#!/bin/bash

# set Ciphers (sshd)
sshd_restart="no"
case "$(lsb_release -sc)" in
"xenial"|"yakkety"|"zesty")
    grep -e '^Ciphers ' "/etc/ssh/sshd_config" > /dev/null 2>&1
    if [ $? -eq 0 ] ; then
        grep -e '^Ciphers +aes256-cbc' "/etc/ssh/sshd_config" > /dev/null 2>&1
        if [ $? -ne 0 ] ; then
            grep -e '^Ciphers.*aes256-cbc' "/etc/ssh/sshd_config" > /dev/null 2>&1
            if [ $? -ne 0 ] ; then
                sed -i -e 's|^\(Ciphers.*\)$|\1,aes256-cbc|g' "/etc/ssh/sshd_config" > /dev/null 2>&1
                [ $? -eq 0 ] && sshd_restart="yes"
            fi
        fi
    else
        echo 'Ciphers +aes256-cbc' >> "/etc/ssh/sshd_config"
        [ $? -eq 0 ] && sshd_restart="yes"
    fi
    ;;
esac
[ "${sshd_restart}" = "yes" ] \
    && systemctl restart "ssh" > /dev/null 2>&1

# Fixes for SSL3 (pure-ftpd)
pureftpd_restart="no"
if [ -d "/etc/pure-ftpd/conf" ] ; then
    if [ -f "/etc/pure-ftpd/conf/TLS" ] ; then
        if [ -f "/etc/pure-ftpd/conf/TLSCipherSuite" ] ; then
            grep -e '^ALL:!aNULL$' "/etc/pure-ftpd/conf/TLSCipherSuite" > /dev/null 2>&1
            if [ $? -ne 0 ] ; then
                echo 'ALL:!aNULL' > "/etc/pure-ftpd/conf/TLSCipherSuite"
                [ $? -eq 0 ] && pureftpd_restart="yes"
            fi
        else
            echo 'ALL:!aNULL' > "/etc/pure-ftpd/conf/TLSCipherSuite"
            [ $? -eq 0 ] && pureftpd_restart="yes"
        fi
    else
        echo "'pure-ftpd': TLS configuration is not enabled."
    fi
else
    echo "'pure-ftpd': config directory not found."
fi
[ "${pureftpd_restart}" = "yes" ] \
    && systemctl restart "pure-ftpd" > /dev/null 2>&1