# IDS, log monitoring, login tracking, file integrity, process auditing, and alerting
# Each function returns a bash command string that app.py executes via ssh_run()


def auth_log_cmd(lines=100):
    """Return bash cmd to get recent auth log entries (failed/successful logins)."""
    return (
        "echo '=== Recent Auth Log Entries ===' && "
        "if [ -f /var/log/auth.log ]; then "
        f"  grep -E '(Failed|Accepted|Invalid|session opened|session closed|authentication failure)' /var/log/auth.log | tail -n {lines}; "
        "elif command -v journalctl >/dev/null 2>&1; then "
        f"  journalctl -u sshd -u ssh --no-pager -n {lines} 2>&1; "
        "else "
        "  echo 'No auth.log found and journalctl not available'; "
        "fi"
    )


def login_tracker_cmd():
    """Return bash cmd to show login attempts with IP, count, and geo info."""
    return (
        "echo '=== Login Tracker: Top 20 IPs ===' && "
        "echo '' && "
        "echo '--- Failed Logins ---' && "
        "if [ -f /var/log/auth.log ]; then "
        "  FAILED_IPS=$(grep -oP 'Failed password.*from \\K[0-9.]+' /var/log/auth.log 2>/dev/null | "
        "    sort | uniq -c | sort -rn | head -20); "
        "else "
        "  FAILED_IPS=$(journalctl -u sshd -u ssh --no-pager 2>/dev/null | "
        "    grep -oP 'Failed password.*from \\K[0-9.]+' | "
        "    sort | uniq -c | sort -rn | head -20); "
        "fi && "
        "if [ -z \"$FAILED_IPS\" ]; then "
        "  echo 'No failed login attempts found'; "
        "else "
        "  echo \"$FAILED_IPS\" | while read COUNT IP; do "
        "    GEO=''; "
        "    if command -v geoiplookup >/dev/null 2>&1; then "
        "      GEO=$(geoiplookup \"$IP\" 2>/dev/null | head -1 | sed 's/GeoIP Country Edition: //'); "
        "    elif command -v whois >/dev/null 2>&1; then "
        "      GEO=$(whois \"$IP\" 2>/dev/null | grep -i -m1 'country' | awk '{print $NF}'); "
        "    fi; "
        "    printf '%6s  %-16s  %s\\n' \"$COUNT\" \"$IP\" \"$GEO\"; "
        "  done; "
        "fi && "
        "echo '' && "
        "echo '--- Accepted Logins ---' && "
        "if [ -f /var/log/auth.log ]; then "
        "  ACCEPT_IPS=$(grep -oP 'Accepted.*from \\K[0-9.]+' /var/log/auth.log 2>/dev/null | "
        "    sort | uniq -c | sort -rn | head -20); "
        "else "
        "  ACCEPT_IPS=$(journalctl -u sshd -u ssh --no-pager 2>/dev/null | "
        "    grep -oP 'Accepted.*from \\K[0-9.]+' | "
        "    sort | uniq -c | sort -rn | head -20); "
        "fi && "
        "if [ -z \"$ACCEPT_IPS\" ]; then "
        "  echo 'No accepted logins found'; "
        "else "
        "  echo \"$ACCEPT_IPS\" | while read COUNT IP; do "
        "    GEO=''; "
        "    if command -v geoiplookup >/dev/null 2>&1; then "
        "      GEO=$(geoiplookup \"$IP\" 2>/dev/null | head -1 | sed 's/GeoIP Country Edition: //'); "
        "    elif command -v whois >/dev/null 2>&1; then "
        "      GEO=$(whois \"$IP\" 2>/dev/null | grep -i -m1 'country' | awk '{print $NF}'); "
        "    fi; "
        "    printf '%6s  %-16s  %s\\n' \"$COUNT\" \"$IP\" \"$GEO\"; "
        "  done; "
        "fi"
    )


def active_sessions_cmd():
    """Return bash cmd to show who is currently logged in."""
    return (
        "echo '=== Currently Logged In ===' && "
        "w 2>&1 && "
        "echo '' && "
        "echo '=== Active Sessions (who) ===' && "
        "who 2>&1 && "
        "echo '' && "
        "echo '=== Recent Logins (last 10) ===' && "
        "last -10 2>&1"
    )


