#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
ProxMenux Security Manager
Handles Proxmox firewall status, rules, and security tool detection.
"""

import os
import json
import subprocess
import re
import fcntl
import threading
from contextlib import contextmanager

# =================================================================
# Proxmox Firewall Management
# =================================================================

# Proxmox firewall config paths
CLUSTER_FW = "/etc/pve/firewall/cluster.fw"
HOST_FW_DIR = "/etc/pve/local"  # host.fw is per-node


@contextmanager
def _exclusive_file_lock(path):
    """Hold an exclusive flock on `path` for the duration of the block.

    The read / modify / write pattern in `add_firewall_rule`,
    `edit_firewall_rule`, `delete_firewall_rule` and the jail.local writer
    was unsynchronised — two concurrent Flask threads doing add+add could
    each read the same content, modify in their own copy, and the second
    write would clobber the first. flock serialises across threads (and
    across processes) on the same path. Audit Tier 6 — security_manager
    locking ausente.
    """
    parent = os.path.dirname(path)
    if parent:
        os.makedirs(parent, exist_ok=True)
    fd = os.open(path, os.O_RDWR | os.O_CREAT, 0o640)
    try:
        fcntl.flock(fd, fcntl.LOCK_EX)
        yield
    finally:
        try:
            fcntl.flock(fd, fcntl.LOCK_UN)
        except Exception:
            pass
        os.close(fd)


# Threading lock for `_lynis_audit_running` flag and similar in-process
# state. flock guards on-disk state; this guards in-memory state.
_state_lock = threading.Lock()


# Match a real pve-firewall rule line: `<DIR> <ACTION> ...` where DIR is
# IN/OUT/GROUP and ACTION is ACCEPT/DROP/REJECT/<group-name>. We don't
# enforce the full grammar — just enough that comments, blank lines, and
# random malformed text don't get counted as rules when computing
# rule_index. PVE itself rejects malformed rules, so they exist on disk
# but never appear in `pve-firewall list` output → keeping our internal
# index in sync with that list means skipping them here too.
_PVE_RULE_LINE_RE = re.compile(
    r'^(?:IN|OUT|GROUP)\s+\S+',
    re.IGNORECASE,
)


def _is_pve_rule_line(stripped):
    if not stripped or stripped.startswith('#') or stripped.startswith('['):
        return False
    return bool(_PVE_RULE_LINE_RE.match(stripped))

# Allowed shape for inputs that flow into fail2ban-client argv or are written
# as INI section headers in /etc/fail2ban/jail.local. Bounded length, conservative
# alphabet, and forced to START with an alphanumeric so a name like `--help`
# cannot be smuggled past argv as an option flag. Also prevents newline injection
# (`jail_name='ssh\n[DEFAULT]\nbantime=1\n['` would corrupt the DEFAULT section)
# and quote/escape tricks. See audit Tier 1 #12b.
_JAIL_NAME_RE = re.compile(r'^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$')

# Whitelist for the `level` argument to firewall functions. The audit flagged
# that an unconstrained value here could one day be extended to `vm` and become
# a path traversal sink. See audit Tier 1 #12d.
_FIREWALL_LEVELS = ('host', 'cluster')

# Whitelist of L4 protocols accepted by Proxmox `pve-firewall` rules. Anything
# outside this set should be rejected to avoid silent acceptance of bogus rules.
# See audit Tier 1 #12d.
_FIREWALL_PROTOCOLS = ('tcp', 'udp', 'icmp', 'icmpv6', 'igmp', 'esp', 'ah', 'ipv6-icmp')


def _is_valid_jail_name(name):
    """Return True iff `name` is a safe jail name for fail2ban-client / jail.local."""
    return isinstance(name, str) and bool(_JAIL_NAME_RE.match(name))


# Source / dest values written into host.fw / cluster.fw rule lines. Allows
# IPs (1.2.3.4), CIDR (1.2.3.0/24), IPv6 (::1, fe80::/64), Proxmox ipset
# references (+ipsetname), and named aliases (alpha-numeric + dot/dash/underscore).
# Rejects whitespace, `#`, and any control character (including the `\n` /
# `\r` / `\t` that would otherwise let an attacker inject a fresh rule line.
# See audit Tier 1 #12c.
_FW_SOURCE_DEST_RE = re.compile(r'^[A-Za-z0-9.:/_+\-]{1,128}$')

# Linux interface names: alphanumerics, dot, dash, underscore. Capped at 16
# chars (Linux IFNAMSIZ). Rejects newlines and shell metacharacters.
_FW_IFACE_RE = re.compile(r'^[A-Za-z0-9_.\-]{1,16}$')


def _is_valid_fw_endpoint(value):
    """True if `value` is empty (optional) or matches a safe firewall endpoint."""
    if value == "" or value is None:
        return True
    return isinstance(value, str) and bool(_FW_SOURCE_DEST_RE.match(value))


def _is_valid_fw_iface(value):
    """True if `value` is empty (optional) or a valid network interface name."""
    if value == "" or value is None:
        return True
    return isinstance(value, str) and bool(_FW_IFACE_RE.match(value))

def _run_cmd(cmd, timeout=10):
    """Run a shell command and return (returncode, stdout, stderr)"""
    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=timeout
        )
        return result.returncode, result.stdout.strip(), result.stderr.strip()
    except subprocess.TimeoutExpired:
        return -1, "", "Command timed out"
    except FileNotFoundError:
        return -1, "", f"Command not found: {cmd[0]}"
    except Exception as e:
        return -1, "", str(e)


def get_firewall_status():
    """
    Get the overall Proxmox firewall status.
    Returns dict with status info.
    """
    result = {
        "pve_firewall_installed": False,
        "pve_firewall_active": False,
        "cluster_fw_enabled": False,
        "host_fw_enabled": False,
        "rules_count": 0,
        "rules": [],
        "monitor_port_open": False,
    }

    # Check if pve-firewall service exists
    rc, out, _ = _run_cmd(["systemctl", "is-active", "pve-firewall"])
    result["pve_firewall_installed"] = rc == 0 or "inactive" in out or "active" in out
    result["pve_firewall_active"] = (rc == 0 and out == "active")

    # If not installed or inactive, check if the service unit exists
    if not result["pve_firewall_installed"]:
        rc2, _, _ = _run_cmd(["systemctl", "cat", "pve-firewall"])
        result["pve_firewall_installed"] = rc2 == 0

    # Parse cluster firewall config
    if os.path.isfile(CLUSTER_FW):
        try:
            with open(CLUSTER_FW, 'r') as f:
                content = f.read()
            # Check if firewall is enabled at cluster level
            for line in content.splitlines():
                line = line.strip()
                if line.lower().startswith("enable:"):
                    val = line.split(":", 1)[1].strip()
                    result["cluster_fw_enabled"] = val == "1"
                    break
        except Exception:
            pass

