root 密码为: $NEW_PASSWD"

# 修改SSH端口
sed -i "/^#Port/c\Port $NEW_PORT" /etc/ssh/sshd_config
sed -i "/^Port/c\Port $NEW_PORT" /etc/ssh/sshd_config

# 防火墙放行
if systemctl is-active --quiet firewalld; then
  firewall-cmd --permanent --add-port=${NEW_PORT}/tcp
  firewall-cmd --reload
fi

# SELinux
if command -v semanage &>/dev/null; then
  semanage port -m -t ssh_port_t -p tcp $NEW_PORT 2>/dev/null || \
  semanage port -a -t ssh_port_t -p tcp $NEW_PORT 2>/dev/null
fi

# 重启SSH
systemctl restart sshd

# 修改root密码
echo "root:$NEW_PASSWD" | chpasswd

echo -e "\n===== 修改完成 ====="
echo "SSH 新端口: $NEW_PORT"
echo "root 新密码: $NEW_PASSWD"
echo "连接方式: ssh root@IP -p $NEW_PORT"