def file_integrity_check_cmd(paths="/etc /usr/bin /usr/sbin /var/www"):
    """Return bash cmd to create/check file integrity baseline."""
    db = "/var/lib/setec-integrity.db"
    return (
        f"if [ -f {db} ]; then "
        f"  echo '=== File Integrity Check (comparing to baseline) ===' && "
        f"  CURRENT=$(mktemp) && "
        f"  find {paths} -type f -exec md5sum {{}} + 2>/dev/null | sort -k2 > \"$CURRENT\" && "
        f"  BASELINE=$(sort -k2 {db}) && "
        "  echo '' && "
        "  echo '--- Modified Files ---' && "
        f"  diff <(echo \"$BASELINE\") \"$CURRENT\" 2>/dev/null | grep '^[<>]' | head -50 && "
        "  echo '' && "
        "  echo '--- New Files (not in baseline) ---' && "
        f"  comm -13 <(awk '{{print $2}}' {db} | sort) <(awk '{{print $2}}' \"$CURRENT\" | sort) | head -50 && "
        "  echo '' && "
        "  echo '--- Deleted Files (in baseline but missing) ---' && "
        f"  comm -23 <(awk '{{print $2}}' {db} | sort) <(awk '{{print $2}}' \"$CURRENT\" | sort) | head -50 && "
        "  MODIFIED=$(diff <(echo \"$BASELINE\") \"$CURRENT\" 2>/dev/null | grep -c '^[<>]' || true) && "
        "  echo '' && "
        "  echo \"Summary: $MODIFIED differences found\" && "
        "  rm -f \"$CURRENT\"; "
        "else "
        f"  echo 'No baseline found at {db}. Creating initial baseline...' && "
        f"  find {paths} -type f -exec md5sum {{}} + 2>/dev/null | sort -k2 > {db} && "
        f"  COUNT=$(wc -l < {db}) && "
        "  echo \"Baseline created with $COUNT files\"; "
        "fi"
    )


def file_integrity_init_cmd(paths="/etc /usr/bin /usr/sbin /var/www"):
    """Return bash cmd to initialize/reset the integrity baseline."""
    db = "/var/lib/setec-integrity.db"
    return (
        f"echo '=== Initializing File Integrity Baseline ===' && "
        f"mkdir -p /var/lib && "
        f"find {paths} -type f -exec md5sum {{}} + 2>/dev/null | sort -k2 > {db} && "
        f"COUNT=$(wc -l < {db}) && "
        f"echo \"Baseline created at {db} with $COUNT files\" && "
        f"echo \"Monitored paths: {paths}\""
    )


def process_audit_cmd():
    """Return bash cmd to find suspicious processes."""
    return (
        "echo '=== Process Security Audit ===' && "
        "echo '' && "
        "echo '--- Listening Ports with Processes ---' && "
        "ss -tlnp 2>&1 && "
        "echo '' && "
        "echo '--- UDP Listening Ports ---' && "
        "ss -ulnp 2>&1 && "
        "echo '' && "
        "echo '--- Processes Running as Root (non-kernel) ---' && "
        "ps aux --sort=-%mem 2>/dev/null | awk '$1==\"root\" && $11!~/^\\[/' | head -30 && "
        "echo '' && "
        "echo '--- Processes with Deleted Binaries (suspicious) ---' && "
        "ls -la /proc/*/exe 2>/dev/null | grep '(deleted)' || echo 'None found' && "
        "echo '' && "
        "echo '--- Recently Modified Binaries (last 7 days) ---' && "
        "find /usr/bin /usr/sbin /usr/local/bin -type f -mtime -7 -ls 2>/dev/null | head -30 || echo 'None found' && "
        "echo '' && "
        "echo '--- Unusual SUID/SGID Binaries ---' && "
        "find /usr/bin /usr/sbin /usr/local/bin /tmp /var/tmp -type f \\( -perm -4000 -o -perm -2000 \\) -ls 2>/dev/null | head -30 || echo 'None found'"
    )


def security_log_cmd(lines=100):
    """Return bash cmd to get combined security-relevant logs."""
    return (
        "echo '=== Combined Security Logs ===' && "
        "( "
        "  [ -f /var/log/auth.log ] && grep -E '(Failed|Accepted|Invalid|authentication failure|sudo|su:)' /var/log/auth.log 2>/dev/null; "
        "  [ -f /var/log/fail2ban.log ] && tail -50 /var/log/fail2ban.log 2>/dev/null; "
        "  [ -f /var/log/kern.log ] && grep -iE '(iptables|firewall|segfault|oom)' /var/log/kern.log 2>/dev/null; "
        "  [ -f /var/log/syslog ] && grep -iE '(security|attack|denied|unauthorized|blocked)' /var/log/syslog 2>/dev/null; "
        "  journalctl -p warning --since '24 hours ago' --no-pager 2>/dev/null | head -50; "
        f") | sort -t' ' -k1,3 2>/dev/null | tail -n {lines}"
    )