    # Parse host firewall config
    host_fw = os.path.join(HOST_FW_DIR, "host.fw")
    if os.path.isfile(host_fw):
        try:
            with open(host_fw, 'r') as f:
                content = f.read()
            for line in content.splitlines():
                line = line.strip()
                if line.lower().startswith("enable:"):
                    val = line.split(":", 1)[1].strip()
                    result["host_fw_enabled"] = val == "1"
                    break
        except Exception:
            pass

    # Get rules
    rules = _parse_firewall_rules()
    result["rules"] = rules
    result["rules_count"] = len(rules)

    # Check if port 8008 is allowed
    for rule in rules:
        dport = str(rule.get("dport", ""))
        if "8008" in dport and rule.get("action", "").upper() == "ACCEPT":
            result["monitor_port_open"] = True
            break

    return result


def _parse_firewall_rules():
    """Parse all firewall rules from cluster and host configs"""
    rules = []
    rule_idx_by_file = {}  # Track rule index per file for deletion

    for fw_file, source in [(CLUSTER_FW, "cluster"), (os.path.join(HOST_FW_DIR, "host.fw"), "host")]:
        if not os.path.isfile(fw_file):
            continue
        rule_idx_by_file[source] = 0
        try:
            with open(fw_file, 'r') as f:
                content = f.read()

            in_rules = False
            section = ""
            for line in content.splitlines():
                line = line.strip()
                if not line or line.startswith('#'):
                    continue

                # Detect section headers
                if line.startswith('['):
                    section_match = re.match(r'\[(\w+)\]', line)
                    if section_match:
                        section = section_match.group(1).upper()
                        in_rules = section in ("RULES", "IN", "OUT")
                    continue

                if in_rules or section in ("RULES", "IN", "OUT"):
                    rule = _parse_rule_line(line, source, section)
                    if rule:
                        rule["rule_index"] = rule_idx_by_file[source]
                        rules.append(rule)
                        rule_idx_by_file[source] += 1
                    # else: malformed line — don't bump the index. The
                    # delete/edit paths use the same `_is_pve_rule_line`
                    # gate so this stays consistent across read and write.
        except Exception:
            pass

    return rules


def _parse_rule_line(line, source, section):
    """Parse a single firewall rule line"""
    # Proxmox rule format: |ACTION MACRO(params) -option value ...
    # or: IN/OUT ACTION -p proto -dport port -source addr
    parts = line.split()
    if len(parts) < 2:
        return None

    rule = {
        "raw": line,
        "source_file": source,
        "section": section,
    }

    idx = 0
    # Direction
    if parts[0].upper() in ("IN", "OUT"):
        rule["direction"] = parts[0].upper()
        idx = 1
    elif section in ("IN",):
        rule["direction"] = "IN"
    elif section in ("OUT",):
        rule["direction"] = "OUT"

    if idx < len(parts):
        rule["action"] = parts[idx].upper()
        idx += 1

    # Parse options
    while idx < len(parts):
        opt = parts[idx]
        if opt.startswith("-") and idx + 1 < len(parts):
            key = opt.lstrip("-")
            val = parts[idx + 1]
            rule[key] = val
            idx += 2
        else:
            idx += 1

    return rule


def add_firewall_rule(direction="IN", action="ACCEPT", protocol="tcp", dport="", sport="",
                      source="", dest="", iface="", comment="", level="host"):
    """
    Add a custom firewall rule to host or cluster firewall config.
    Returns (success, message)
    """
    # Validate inputs
    action = action.upper()
    if action not in ("ACCEPT", "DROP", "REJECT"):
        return False, f"Invalid action: {action}. Must be ACCEPT, DROP, or REJECT"

    direction = direction.upper()
    if direction not in ("IN", "OUT"):
        return False, f"Invalid direction: {direction}. Must be IN or OUT"

    if level not in _FIREWALL_LEVELS:
        return False, f"Invalid level: {level}. Must be one of {_FIREWALL_LEVELS}"

    # Per-field input hardening — rejects newline / `#` / shell metas which would
    # otherwise let a caller inject extra rule lines into host.fw / cluster.fw.
    # See audit Tier 1 #12c.
    if not _is_valid_fw_endpoint(source):
        return False, "Invalid source (only IP/CIDR/ipset/alias chars allowed)"
    if not _is_valid_fw_endpoint(dest):
        return False, "Invalid destination (only IP/CIDR/ipset/alias chars allowed)"
    if not _is_valid_fw_iface(iface):
        return False, "Invalid interface name"

    # Build rule line
    parts = [direction, action]

    if protocol:
        proto = protocol.lower()
        if proto not in _FIREWALL_PROTOCOLS:
            return False, f"Invalid protocol: {protocol}. Must be one of {_FIREWALL_PROTOCOLS}"
        parts.extend(["-p", proto])
    if dport:
        # Validate port
        if not re.match(r'^[\d:,]+$', dport):
            return False, f"Invalid destination port: {dport}"
        parts.extend(["-dport", dport])
    if sport:
        if not re.match(r'^[\d:,]+$', sport):
            return False, f"Invalid source port: {sport}"
        parts.extend(["-sport", sport])
    if source:
        parts.extend(["-source", source])
    if dest:
        parts.extend(["-dest", dest])
    if iface:
        parts.extend(["-i", iface])

    parts.extend(["-log", "nolog"])

    if comment:
        # Sanitize comment. The previous regex used `\s` in the negation which
        # accepts `\n` / `\r` — letting a malicious comment terminate the rule
        # line and inject a fresh one. We use a literal space in the negation
        # so newlines / tabs are stripped. See audit Tier 1 #12c.
        safe_comment = re.sub(r'[^\w \-._/():]', '', comment)
        parts.append(f"# {safe_comment}")

    rule_line = " ".join(parts)

    # Determine target file
    if level == "cluster":
        fw_file = CLUSTER_FW
    else:
        fw_file = os.path.join(HOST_FW_DIR, "host.fw")

    try:
        with _exclusive_file_lock(fw_file):
            content = ""
            has_rules_section = False

            if os.path.isfile(fw_file):
                with open(fw_file, 'r') as f:
                    content = f.read()
                has_rules_section = "[RULES]" in content

            if has_rules_section:
                lines = content.splitlines()
                new_lines = []
                inserted = False
                for line in lines:
                    new_lines.append(line)
                    if not inserted and line.strip() == "[RULES]":
                        new_lines.append(rule_line)
                        inserted = True
                content = "\n".join(new_lines) + "\n"
            else:
                if content and not content.endswith("\n"):
                    content += "\n"
                content += "\n[RULES]\n"
                content += rule_line + "\n"

            os.makedirs(os.path.dirname(fw_file), exist_ok=True)
            with open(fw_file, 'w') as f:
                f.write(content)

