#!/bin/sh
# SSH 诊断信息采集 + 自动回传下载站
R=/tmp/diag.txt
{
echo "=== sshd -T 生效配置"
(sshd -T 2>/dev/null || /usr/sbin/sshd -T 2>/dev/null) | grep -iE "permitrootlogin|passwordauth|authorizedkeysfile|pubkeyauth|strictmodes"
echo "=== sshd_config.d 目录"
ls -la /etc/ssh/sshd_config.d/ 2>/dev/null
echo "=== 主配置头部"
head -5 /etc/ssh/sshd_config 2>/dev/null
echo "=== authorized_keys 内容前120字符"
ls -la ~/.ssh/ 2>/dev/null
head -c 120 ~/.ssh/authorized_keys 2>/dev/null
echo
echo "=== 权限"
stat -c "%a %U %n" ~ ~/.ssh ~/.ssh/authorized_keys 2>/dev/null
echo "=== SELinux"
getenforce 2>/dev/null
echo "=== sshd 进程"
ps aux 2>/dev/null | grep sshd | grep -v grep
echo "=== sshd 日志尾部"
(journalctl -u ssh -u sshd --no-pager -n 20 2>/dev/null || tail -20 /var/log/secure 2>/dev/null || tail -20 /var/log/auth.log 2>/dev/null) | tail -20
} > $R 2>&1
B64=$(base64 -w0 $R 2>/dev/null || base64 $R | tr -d '\n')
curl -s -m 15 -X POST -H "Content-Type: application/json" \
  -d "{\"cat\":\"misc\",\"name\":\"diag-result.txt\",\"token\":\"dl7k4x9m2q\",\"b64\":\"$B64\"}" \
  http://127.0.0.1:18086/api/upload
echo
echo DIAG-SENT