def alert_setup_cmd(email, webhook_url=""):
    """Return bash cmd to set up alert script for suspicious activity."""
    webhook_section = ""
    if webhook_url:
        webhook_section = (
            f"    if command -v curl >/dev/null 2>&1; then\\n"
            f"      curl -s -X POST -H 'Content-Type: application/json' "
            f"-d \\\"{{\\\\\\\"text\\\\\\\": \\\\\\\"$MSG\\\\\\\"}}\\\" "
            f"'{webhook_url}' >/dev/null 2>&1\\n"
            f"    fi\\n"
        )

    script = (
        "#!/bin/bash\\n"
        "# Setec Labs Security Alert Script\\n"
        "LOGFILE=/var/log/setec-alerts.log\\n"
        "STATEFILE=/var/lib/setec-alert-state\\n"
        "THRESHOLD=10\\n"
        "\\n"
        "mkdir -p /var/lib\\n"
        "touch \\\"$STATEFILE\\\" \\\"$LOGFILE\\\"\\n"
        "\\n"
        "LAST_CHECK=$(cat \\\"$STATEFILE\\\" 2>/dev/null || echo 0)\\n"
        "NOW=$(date +%s)\\n"
        "echo \\\"$NOW\\\" > \\\"$STATEFILE\\\"\\n"
        "\\n"
        "# Check failed SSH logins since last check\\n"
        "if [ -f /var/log/auth.log ]; then\\n"
        "  FAILED=$(grep 'Failed password' /var/log/auth.log 2>/dev/null | wc -l)\\n"
        "else\\n"
        "  FAILED=$(journalctl -u sshd --since '5 minutes ago' --no-pager 2>/dev/null | grep -c 'Failed password')\\n"
        "fi\\n"
        "\\n"
        "# Check fail2ban bans\\n"
        "BANS=0\\n"
        "if [ -f /var/log/fail2ban.log ]; then\\n"
        "  BANS=$(grep -c 'Ban' /var/log/fail2ban.log 2>/dev/null || echo 0)\\n"
        "fi\\n"
        "\\n"
        "# Check for new SUID files\\n"
        "NEWSUID=$(find /tmp /var/tmp /home -type f -perm -4000 2>/dev/null | wc -l)\\n"
        "\\n"
        "ALERT=0\\n"
        "MSG=\\\"\\\"\\n"
        "\\n"
        "if [ \\\"$FAILED\\\" -gt \\\"$THRESHOLD\\\" ]; then\\n"
        "  MSG=\\\"ALERT: $FAILED failed SSH login attempts detected\\\"\\n"
        "  ALERT=1\\n"
        "fi\\n"
        "\\n"
        "if [ \\\"$NEWSUID\\\" -gt 0 ]; then\\n"
        "  MSG=\\\"$MSG\\\\nALERT: $NEWSUID SUID files found in /tmp, /var/tmp, or /home\\\"\\n"
        "  ALERT=1\\n"
        "fi\\n"
        "\\n"
        "if [ \\\"$ALERT\\\" -eq 1 ]; then\\n"
        "  HOSTNAME=$(hostname)\\n"
        "  MSG=\\\"[$HOSTNAME] $(date): $MSG\\\"\\n"
        "  echo \\\"$MSG\\\" >> \\\"$LOGFILE\\\"\\n"
        f"  if command -v mail >/dev/null 2>&1; then\\n"
        f"    echo -e \\\"$MSG\\\" | mail -s \\\"Setec Security Alert: $HOSTNAME\\\" {email} 2>/dev/null\\n"
        f"  fi\\n"
        f"{webhook_section}"
        "fi\\n"
    )

    return (
        "echo '=== Setting Up Security Alerting ===' && "
        f"echo -e '{script}' > /usr/local/bin/setec-alert.sh && "
        "chmod +x /usr/local/bin/setec-alert.sh && "
        "touch /var/log/setec-alerts.log && "
        "(crontab -l 2>/dev/null | grep -v 'setec-alert.sh'; "
        "echo '*/5 * * * * /usr/local/bin/setec-alert.sh') | crontab - && "
        f"echo 'Alert script installed at /usr/local/bin/setec-alert.sh' && "
        f"echo 'Cron job added: runs every 5 minutes' && "
        f"echo 'Alert email: {email}'"
    )