        _run_cmd(["pve-firewall", "reload"])

        return True, f"Firewall rule added: {direction} {action} {protocol}{':' + dport if dport else ''}"
    except PermissionError:
        return False, "Permission denied. Cannot write to firewall config."
    except Exception as e:
        return False, f"Failed to add firewall rule: {str(e)}"


def edit_firewall_rule(rule_index, level="host", direction="IN", action="ACCEPT",
                       protocol="tcp", dport="", sport="", source="", dest="", iface="", comment=""):
    """
    Edit an existing firewall rule by replacing it in-place.
    Deletes the old rule at rule_index and inserts the new one at the same position.
    Returns (success, message)
    """
    # Validate inputs
    action = action.upper()
    if action not in ("ACCEPT", "DROP", "REJECT"):
        return False, f"Invalid action: {action}. Must be ACCEPT, DROP, or REJECT"
    direction = direction.upper()
    if direction not in ("IN", "OUT"):
        return False, f"Invalid direction: {direction}. Must be IN or OUT"

    if level not in _FIREWALL_LEVELS:
        return False, f"Invalid level: {level}. Must be one of {_FIREWALL_LEVELS}"

    # See add_firewall_rule for the same rationale — keep both entry points
    # consistent so they cannot be exploited via newline / shell-metachar
    # injection. Audit Tier 1 #12c.
    if not _is_valid_fw_endpoint(source):
        return False, "Invalid source (only IP/CIDR/ipset/alias chars allowed)"
    if not _is_valid_fw_endpoint(dest):
        return False, "Invalid destination (only IP/CIDR/ipset/alias chars allowed)"
    if not _is_valid_fw_iface(iface):
        return False, "Invalid interface name"

    # Build new rule line
    parts = [direction, action]
    if protocol:
        proto = protocol.lower()
        if proto not in _FIREWALL_PROTOCOLS:
            return False, f"Invalid protocol: {protocol}. Must be one of {_FIREWALL_PROTOCOLS}"
        parts.extend(["-p", proto])
    if dport:
        if not re.match(r'^[\d:,]+$', dport):
            return False, f"Invalid destination port: {dport}"
        parts.extend(["-dport", dport])
    if sport:
        if not re.match(r'^[\d:,]+$', sport):
            return False, f"Invalid source port: {sport}"
        parts.extend(["-sport", sport])
    if source:
        parts.extend(["-source", source])
    # `dest` was previously dropped silently from edit_firewall_rule — that's
    # the registered audit issue "edit_firewall_rule IGNORA dest". Honor it.
    if dest:
        parts.extend(["-dest", dest])
    if iface:
        parts.extend(["-i", iface])
    parts.extend(["-log", "nolog"])
    if comment:
        # Same fix as add_firewall_rule: literal space, no `\s`, so newlines
        # cannot escape the comment and inject another rule.
        safe_comment = re.sub(r'[^\w \-._/():]', '', comment)
        parts.append(f"# {safe_comment}")
    new_rule_line = " ".join(parts)

    # Determine target file
    if level == "cluster":
        fw_file = CLUSTER_FW
    else:
        fw_file = os.path.join(HOST_FW_DIR, "host.fw")

    if not os.path.isfile(fw_file):
        return False, "Firewall config file not found"

    try:
        with _exclusive_file_lock(fw_file):
            with open(fw_file, 'r') as f:
                content = f.read()

            lines = content.splitlines()
            new_lines = []
            in_rules = False
            current_rule_idx = 0
            replaced = False

            for line in lines:
                stripped = line.strip()
                if stripped.startswith('['):
                    section_match = re.match(r'\[(\w+)\]', stripped)
                    if section_match:
                        section = section_match.group(1).upper()
                        in_rules = section in ("RULES", "IN", "OUT")

                # Only count lines that look like real PVE firewall rules
                # (`<DIR> <ACTION> ...`). Random malformed lines that pve-
                # firewall would skip used to bump our index, which made
                # "delete rule N" hit the wrong rule. Audit Tier 6 —
                # delete/edit_firewall_rule desync de índices.
                if in_rules and stripped and _is_pve_rule_line(stripped):
                    if current_rule_idx == rule_index:
                        new_lines.append(new_rule_line)
                        replaced = True
                        current_rule_idx += 1
                        continue
                    current_rule_idx += 1

                new_lines.append(line)

            if not replaced:
                return False, f"Rule index {rule_index} not found"

            with open(fw_file, 'w') as f:
                f.write("\n".join(new_lines) + "\n")

        _run_cmd(["pve-firewall", "reload"])

        return True, f"Firewall rule updated: {direction} {action} {protocol}{':' + dport if dport else ''}"
    except PermissionError:
        return False, "Permission denied. Cannot modify firewall config."
    except Exception as e:
        return False, f"Failed to edit rule: {str(e)}"


def delete_firewall_rule(rule_index, level="host"):
    """
    Delete a firewall rule by index from host or cluster config.
    The index corresponds to the order of rules in [RULES] section.
    Returns (success, message)
    """
    if level not in _FIREWALL_LEVELS:
        return False, f"Invalid level: {level}. Must be one of {_FIREWALL_LEVELS}"
    if level == "cluster":
        fw_file = CLUSTER_FW
    else:
        fw_file = os.path.join(HOST_FW_DIR, "host.fw")

    if not os.path.isfile(fw_file):
        return False, "Firewall config file not found"

    try:
        with _exclusive_file_lock(fw_file):
            with open(fw_file, 'r') as f:
                content = f.read()

            lines = content.splitlines()
            new_lines = []
            in_rules = False
            current_rule_idx = 0
            removed_rule = None

            for line in lines:
                stripped = line.strip()
                if stripped.startswith('['):
                    section_match = re.match(r'\[(\w+)\]', stripped)
                    if section_match:
                        section = section_match.group(1).upper()
                        in_rules = section in ("RULES", "IN", "OUT")

                # Same rule-shape gate as edit_firewall_rule above — skip
                # malformed lines so the index stays aligned with the
                # rules pve-firewall actually reports.
                if in_rules and stripped and _is_pve_rule_line(stripped):
                    if current_rule_idx == rule_index:
                        removed_rule = stripped
                        current_rule_idx += 1
                        continue  # Skip this line (delete it)
                    current_rule_idx += 1

                new_lines.append(line)

            if removed_rule is None:
                return False, f"Rule index {rule_index} not found"

            with open(fw_file, 'w') as f:
                f.write("\n".join(new_lines) + "\n")

        _run_cmd(["pve-firewall", "reload"])

        return True, f"Firewall rule deleted: {removed_rule}"
    except PermissionError:
        return False, "Permission denied. Cannot modify firewall config."
    except Exception as e:
        return False, f"Failed to delete rule: {str(e)}"


def add_monitor_port_rule():
    """
    Add a firewall rule to allow port 8008 (ProxMenux Monitor) on the host.
    Returns (success, message)
    """
    host_fw = os.path.join(HOST_FW_DIR, "host.fw")

