Security check you public IP server

#!/usr/bin/env bash

set -euo pipefail

SINCE="${1:-today}"
TOP_LIMIT="${TOP_LIMIT:-20}"

TMP=$(mktemp)
trap 'rm -f "$TMP"' EXIT

line() {
    printf '%100s\n' '' | tr ' ' '='
}

section() {
    echo
    line
    echo "$1"
    line
}

extract_ips() {
    grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' || true
}

if ! command -v journalctl >/dev/null 2>&1; then
    echo "Error: journalctl is not available on this system." >&2
    exit 1
fi

# On Ubuntu, the OpenSSH service is normally named ssh.service.
# If the current user cannot read all journal entries, run the script with sudo.
journalctl -u ssh.service --since "$SINCE" --no-pager -o short-iso 2>/dev/null > "$TMP"

if [[ ! -s "$TMP" ]]; then
    echo "No SSH journal entries were found since: $SINCE"
    echo "Try running the script with sudo or specify a wider time range."
    exit 0
fi

SUCCESS_COUNT=$(grep -cE 'Accepted (publickey|password|keyboard-interactive)' "$TMP" || true)
INVALID_COUNT=$(grep -c 'Invalid user' "$TMP" || true)
ROOT_COUNT=$(grep -cE '(authenticating user root|Failed password for root|Failed publickey for root)' "$TMP" || true)
FAILED_PASSWORD_COUNT=$(grep -c 'Failed password' "$TMP" || true)
FAILED_PUBLICKEY_COUNT=$(grep -c 'Failed publickey' "$TMP" || true)
UNIQUE_SOURCE_COUNT=$(
    grep 'sshd\[' "$TMP" \
        | extract_ips \
        | sort -u \
        | wc -l \
        | tr -d ' '
)

SUCCESSFUL_IPS=$(
    grep -E 'Accepted (publickey|password|keyboard-interactive)' "$TMP" \
        | sed -nE 's/.* from ([0-9.]+) port.*/\1/p' \
        | sort -u
)

section "SSH Activity Report"

echo "Host      : $(hostname)"
echo "Since     : $SINCE"
echo "Generated : $(date --iso-8601=seconds)"
echo "Journal   : ssh.service"

section "Statistics"

printf '%-42s %8s\n' "Successful logins" "$SUCCESS_COUNT"
printf '%-42s %8s\n' "Invalid-user attempts" "$INVALID_COUNT"
printf '%-42s %8s\n' "Root authentication attempts" "$ROOT_COUNT"
printf '%-42s %8s\n' "Failed password attempts" "$FAILED_PASSWORD_COUNT"
printf '%-42s %8s\n' "Failed public-key attempts" "$FAILED_PUBLICKEY_COUNT"
printf '%-42s %8s\n' "Unique source IP addresses" "$UNIQUE_SOURCE_COUNT"

section "Successful Logins"

if ! grep -E 'Accepted (publickey|password|keyboard-interactive)' "$TMP"; then
    echo "None"
fi

section "Successful Login Source IPs"

if [[ -n "$SUCCESSFUL_IPS" ]]; then
    while read -r IP; do
        [[ -n "$IP" ]] || continue
        COUNT=$(
            grep -E 'Accepted (publickey|password|keyboard-interactive)' "$TMP" \
                | grep -F -c "from $IP " || true
        )
        printf '%8s  %s\n' "$COUNT" "$IP"
    done <<< "$SUCCESSFUL_IPS" | sort -rn
else
    echo "None"
fi

section "Top SSH Source IPs"

if ! grep 'sshd\[' "$TMP" \
    | extract_ips \
    | sort \
    | uniq -c \
    | sort -rn \
    | head -n "$TOP_LIMIT"; then
    echo "None"
fi

section "Most Common Usernames Attempted"