def alert_status_cmd():
    """Return bash cmd to check if alerting is configured and show recent alerts."""
    return (
        "echo '=== Alert System Status ===' && "
        "echo '' && "
        "echo '--- Script ---' && "
        "if [ -f /usr/local/bin/setec-alert.sh ]; then "
        "  echo 'Alert script: INSTALLED'; "
        "  ls -la /usr/local/bin/setec-alert.sh; "
        "else "
        "  echo 'Alert script: NOT INSTALLED'; "
        "fi && "
        "echo '' && "
        "echo '--- Cron Job ---' && "
        "if crontab -l 2>/dev/null | grep -q 'setec-alert.sh'; then "
        "  echo 'Cron job: ACTIVE'; "
        "  crontab -l 2>/dev/null | grep 'setec-alert.sh'; "
        "else "
        "  echo 'Cron job: NOT FOUND'; "
        "fi && "
        "echo '' && "
        "echo '--- Recent Alerts (last 20) ---' && "
        "if [ -f /var/log/setec-alerts.log ]; then "
        "  tail -20 /var/log/setec-alerts.log; "
        "else "
        "  echo 'No alert log found'; "
        "fi"
    )


def alert_remove_cmd():
    """Return bash cmd to remove alerting."""
    return (
        "echo '=== Removing Security Alerting ===' && "
        "(crontab -l 2>/dev/null | grep -v 'setec-alert.sh') | crontab - && "
        "rm -f /usr/local/bin/setec-alert.sh && "
        "echo 'Alert script removed' && "
        "echo 'Cron job removed' && "
        "echo 'Alert log preserved at /var/log/setec-alerts.log'"
    )


def suid_audit_cmd():
    """Return bash cmd to find all SUID/SGID binaries."""
    return (
        "echo '=== SUID/SGID Binary Audit ===' && "
        "echo '' && "
        "echo '--- SUID Binaries ---' && "
        "find / -type f -perm -4000 -not -path '/proc/*' -not -path '/sys/*' -ls 2>/dev/null && "
        "echo '' && "
        "echo '--- SGID Binaries ---' && "
        "find / -type f -perm -2000 -not -path '/proc/*' -not -path '/sys/*' -ls 2>/dev/null && "
        "echo '' && "
        "SUID_COUNT=$(find / -type f -perm -4000 -not -path '/proc/*' -not -path '/sys/*' 2>/dev/null | wc -l) && "
        "SGID_COUNT=$(find / -type f -perm -2000 -not -path '/proc/*' -not -path '/sys/*' 2>/dev/null | wc -l) && "
        "echo \"Total: $SUID_COUNT SUID, $SGID_COUNT SGID binaries\""
    )


def world_writable_cmd():
    """Return bash cmd to find world-writable files/dirs."""
    return (
        "echo '=== World-Writable Files ===' && "
        "find / -type f -perm -0002 "
        "-not -path '/proc/*' -not -path '/sys/*' -not -path '/dev/*' "
        "-ls 2>/dev/null | head -50 && "
        "echo '' && "
        "echo '=== World-Writable Directories (without sticky bit) ===' && "
        "find / -type d -perm -0002 -not -perm -1000 "
        "-not -path '/proc/*' -not -path '/sys/*' -not -path '/dev/*' "
        "-ls 2>/dev/null | head -50"
    )


def cron_audit_cmd():
    """Return bash cmd to audit all cron jobs on the system."""
    return (
        "echo '=== Cron Job Audit ===' && "
        "echo '' && "
        "echo '--- System Crontab (/etc/crontab) ---' && "
        "cat /etc/crontab 2>/dev/null || echo 'Not found' && "
        "echo '' && "
        "echo '--- /etc/cron.d/ ---' && "
        "for f in /etc/cron.d/*; do "
        "  [ -f \"$f\" ] && echo \"== $f ==\" && cat \"$f\" && echo ''; "
        "done 2>/dev/null && "
        "echo '' && "
        "echo '--- /etc/cron.daily/ ---' && "
        "ls -la /etc/cron.daily/ 2>/dev/null || echo 'Not found' && "
        "echo '' && "
        "echo '--- /etc/cron.hourly/ ---' && "
        "ls -la /etc/cron.hourly/ 2>/dev/null || echo 'Not found' && "
        "echo '' && "
        "echo '--- /etc/cron.weekly/ ---' && "
        "ls -la /etc/cron.weekly/ 2>/dev/null || echo 'Not found' && "
        "echo '' && "
        "echo '--- /etc/cron.monthly/ ---' && "
        "ls -la /etc/cron.monthly/ 2>/dev/null || echo 'Not found' && "
        "echo '' && "
        "echo '--- User Crontabs ---' && "
        "for user in $(cut -f1 -d: /etc/passwd 2>/dev/null); do "
        "  CRON=$(crontab -u \"$user\" -l 2>/dev/null); "
        "  if [ -n \"$CRON\" ]; then "
        "    echo \"== $user ==\"; "
        "    echo \"$CRON\"; "
        "    echo ''; "
        "  fi; "
        "done && "
        "echo '' && "
        "echo '--- Systemd Timers ---' && "
        "systemctl list-timers --all --no-pager 2>/dev/null || echo 'systemctl not available'"
    )