    # Check if rule already exists
    status = get_firewall_status()
    if status.get("monitor_port_open"):
        return True, "Port 8008 is already allowed in the firewall"

    try:
        content = ""
        has_rules_section = False

        if os.path.isfile(host_fw):
            with open(host_fw, 'r') as f:
                content = f.read()
            has_rules_section = "[RULES]" in content

        rule_line = "IN ACCEPT -p tcp -dport 8008 -log nolog # ProxMenux Monitor"

        if has_rules_section:
            # Add rule after [RULES] section header
            lines = content.splitlines()
            new_lines = []
            inserted = False
            for line in lines:
                new_lines.append(line)
                if not inserted and line.strip() == "[RULES]":
                    new_lines.append(rule_line)
                    inserted = True
            content = "\n".join(new_lines) + "\n"
        else:
            # Add [RULES] section
            if content and not content.endswith("\n"):
                content += "\n"
            content += "\n[RULES]\n"
            content += rule_line + "\n"

        with open(host_fw, 'w') as f:
            f.write(content)

        # Reload firewall
        _run_cmd(["pve-firewall", "reload"])

        return True, "Firewall rule added: port 8008 (TCP) allowed for ProxMenux Monitor"
    except PermissionError:
        return False, "Permission denied. Cannot write to firewall config."
    except Exception as e:
        return False, f"Failed to add firewall rule: {str(e)}"


def remove_monitor_port_rule():
    """
    Remove the ProxMenux Monitor port 8008 rule from host firewall.
    Returns (success, message)
    """
    host_fw = os.path.join(HOST_FW_DIR, "host.fw")

    if not os.path.isfile(host_fw):
        return True, "No host firewall config found"

    try:
        with open(host_fw, 'r') as f:
            lines = f.readlines()

        new_lines = []
        removed = False
        for line in lines:
            if "8008" in line and "ProxMenux" in line:
                removed = True
                continue
            new_lines.append(line)

        if not removed:
            return True, "No ProxMenux Monitor rule found to remove"

        with open(host_fw, 'w') as f:
            f.writelines(new_lines)

        _run_cmd(["pve-firewall", "reload"])

        return True, "ProxMenux Monitor firewall rule removed"
    except Exception as e:
        return False, f"Failed to remove firewall rule: {str(e)}"


def enable_firewall(level="host"):
    """
    Enable the Proxmox firewall at host or cluster level.
    Returns (success, message)
    """
    if level not in _FIREWALL_LEVELS:
        return False, f"Invalid level: {level}. Must be one of {_FIREWALL_LEVELS}"
    if level == "cluster":
        return _set_firewall_enabled(CLUSTER_FW, True)
    else:
        host_fw = os.path.join(HOST_FW_DIR, "host.fw")
        return _set_firewall_enabled(host_fw, True)


def disable_firewall(level="host"):
    """
    Disable the Proxmox firewall at host or cluster level.
    Returns (success, message)
    """
    if level not in _FIREWALL_LEVELS:
        return False, f"Invalid level: {level}. Must be one of {_FIREWALL_LEVELS}"
    if level == "cluster":
        return _set_firewall_enabled(CLUSTER_FW, False)
    else:
        host_fw = os.path.join(HOST_FW_DIR, "host.fw")
        return _set_firewall_enabled(host_fw, False)


def _set_firewall_enabled(fw_file, enabled):
    """Set enable: 1 or enable: 0 in firewall config"""
    try:
        content = ""
        if os.path.isfile(fw_file):
            with open(fw_file, 'r') as f:
                content = f.read()

        enable_val = "1" if enabled else "0"
        has_options = "[OPTIONS]" in content
        has_enable = False

        lines = content.splitlines()
        new_lines = []
        in_options = False

        for line in lines:
            stripped = line.strip()
            if stripped.startswith("["):
                in_options = stripped == "[OPTIONS]"

            if in_options and stripped.lower().startswith("enable:"):
                new_lines.append(f"enable: {enable_val}")
                has_enable = True
            else:
                new_lines.append(line)

        if not has_enable:
            if has_options:
                # Add enable line after [OPTIONS]
                final_lines = []
                for line in new_lines:
                    final_lines.append(line)
                    if line.strip() == "[OPTIONS]":
                        final_lines.append(f"enable: {enable_val}")
                new_lines = final_lines
            else:
                # Add [OPTIONS] section at the beginning
                new_lines.insert(0, "[OPTIONS]")
                new_lines.insert(1, f"enable: {enable_val}")
                new_lines.insert(2, "")

        # Ensure parent directory exists
        os.makedirs(os.path.dirname(fw_file), exist_ok=True)

        with open(fw_file, 'w') as f:
            f.write("\n".join(new_lines) + "\n")

        # Reload or start the firewall service
        if enabled:
            _run_cmd(["systemctl", "enable", "pve-firewall"])
            _run_cmd(["systemctl", "start", "pve-firewall"])
        
        _run_cmd(["pve-firewall", "reload"])

        state = "enabled" if enabled else "disabled"
        level = "cluster" if fw_file == CLUSTER_FW else "host"
        return True, f"Firewall {state} at {level} level"
    except PermissionError:
        return False, "Permission denied. Cannot modify firewall config."
    except Exception as e:
        return False, f"Failed to modify firewall: {str(e)}"


# =================================================================
# Security Tools Detection
# =================================================================

# =================================================================
# Fail2Ban Detailed Management
# =================================================================

def get_fail2ban_details():
    """
    Get detailed Fail2Ban info: per-jail banned IPs, ban times, etc.
    Returns dict with detailed jail information.
    """
    result = {
        "installed": False,
        "active": False,
        "version": "",
        "jails": [],
    }

    rc, out, _ = _run_cmd(["fail2ban-client", "--version"])
    if rc != 0:
        return result

    result["installed"] = True
    result["version"] = out.split("\n")[0].strip() if out else ""

    rc2, out2, _ = _run_cmd(["systemctl", "is-active", "fail2ban"])
    result["active"] = (rc2 == 0 and out2 == "active")

    if not result["active"]:
        return result

    # Get jail list
    rc3, out3, _ = _run_cmd(["fail2ban-client", "status"])
    jail_names = []
    if rc3 == 0:
        for line in out3.splitlines():
            if "Jail list:" in line:
                jails_str = line.split(":", 1)[1].strip()
                jail_names = [j.strip() for j in jails_str.split(",") if j.strip()]

    # Get detailed info per jail
    for jail_name in jail_names:
        jail_info = {
            "name": jail_name,
            "currently_failed": 0,
            "total_failed": 0,
            "currently_banned": 0,
            "total_banned": 0,
            "banned_ips": [],
            "findtime": "",
            "bantime": "",
            "maxretry": "",
        }

        rc4, out4, _ = _run_cmd(["fail2ban-client", "status", jail_name])
        if rc4 == 0:
            for line in out4.splitlines():
                line = line.strip()
                if "Currently failed:" in line:
                    try:
                        jail_info["currently_failed"] = int(line.split(":", 1)[1].strip())
                    except ValueError:
                        pass
                elif "Total failed:" in line:
                    try:
                        jail_info["total_failed"] = int(line.split(":", 1)[1].strip())
                    except ValueError:
                        pass
                elif "Currently banned:" in line:
                    try:
                        jail_info["currently_banned"] = int(line.split(":", 1)[1].strip())
                    except ValueError:
                        pass
                elif "Total banned:" in line:
                    try:
                        jail_info["total_banned"] = int(line.split(":", 1)[1].strip())
                    except ValueError:
                        pass
                elif "Banned IP list:" in line:
                    ips_str = line.split(":", 1)[1].strip()
                    if ips_str:
                        raw_ips = [ip.strip() for ip in ips_str.split() if ip.strip()]
                        jail_info["banned_ips"] = [
                            {"ip": ip, "type": classify_ip(ip)} for ip in raw_ips
                        ]