{
    sed -nE 's/.*Invalid user ([^ ]+) from.*/\1/p' "$TMP"
    sed -nE 's/.*Failed password for (invalid user )?([^ ]+) from.*/\2/p' "$TMP"
    sed -nE 's/.*Failed publickey for (invalid user )?([^ ]+) from.*/\2/p' "$TMP"
} \
    | sort \
    | uniq -c \
    | sort -rn \
    | head -n "$TOP_LIMIT" \
    | awk '{printf "%8s  %s\n", $1, $2}' \
    || true

section "Top Invalid-User Scanner Sources"

if ! grep 'Invalid user' "$TMP" \
    | sed -nE 's/.* from ([0-9.]+) port.*/\1/p' \
    | sort \
    | uniq -c \
    | sort -rn \
    | head -n "$TOP_LIMIT"; then
    echo "None"
fi

section "Top Root Login Attempt Sources"

if ! grep -E '(authenticating user root|Failed password for root|Failed publickey for root)' "$TMP" \
    | extract_ips \
    | sort \
    | uniq -c \
    | sort -rn \
    | head -n "$TOP_LIMIT"; then
    echo "None"
fi

section "Source IP Timeline"

printf '%-20s %8s  %-25s  %-25s\n' \
    "IP" "EVENTS" "FIRST SEEN" "LAST SEEN"

awk '
{
    timestamp = $1
    ip = ""

    for (i = 1; i <= NF; i++) {
        if ($i ~ /^[0-9]{1,3}(\.[0-9]{1,3}){3}$/) {
            ip = $i
            break
        }
    }

    if (ip != "") {
        if (!(ip in first)) {
            first[ip] = timestamp
        }
        last[ip] = timestamp
        count[ip]++
    }
}
END {
    for (ip in count) {
        printf "%-20s %8d  %-25s  %-25s\n", \
            ip, count[ip], first[ip], last[ip]
    }
}
' "$TMP" | sort -k2,2nr | head -n "$TOP_LIMIT"

section "Successful IPs Also Showing Suspicious Activity"

MIXED_BEHAVIOUR=0

if [[ -n "$SUCCESSFUL_IPS" ]]; then
    while read -r IP; do
        [[ -n "$IP" ]] || continue

        SUSPICIOUS_COUNT=$(
            grep -F "$IP" "$TMP" \
                | grep -E -c '(Invalid user|Failed password|Failed publickey|authenticating user root)' \
                || true
        )

        if (( SUSPICIOUS_COUNT > 0 )); then
            MIXED_BEHAVIOUR=1
            printf '%s  %s suspicious entries\n' "$IP" "$SUSPICIOUS_COUNT"
        fi
    done <<< "$SUCCESSFUL_IPS"
fi

if (( MIXED_BEHAVIOUR == 0 )); then
    echo "None detected"
fi

section "Recent Successful Logins"

grep -E 'Accepted (publickey|password|keyboard-interactive)' "$TMP" \
    | tail -n "$TOP_LIMIT" \
    || true

section "Recent Root Login Attempts"

grep -E '(authenticating user root|Failed password for root|Failed publickey for root)' "$TMP" \
    | tail -n "$TOP_LIMIT" \
    || true

section "Recent Invalid Users"

grep 'Invalid user' "$TMP" \
    | tail -n "$TOP_LIMIT" \
    || true

section "Assessment"

if (( SUCCESS_COUNT == 0 )); then
    echo "[INFO] No successful SSH logins were observed in the selected period."
else
    echo "[INFO] Successful SSH logins were observed. Verify that the users, source IPs and authentication methods are expected."
fi

if (( INVALID_COUNT > 0 )); then
    echo "[INFO] Invalid-user attempts were observed. This is common when SSH is publicly accessible."
fi

if (( INVALID_COUNT > 50 )); then
    echo "[INFO] A high volume of automated username scanning was observed."
fi

if (( ROOT_COUNT > 0 )); then
    echo "[INFO] Root-login probing was observed."
fi

if (( FAILED_PASSWORD_COUNT > 0 )); then
    echo "[WARNING] Failed password attempts were observed."
fi

if (( FAILED_PUBLICKEY_COUNT > 0 )); then
    echo "[INFO] Failed public-key attempts were observed."
fi

if (( MIXED_BEHAVIOUR > 0 )); then
    echo "[WARNING] At least one successful-login IP also generated suspicious SSH entries. Review those events manually."
fi

echo
echo "Report complete."