# Collect critical system configurations
sudo tar czf /tmp/sysconfig.tar.gz \
  /etc/ssh/sshd_config \
  /etc/sudoers \
  /etc/security/limits.conf \
  /etc/pam.d/ \
  /etc/sysctl.conf \
  /etc/fstab \
  /etc/crontab \
  /var/log/auth.log

import subprocess
import json

def collect_security_logs(hours=24):
    """Collect logs from the last N hours"""
    since = f"{hours} hours ago"
    logs = {}
    
    # SSH authentication logs
    result = subprocess.run(
        ["journalctl", "--since", since, 
         "-u", "sshd", "--no-pager"],
        capture_output=True, text=True
    )
    logs["ssh_auth"] = result.stdout.splitlines()
    
    # Failed login attempts
    failed = [l for l in logs["ssh_auth"] if "Failed" in l]
    logs["failed_logins"] = failed
    
    # Unusual login times
    logs["suspicious_hours"] = [
        l for l in logs["ssh_auth"]
        if any(h in l for h in ["02:", "03:", "04:"])
    ]
    
    return logs

#!/bin/bash
# ai-vuln-scanner.sh - Automated vulnerability detection script

echo "=== VPS Security Vulnerability Scan ==="
echo "Time: $(date)"
echo ""

# 1. Check outdated packages
echo "[1/5] Checking outdated packages..."
apt list --upgradable 2>/dev/null | grep -v "^Listing" > /tmp/outdated.txt
if [ -s /tmp/outdated.txt ]; then
    echo "Found $(wc -l < /tmp/outdated.txt) upgradable packages"
    cat /tmp/outdated.txt
else
    echo "✓ All packages are up to date"
fi

# 2. Check SSH configuration weaknesses
echo ""
echo "[2/5] Checking SSH configuration..."
ssh_config=$(cat /etc/ssh/sshd_config 2>/dev/null)
weaknesses=""

if echo "$ssh_config" | grep -q "PermitRootLogin yes"; then
    weaknesses="$weaknesses\n  ⚠ Root login enabled"
fi
if echo "$ssh_config" | grep -q "PasswordAuthentication yes"; then
    weaknesses="$weaknesses\n  ⚠ Password authentication enabled"
fi
if echo "$ssh_config" | grep -q "Port 22"; then
    weaknesses="$weaknesses\n  ⚠ Using default SSH port"
fi

if [ -n "$weaknesses" ]; then
    echo "Found the following weaknesses:$weaknesses"
else
    echo "✓ SSH configuration is good"
fi

# 3. Check open ports
echo ""
echo "[3/5] Checking open ports..."
ss -tlnp 2>/dev/null | grep LISTEN > /tmp/open_ports.txt
echo "Open ports:"
cat /tmp/open_ports.txt

# 4. Check firewall rules
echo ""
echo "[4/5] Checking firewall status..."
ufw status 2>/dev/null || iptables -L -n 2>/dev/null | head -20

# 5. Check file integrity
echo ""
echo "[5/5] Checking critical file integrity..."
for f in /etc/passwd /etc/shadow /etc/hosts /etc/crontab; do
    if [ -f "$f" ]; then
        md5sum "$f" >> /tmp/file_checksums.txt
        echo "  ✓ $f (MD5: $(md5sum "$f" | cut -d' ' -f1))"
    fi
done

echo ""
echo "=== Scan Complete ==="
echo "Sending results to AI for detailed analysis..."

import requests

def generate_audit_report(log_data, config_issues, vuln_results):
    """Generate AI-driven security audit report"""
    
    prompt = f"""You are a senior Linux security expert. Based on the following VPS audit data, generate a detailed security assessment report.

## Issues Found

### SSH Configuration Weaknesses
{config_issues}

### Suspicious Login Activity
{log_data.get('failed_logins', [])[:10]}

### Outdated Packages
{vuln_results.get('outdated_packages', [])}

### Open Ports
{vuln_results.get('open_ports', [])}

## Please output the report in the following format:

### 📊 Security Score
Give a score from 0-100 with reasoning

### 🔴 Critical Issues (Immediate Action Required)
List all issues needing immediate fix

### 🟡 Medium Issues (Recommended for Near-term Fix)
List configurations recommended for optimization

### 🟢 Low Risk Items
List items that can be improved gradually

### 🛠 Remediation Steps
Provide specific command-line fixes for each issue

### 📋 Continuous Monitoring Recommendations
Recommended monitoring items and alert rules"""

    # Call AI API (using OpenRouter as example)
    response = requests.post(
        "https://openrouter.ai/api/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {API_KEY}",
            "HTTP-Referer": "https://selfvps.net",
            "X-Title": "VPS Security Audit"
        },
        json={
            "model": "meta-llama/llama-3.1-8b-instruct:free",
            "messages": [{"role": "user", "content": prompt}]
        }
    )
    
    return response.json()["choices"][0]["message"]["content"]

#!/bin/bash
# /opt/ai-security-audit/run-audit.sh

AUDIT_DIR="/var/lib/security-audit/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$AUDIT_DIR"

echo "🔍 Starting VPS security audit..."
echo "📁 Report directory: $AUDIT_DIR"

# 1. System information collection
uname -a > "$AUDIT_DIR/system_info.txt"
hostnamectl >> "$AUDIT_DIR/system_info.txt"
df -h >> "$AUDIT_DIR/system_info.txt"
free -h >> "$AUDIT_DIR/system_info.txt"
uptime >> "$AUDIT_DIR/system_info.txt"