        # Get jail config values
        for key in ["findtime", "bantime", "maxretry"]:
            rc5, out5, _ = _run_cmd(["fail2ban-client", "get", jail_name, key])
            if rc5 == 0 and out5:
                jail_info[key] = out5.strip()

        result["jails"].append(jail_info)

    return result


def classify_ip(ip_address):
    """
    Classify an IP address as 'local' or 'external'.
    Local: 10.x.x.x, 172.16-31.x.x, 192.168.x.x, 127.x.x.x, fd00::/8, fe80::/10, ::1
    """
    if not ip_address:
        return "unknown"

    ip = ip_address.strip()

    # IPv4 private ranges
    if ip.startswith("10.") or ip.startswith("127.") or ip.startswith("192.168."):
        return "local"
    if ip.startswith("172."):
        try:
            second_octet = int(ip.split(".")[1])
            if 16 <= second_octet <= 31:
                return "local"
        except (ValueError, IndexError):
            pass

    # IPv6 private/link-local
    ip_lower = ip.lower()
    if ip_lower == "::1" or ip_lower.startswith("fd") or ip_lower.startswith("fe80"):
        return "local"

    return "external"


def update_jail_config(jail_name, maxretry=None, bantime=None, findtime=None):
    """
    Update Fail2Ban jail configuration (maxretry, bantime, findtime).
    Uses fail2ban-client set commands for live changes, and also writes
    to the jail.local file for persistence.

    bantime = -1 means permanent ban.
    Returns (success, message)
    """
    if not _is_valid_jail_name(jail_name):
        return False, "Invalid jail name"

    changes = []
    errors = []

    # Apply live changes via fail2ban-client
    if maxretry is not None:
        try:
            val = int(maxretry)
            if val < 1:
                return False, "Max retries must be at least 1"
            rc, _, err = _run_cmd(["fail2ban-client", "set", jail_name, "maxretry", str(val)])
            if rc == 0:
                changes.append(f"maxretry={val}")
            else:
                errors.append(f"maxretry: {err}")
        except ValueError:
            errors.append("maxretry must be a number")

    if bantime is not None:
        try:
            val = int(bantime)
            # -1 = permanent, otherwise must be positive
            if val < -1 or val == 0:
                return False, "Ban time must be positive seconds or -1 for permanent"
            rc, _, err = _run_cmd(["fail2ban-client", "set", jail_name, "bantime", str(val)])
            if rc == 0:
                changes.append(f"bantime={val}")
            else:
                errors.append(f"bantime: {err}")
        except ValueError:
            errors.append("bantime must be a number")

    if findtime is not None:
        try:
            val = int(findtime)
            if val < 1:
                return False, "Find time must be positive"
            rc, _, err = _run_cmd(["fail2ban-client", "set", jail_name, "findtime", str(val)])
            if rc == 0:
                changes.append(f"findtime={val}")
            else:
                errors.append(f"findtime: {err}")
        except ValueError:
            errors.append("findtime must be a number")

    # Also persist to jail.local so changes survive restart
    if changes:
        _persist_jail_config(jail_name, maxretry, bantime, findtime)

    if errors:
        return False, "Errors: " + "; ".join(errors)

    if changes:
        return True, f"Jail '{jail_name}' updated: {', '.join(changes)}"

    return False, "No changes specified"


def _persist_jail_config(jail_name, maxretry=None, bantime=None, findtime=None):
    """
    Write jail config changes to /etc/fail2ban/jail.local for persistence.

    `jail_name` is interpolated into an INI section header `[jail_name]`. Any
    callers should already have validated the name with `_is_valid_jail_name`,
    but we re-check defensively in case a future code path skips it.
    """
    if not _is_valid_jail_name(jail_name):
        return  # silently refuse malformed names; never write to disk

    jail_local = "/etc/fail2ban/jail.local"

    try:
        content = ""
        if os.path.isfile(jail_local):
            with open(jail_local, 'r') as f:
                content = f.read()

        lines = content.splitlines() if content else []

        # Find or create the jail section
        jail_section = f"[{jail_name}]"
        section_start = -1
        section_end = len(lines)

        for i, line in enumerate(lines):
            if line.strip() == jail_section:
                section_start = i
            elif section_start >= 0 and line.strip().startswith("[") and i > section_start:
                section_end = i
                break

        # Build settings to update
        settings = {}
        if maxretry is not None:
            settings["maxretry"] = str(int(maxretry))
        if bantime is not None:
            settings["bantime"] = str(int(bantime))
        if findtime is not None:
            settings["findtime"] = str(int(findtime))

        if section_start >= 0:
            # Update existing section
            for key, val in settings.items():
                found = False
                for i in range(section_start + 1, section_end):
                    stripped = lines[i].strip()
                    if stripped.startswith(f"{key}") and "=" in stripped:
                        lines[i] = f"{key} = {val}"
                        found = True
                        break
                if not found:
                    lines.insert(section_start + 1, f"{key} = {val}")
                    section_end += 1
        else:
            # Create new section
            if lines and lines[-1].strip():
                lines.append("")
            lines.append(jail_section)
            for key, val in settings.items():
                lines.append(f"{key} = {val}")

        with open(jail_local, 'w') as f:
            f.write("\n".join(lines) + "\n")

    except Exception:
        pass  # Best effort persistence


def apply_missing_jails():
    """
    Check for missing Fail2Ban jails (proxmox, proxmenux) and create them.
    Returns (success, message, applied_jails).
    """
    applied = []
    errors = []

    # Check which jails are currently active
    rc, out, _ = _run_cmd(["fail2ban-client", "status"])
    if rc != 0:
        return False, "Cannot communicate with fail2ban-client", []

    current_jails = []
    for line in out.splitlines():
        if "Jail list:" in line:
            jails_str = line.split(":", 1)[1].strip()
            current_jails = [j.strip().lower() for j in jails_str.split(",") if j.strip()]

    # --- Proxmox jail (port 8006) ---
    # Fail2Ban's systemd backend can't reliably read pvedaemon worker entries
    # in real-time. We use a systemd service that tails the journal to a file
    # and fail2ban monitors that file with backend=auto.
    if "proxmox" not in current_jails:
        try:
            # Create the auth logger service if not present
            logger_service = "/etc/systemd/system/proxmox-auth-logger.service"
            if not os.path.isfile(logger_service):
                service_content = """[Unit]
Description=Proxmox Auth Logger for Fail2Ban
After=pvedaemon.service
PartOf=fail2ban.service

