Updated the script version to v4.6.1 and made various security fixes, including symlink protection and improved validation for SSH keys and configurations.
Release v4.0.0: Platinum Edition - Health Reports, Metadata Backups & POSIX Compliance
Major release v4.0.0 brings enterprise-grade reliability and strict POSIX compliance.
New Features:
- Feat: Added comprehensive `preflight_checks` to verify core tools, disk space, and memory before execution.
- Feat: Implemented triple-redundancy IPv6 detection (checking `/proc`, `ip`, and `ifconfig`) to ensure accuracy on minimal/container systems.
- Feat: Added persistent, versioned backups in `/var/backups/ssh-config/` with accompanying `.meta` files for audit trails.
- Feat: Automatically generates a detailed `Health Report` upon successful completion.
Fixes & Improvements:
- Refactor: Replaced all Bash-isms (e.g., arrays) with strict POSIX string handling for full Alpine/Dash compatibility.
- Fix: Clarified random port generation logic to strictly avoid Kubernetes NodePort range (30000-32767).
- Security: Enhanced temporary directory handling using `mktemp` and traps for secure cleanup.
This major update upgrades the script from v1.0.0 to v1.0.5 (Production Gold).
**Key Improvements & Fixes:**
* **Critical Fixes:**
* Fixed `ss` command parsing logic to prevent port detection false positives (e.g., port 22 matching port 2).
* Fixed log file initialization order to prevent crashes before dependency checks.
* Added `export LC_ALL=C` to ensure consistent POSIX command behavior across different locales.
* **Safety Hardening:**
* Added passive detection for `AllowUsers` configuration trap to prevent lockout.
* Improved `sshd_config` cleanup regex to handle indented lines correctly.
* Added fail-safe protection for log writing (prevents script crash if log is unwritable).
* **Compatibility:**
* Added `wget` fallback for key fetching if `curl` is missing.
* Updated `chown` syntax to `user:` for better group compatibility on Alpine/minimal systems.
* Added pre-flight check for core dependencies (`grep`, `awk`, `sed`, `id`).
* Forced `procps` installation check before enabling BBR.
* **Refactor:**
* Optimized i18n handling (optional based on implementation).
247like