# 2. User account audit
echo "=== User Accounts ===" > "$AUDIT_DIR/users.txt"
awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $3, $6, $7}' /etc/passwd >> "$AUDIT_DIR/users.txt"
echo "=== Privileged Users ===" >> "$AUDIT_DIR/users.txt"
awk -F: '$3 == 0 {print $1, $3}' /etc/passwd >> "$AUDIT_DIR/users.txt"

# 3. Network status
echo "=== Listening Ports ===" > "$AUDIT_DIR/network.txt"
ss -tlnp >> "$AUDIT_DIR/network.txt"
echo "=== Connection Stats ===" >> "$AUDIT_DIR/network.txt"
ss -s >> "$AUDIT_DIR/network.txt"

# 4. Service status
echo "=== Running Services ===" > "$AUDIT_DIR/services.txt"
systemctl list-units --type=service --state=running >> "$AUDIT_DIR/services.txt"

# 5. Security logs
echo "=== Recent Logins ===" > "$AUDIT_DIR/login_history.txt"
last -20 >> "$AUDIT_DIR/login_history.txt"
echo "=== Failed Logins ===" >> "$AUDIT_DIR/login_history.txt"
journalctl -u sshd --since "24 hours ago" --no-pager 2>/dev/null | grep "Failed" >> "$AUDIT_DIR/login_history.txt"

# 6. File permission checks
echo "=== World-writable Files ===" > "$AUDIT_DIR/world_writable.txt"
find /etc -perm -o+w -type f 2>/dev/null >> "$AUDIT_DIR/world_writable.txt"
echo "=== SUID Files ===" >> "$AUDIT_DIR/world_writable.txt"
find / -perm -4000 -type f 2>/dev/null >> "$AUDIT_DIR/world_writable.txt"

echo "✅ Data collection complete, generating report..."

# 7. Compress data
tar czf "$AUDIT_DIR/data.tar.gz" -C "$AUDIT_DIR" .

echo "📦 Audit report saved to: $AUDIT_DIR/"
echo "Next step: Send data to AI for analysis"

# Edit crontab
crontab -e

# Run security audit every Sunday at 3 AM
0 3 * * 0 /opt/ai-security-audit/run-audit.sh >> /var/log/security-audit.log 2>&1

# Check SSH anomalies every 6 hours
0 */6 * * * /opt/ai-security-audit/check-ssh-alerts.sh

#!/usr/bin/env python3
"""
ai-security-alarm.py - AI-driven security alert system
Sends notifications when anomalies are detected
"""

import smtplib
import requests
from email.mime.text import MIMEText
from datetime import datetime, timedelta

def check_ssh_anomalies():
    """Check for SSH login anomalies"""
    import subprocess
    
    # Get failed logins in the last 1 hour
    result = subprocess.run(
        ["journalctl", "-u", "sshd", "--since", "1 hour ago", "--no-pager"],
        capture_output=True, text=True
    )
    
    failed_logins = [
        line for line in result.stdout.splitlines()
        if "Failed password" in line
    ]
    
    if len(failed_logins) > 5:
        # Extract IP addresses
        import re
        ips = re.findall(r'from (\d+\.\d+\.\d+\.\d+)', '\n'.join(failed_logins))
        ip_counts = {}
        for ip in ips:
            ip_counts[ip] = ip_counts.get(ip, 0) + 1
        
        # Find the most aggressive IP
        top_ip = max(ip_counts, key=ip_counts.get)
        
        return {
            "alert": True,
            "type": "brute_force",
            "ip": top_ip,
            "attempts": ip_counts[top_ip],
            "total_failed": len(failed_logins)
        }
    
    return {"alert": False}

def send_notification(alert_data):
    """Send alert notification"""
    subject = f"🚨 VPS Security Alert: {alert_data['type'].upper()}"
    
    body = f"""
Time: {datetime.now().strftime('%Y-%m-%d %H:%M')}
Type: {alert_data['type']}
Source IP: {alert_data.get('ip', 'N/A')}
Attempts: {alert_data.get('attempts', 'N/A')}

Please check your VPS security status immediately!
    """
    
    msg = MIMEText(body)
    msg["Subject"] = subject
    msg["From"] = "security@selfvps.net"
    msg["To"] = "admin@example.com"
    
    try:
        with smtplib.SMTP("localhost", 25) as server:
            server.send_message(msg)
        print(f"✅ Alert email sent to {msg['To']}")
    except Exception as e:
        print(f"❌ Email sending failed: {e}")
        send_telegram_alert(subject, body)

def send_telegram_alert(subject, body):
    """Send alert via Telegram Bot"""
    BOT_TOKEN="YOUR_BOT_TOKEN"
    CHAT_ID = "YOUR_CHAT_ID"
    
    message = f"{subject}\n\n{body}"
    
    requests.post(
        f"https://api.telegram.org/bot{BOT_TOKEN}/sendMessage",
        json={"chat_id": CHAT_ID, "text": message}
    )

if __name__ == "__main__":
    alert = check_ssh_anomalies()
    if alert.get("alert"):
        send_notification(alert)
    else:
        print("✅ No anomalies detected, all clear")

# Run Llama 3.1 8B locally for initial screening
ollama run llama3.1:8b <<EOF
Please check if the following SSH configuration has security issues:
$(cat /etc/ssh/sshd_config)

Return only the list of issues, no explanations.
EOF

# Send detailed data to cloud AI for deep analysis
curl -X POST https://api.openrouter.ai/api/v1/chat/completions \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "anthropic/claude-3.5-haiku",
    "messages": [{
      "role": "user",
      "content": "Analyze the following VPS security audit data and provide remediation steps..."
    }]
  }'