[Service]
Type=simple
ExecStart=/bin/bash -c 'journalctl -f _SYSTEMD_UNIT=pvedaemon.service -o short-iso --no-pager >> /var/log/proxmox-auth.log'
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
"""
                with open(logger_service, "w") as f:
                    f.write(service_content)

                # Create log file
                log_file = "/var/log/proxmox-auth.log"
                if not os.path.isfile(log_file):
                    with open(log_file, "w") as f:
                        pass
                    os.chmod(log_file, 0o640)

                _run_cmd(["systemctl", "daemon-reload"])
                _run_cmd(["systemctl", "enable", "--now", "proxmox-auth-logger.service"])

            # Create filter (only if user hasn't placed their own version)
            filter_path = "/etc/fail2ban/filter.d/proxmox.conf"
            if not os.path.isfile(filter_path):
                filter_content = """[Definition]
failregex = authentication (failure|error); rhost=(::ffff:)?<HOST> user=.* msg=.*
ignoreregex =
datepattern = ^%%Y-%%m-%%dT%%H:%%M:%%S
"""
                with open(filter_path, "w") as f:
                    f.write(filter_content)

            # Create jail (only if not already present on disk). The user
            # may have deliberately disabled it (`enabled = false`) while
            # keeping their other customisations; the previous code re-
            # enabled and clobbered everything every run. Audit Tier 6 —
            # `apply_missing_jails` sobrescribe configs personalizadas.
            jail_path = "/etc/fail2ban/jail.d/proxmox.conf"
            if not os.path.isfile(jail_path):
                jail_content = """[proxmox]
enabled = true
port = 8006
filter = proxmox
backend = auto
logpath = /var/log/proxmox-auth.log
maxretry = 3
bantime = 3600
findtime = 600
"""
                with open(jail_path, "w") as f:
                    f.write(jail_content)

            applied.append("proxmox")
        except Exception as e:
            errors.append(f"proxmox: {str(e)}")

    # --- ProxMenux Monitor jail (port 8008 + reverse proxy) ---
    # Uses backend=auto with logpath because the Flask app writes
    # auth failures directly to this file (not via syslog/journal).
    if "proxmenux" not in current_jails:
        try:
            # Create filter (preserve any user-customised version on disk)
            filter_path = "/etc/fail2ban/filter.d/proxmenux.conf"
            if not os.path.isfile(filter_path):
                filter_content = """[Definition]
failregex = ^.*proxmenux-auth: authentication failure; rhost=<HOST> user=.*$
ignoreregex =
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
"""
                with open(filter_path, "w") as f:
                    f.write(filter_content)

            # Create jail only if not already present (same rationale as
            # the proxmox jail above).
            jail_path = "/etc/fail2ban/jail.d/proxmenux.conf"
            if not os.path.isfile(jail_path):
                jail_content = """[proxmenux]
enabled = true
port = 8008,http,https
filter = proxmenux
backend = auto
logpath = /var/log/proxmenux-auth.log
maxretry = 3
bantime = 3600
findtime = 600
"""
                with open(jail_path, "w") as f:
                    f.write(jail_content)

            # Ensure log file exists
            if not os.path.isfile("/var/log/proxmenux-auth.log"):
                with open("/var/log/proxmenux-auth.log", "w") as f:
                    pass
                os.chmod("/var/log/proxmenux-auth.log", 0o640)

            applied.append("proxmenux")
        except Exception as e:
            errors.append(f"proxmenux: {str(e)}")

    if not applied and not errors:
        return True, "All jails are already configured", []

    if applied:
        # Restart fail2ban to load new jails
        _run_cmd(["systemctl", "restart", "fail2ban"])
        import time
        time.sleep(2)

    if errors:
        return False, "Errors: " + "; ".join(errors), applied

    return True, f"Applied jails: {', '.join(applied)}", applied


def unban_ip(jail_name, ip_address):
    """
    Unban a specific IP from a Fail2Ban jail.
    Returns (success, message)
    """
    if not _is_valid_jail_name(jail_name):
        return False, "Invalid jail name"
    if not ip_address:
        return False, "IP address is required"

    # Validate IP format (basic check)
    if not re.match(r'^[\d.:a-fA-F]+$', ip_address):
        return False, f"Invalid IP address format: {ip_address}"

    rc, out, err = _run_cmd(["fail2ban-client", "set", jail_name, "unbanip", ip_address])
    if rc == 0:
        return True, f"IP {ip_address} has been unbanned from jail '{jail_name}'"
    else:
        return False, f"Failed to unban IP: {err or out}"


def get_fail2ban_recent_activity(lines=50):
    """
    Get recent Fail2Ban log activity (bans and unbans).
    Returns list of recent events.
    """
    events = []

    log_file = "/var/log/fail2ban.log"
    if not os.path.isfile(log_file):
        return events

    # Coerce + clamp `lines`. The caller (Flask route) passed it through
    # without bounds checking, so a request with `?lines=999999999` made
    # `tail` read most of `/var/log/fail2ban.log` and stuffed it into a
    # response. Audit Tier 6 — `get_fail2ban_recent_activity` permite
    # `lines` arbitrario.
    try:
        lines_int = int(lines)
    except (TypeError, ValueError):
        lines_int = 50
    lines_int = max(1, min(lines_int, 1000))

    try:
        # Read last N lines using tail
        rc, out, _ = _run_cmd(["tail", f"-{lines_int}", log_file], timeout=5)
        if rc != 0 or not out:
            return events

        for line in out.splitlines():
            event = None

            # Parse ban events
            ban_match = re.search(
                r'(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})[,\d]*\s+.*\[(\w+)\]\s+Ban\s+([\d.:a-fA-F]+)',
                line
            )
            if ban_match:
                event = {
                    "timestamp": ban_match.group(1),
                    "jail": ban_match.group(2),
                    "ip": ban_match.group(3),
                    "action": "ban",
                }

            # Parse unban events
            if not event:
                unban_match = re.search(
                    r'(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})[,\d]*\s+.*\[(\w+)\]\s+Unban\s+([\d.:a-fA-F]+)',
                    line
                )
                if unban_match:
                    event = {
                        "timestamp": unban_match.group(1),
                        "jail": unban_match.group(2),
                        "ip": unban_match.group(3),
                        "action": "unban",
                    }

            # Parse found (failed attempt) events
            if not event:
                found_match = re.search(
                    r'(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})[,\d]*\s+.*\[(\w+)\]\s+Found\s+([\d.:a-fA-F]+)',
                    line
                )
                if found_match:
                    event = {
                        "timestamp": found_match.group(1),
                        "jail": found_match.group(2),
                        "ip": found_match.group(3),
                        "action": "found",
                    }

            if event:
                events.append(event)

        # Return most recent first
        events.reverse()

    except Exception:
        pass

    return events


def detect_security_tools():
    """
    Detect installed security tools on the system.
    Returns dict with tool status info.
    """
    tools = {}

    # Fail2Ban
    tools["fail2ban"] = _detect_fail2ban()

    # Lynis
    tools["lynis"] = _detect_lynis()

    return tools


def _detect_fail2ban():
    """Detect Fail2Ban installation and status"""
    info = {
        "installed": False,
        "active": False,
        "version": "",
        "jails": [],
        "banned_ips_count": 0,
    }

    rc, out, _ = _run_cmd(["fail2ban-client", "--version"])
    if rc == 0:
        info["installed"] = True
        info["version"] = out.split("\n")[0].strip() if out else ""

        # Check service status
        rc2, out2, _ = _run_cmd(["systemctl", "is-active", "fail2ban"])
        info["active"] = (rc2 == 0 and out2 == "active")

        if info["active"]:
            # Get jails
            rc3, out3, _ = _run_cmd(["fail2ban-client", "status"])
            if rc3 == 0:
                for line in out3.splitlines():
                    if "Jail list:" in line:
                        jails_str = line.split(":", 1)[1].strip()
                        info["jails"] = [j.strip() for j in jails_str.split(",") if j.strip()]

            # Count banned IPs across all jails
            total_banned = 0
            for jail in info["jails"]:
                rc4, out4, _ = _run_cmd(["fail2ban-client", "status", jail])
                if rc4 == 0:
                    for line in out4.splitlines():
                        if "Currently banned:" in line:
                            try:
                                count = int(line.split(":", 1)[1].strip())
                                total_banned += count
                            except ValueError:
                                pass
            info["banned_ips_count"] = total_banned

    return info


def _find_lynis_cmd():
    """Find the lynis binary path"""
    for path in ["/usr/local/bin/lynis", "/opt/lynis/lynis", "/usr/bin/lynis"]:
        if os.path.isfile(path) and os.access(path, os.X_OK):
            return path
    return None


def _detect_lynis():
    """Detect Lynis installation and status"""
    info = {
        "installed": False,
        "version": "",
        "last_scan": None,
        "hardening_index": None,
    }

    lynis_cmd = _find_lynis_cmd()

    if lynis_cmd:
        info["installed"] = True
        rc, out, _ = _run_cmd([lynis_cmd, "show", "version"])
        if rc == 0:
            info["version"] = out.strip()

        # Check for last scan report - use full parser for accurate data
        report = parse_lynis_report()
        if report:
            info["last_scan"] = report.get("datetime_start", None)
            info["hardening_index"] = report.get("hardening_index", None)
        else:
            # Fallback: quick read of report.dat
            report_file = "/var/log/lynis-report.dat"
            if os.path.isfile(report_file):
                try:
                    with open(report_file, 'r') as f:
                        for line in f:
                            if line.startswith("report_datetime_start="):
                                info["last_scan"] = line.split("=", 1)[1].strip()
                            elif line.startswith("hardening_index="):
                                try:
                                    info["hardening_index"] = int(line.split("=", 1)[1].strip())
                                except ValueError:
                                    pass
                except Exception:
                    pass

    return info


# Track running audit
_lynis_audit_running = False
_lynis_audit_progress = ""


def run_lynis_audit():
    """
    Run lynis audit system in the background.
    Returns (success, message).
    """
    global _lynis_audit_running, _lynis_audit_progress

    # Guard the check-and-set under `_state_lock` — without it two Flask
    # threads racing into `run_lynis_audit` can both see the flag as
    # False, then both set it True, and both spawn a Lynis subprocess.
    # Audit Tier 6 — `_lynis_audit_running` global sin lock.
    with _state_lock:
        if _lynis_audit_running:
            return False, "An audit is already running"

        lynis_cmd = _find_lynis_cmd()
        if not lynis_cmd:
            return False, "Lynis is not installed"

        _lynis_audit_running = True
        _lynis_audit_progress = "starting"

    import threading

    def _run_audit():
        global _lynis_audit_running, _lynis_audit_progress
        try:
            _lynis_audit_progress = "running"
            # Remove old report so lynis creates a fresh one
            report_file = "/var/log/lynis-report.dat"
            if os.path.isfile(report_file):
                os.remove(report_file)

            # Capture full formatted output. Lynis suppresses its nice
            # formatted output ([+] sections) when stdout is not a tty.
            # Use 'script' to simulate a terminal so Lynis outputs everything.
            output_log = "/var/log/lynis-output.log"
            rc = -1
            out = ""
            err = ""

            # Method 1: Use 'script -qc' (simulates tty)
            try:
                script_cmd = [
                    "script", "-qec",
                    f"{lynis_cmd} audit system --no-colors --quick",
                    output_log
                ]
                result = subprocess.run(
                    script_cmd,
                    capture_output=True, text=True, timeout=600,
                    env={**os.environ, "TERM": "dumb"}
                )
                rc = result.returncode
                out = result.stdout.strip()
                err = result.stderr.strip()
            except Exception:
                pass

            # If script failed or output file is too small, try direct method
            output_ok = (
                os.path.isfile(output_log)
                and os.path.getsize(output_log) > 500
            )
            if not output_ok:
                try:
                    rc, out, err = _run_cmd(
                        [lynis_cmd, "audit", "system", "--no-colors", "--quick"],
                        timeout=600
                    )
                    if out:
                        with open(output_log, "w") as fout:
                            fout.write(out)
                except Exception:
                    pass

            # Clean ALL ANSI/terminal escape codes and control chars from output
            if os.path.isfile(output_log):
                try:
                    import re as _re
                    with open(output_log, 'r', errors='replace') as fout:
                        raw = fout.read()
                    # Remove ALL ANSI escape sequences comprehensively:
                    # CSI sequences: \x1b[ ... (letter)  e.g. \x1b[0m, \x1b[?25h
                    cleaned = _re.sub(r'\x1b\[[\x20-\x3f]*[\x40-\x7e]', '', raw)
                    # OSC sequences: \x1b] ... \x07 or \x1b\\
                    cleaned = _re.sub(r'\x1b\].*?(?:\x07|\x1b\\)', '', cleaned)
                    # Other escape sequences: \x1b followed by one char
                    cleaned = _re.sub(r'\x1b[\x20-\x7e]', '', cleaned)
                    # Remove remaining control characters except \n and \t
                    cleaned = _re.sub(r'[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]', '', cleaned)
                    # Remove carriage returns
                    cleaned = cleaned.replace('\r', '')
                    # Remove 'Script started/done' lines added by script cmd
                    lines = cleaned.splitlines()
                    lines = [l for l in lines
                             if not l.strip().startswith('Script started')
                             and not l.strip().startswith('Script done')]
                    # Remove empty lines at start/end
                    while lines and not lines[0].strip():
                        lines.pop(0)
                    while lines and not lines[-1].strip():
                        lines.pop()
                    cleaned = '\n'.join(lines)
                    with open(output_log, 'w') as fout:
                        fout.write(cleaned)
                except Exception:
                    pass

            # Lynis returns the hardening index as exit code (e.g. 65)
            # Any non-negative code means the audit ran successfully
            if rc >= 0:
                _lynis_audit_progress = "completed"
            else:
                _lynis_audit_progress = f"error: {err[:200] if err else 'unknown error'}"
        except Exception as e:
            _lynis_audit_progress = f"error: {str(e)}"
        finally:
            _lynis_audit_running = False

    t = threading.Thread(target=_run_audit, daemon=True)
    t.start()
    return True, "Audit started"


def get_lynis_audit_status():
    """Get current audit status"""
    return {
        "running": _lynis_audit_running,
        "progress": _lynis_audit_progress,
    }


def parse_lynis_report():
    """
    Parse /var/log/lynis-report.dat into structured report data.
    Also enriches with data from lynis.log when report.dat is sparse.
    Returns a dict with all audit findings.
    """
    report_file = "/var/log/lynis-report.dat"
    output_file = "/var/log/lynis-output.log"
    # Need at least one data source
    if not os.path.isfile(report_file) and not os.path.isfile(output_file):
        return None

    report = {
        "datetime_start": "",
        "datetime_end": "",
        "lynis_version": "",
        "os_name": "",
        "os_version": "",
        "os_fullname": "",
        "hostname": "",
        "hardening_index": None,
        "tests_performed": 0,
        "warnings": [],
        "suggestions": [],
        "categories": {},
        "installed_packages": 0,
        "kernel_version": "",
        "firewall_active": False,
        "malware_scanner": False,
    }

    # Collect all raw key-value pairs first for flexible matching
    raw_data = {}
    warnings_raw = []
    suggestions_raw = []

    if os.path.isfile(report_file):
        try:
            with open(report_file, 'r') as f:
                for line in f:
                    line = line.strip()
                    if not line or line.startswith("#") or line.startswith("["):
                        continue

                    if "=" not in line:
                        continue

                    key, _, value = line.partition("=")
                    key = key.strip()
                    value = value.strip()

                    if key == "warning[]":
                        warnings_raw.append(value)
                    elif key == "suggestion[]":
                        suggestions_raw.append(value)
                    else:
                        # Last value wins (some keys appear multiple times)
                        raw_data[key] = value
        except Exception:
            pass  # Continue with output.log data

    # Map known fields (Lynis uses varied naming across versions)
    report["datetime_start"] = raw_data.get("report_datetime_start", "")
    report["datetime_end"] = raw_data.get("report_datetime_end", "")
    report["lynis_version"] = raw_data.get("lynis_version", "")
    report["hostname"] = raw_data.get("hostname", "")

    # OS name - try multiple fields
    report["os_name"] = (raw_data.get("os_name", "") or
                         raw_data.get("os", "") or
                         raw_data.get("os_fullname", ""))
    report["os_version"] = (raw_data.get("os_version", "") or
                            raw_data.get("os_version_id", ""))
    report["os_fullname"] = raw_data.get("os_fullname", "")

    # Kernel - try multiple field names
    report["kernel_version"] = (raw_data.get("os_kernel_version_full", "") or
                                raw_data.get("os_kernel_version", "") or
                                raw_data.get("linux_kernel_version", "") or
                                raw_data.get("linux_version", "") or
                                raw_data.get("os_kernelversion_full", "") or
                                raw_data.get("os_kernelversion", ""))

    # Hardening index
    for k in ["hardening_index", "hpindex", "hp_index"]:
        if k in raw_data:
            try:
                report["hardening_index"] = int(raw_data[k])
                break
            except ValueError:
                pass

    # Tests performed
    for k in ["tests_performed", "ctests_performed", "total_tests"]:
        if k in raw_data:
            try:
                val = int(raw_data[k])
                if val > report["tests_performed"]:
                    report["tests_performed"] = val
            except ValueError:
                pass

    # Installed packages
    for k in ["installed_packages", "installed_packages_array"]:
        if k in raw_data:
            try:
                report["installed_packages"] = int(raw_data[k])
            except ValueError:
                # Might be a string like "package1,package2" - count them
                pkgs = raw_data[k]
                if pkgs:
                    report["installed_packages"] = len(pkgs.split(","))

    # Firewall
    for k in ["firewall_active", "firewall_installed"]:
        if k in raw_data and raw_data[k] in ("1", "true", "yes"):
            report["firewall_active"] = True
            break

    # Malware scanner
    for k in ["malware_scanner_installed", "malware_scanner"]:
        if k in raw_data and raw_data[k] in ("1", "true", "yes"):
            report["malware_scanner"] = True
            break

    # Parse warnings
    for w in warnings_raw:
        parts = w.split("|")
        if len(parts) >= 2:
            report["warnings"].append({
                "test_id": parts[0].strip() if len(parts) > 0 else "",
                "severity": parts[1].strip() if len(parts) > 1 else "",
                "description": parts[2].strip() if len(parts) > 2 else parts[1].strip(),
                "solution": parts[3].strip() if len(parts) > 3 else "",
            })

    # Parse suggestions
    for s in suggestions_raw:
        parts = s.split("|")
        if len(parts) >= 2:
            report["suggestions"].append({
                "test_id": parts[0].strip() if len(parts) > 0 else "",
                "description": parts[1].strip() if len(parts) > 1 else "",
                "solution": parts[2].strip() if len(parts) > 2 else "",
                "details": parts[3].strip() if len(parts) > 3 else "",
            })

    # Parse lynis-output.log (stdout) for section checks, fallback to lynis.log.
    # The same file gets parsed twice — once for sections/checks (this block),
    # once for warnings/suggestions/software (block below). Read once into
    # `_log_lines` and share the list across both passes so we don't pay the
    # disk + decode cost twice. Audit Tier 6 — `parse_lynis_report` lee
    # archivo entero a memoria 2 veces.
    report["sections"] = []
    output_file = "/var/log/lynis-output.log"
    log_file = output_file if os.path.isfile(output_file) else "/var/log/lynis.log"
    _log_lines = []
    if os.path.isfile(log_file):
        try:
            with open(log_file, 'r') as f:
                _log_lines = f.readlines()
        except Exception:
            _log_lines = []
    if _log_lines:
        try:
            import re
            log_lines = _log_lines

            current_section = None
            current_checks = []

            for line in log_lines:
                line = line.rstrip('\n')
                stripped = line.strip()

                # Detect section headers: "[+] Boot and services"
                # Use 'in' check first for speed, then regex for extraction
                if '[+]' in stripped:
                    section_match = re.search(r'\[\+\]\s+(.+)', stripped)
                    if section_match:
                        # Save previous section
                        if current_section and current_checks:
                            report["sections"].append({
                                "name": current_section,
                                "checks": current_checks,
                            })
                        current_section = section_match.group(1).strip()
                        # Remove trailing dashes from names like "Boot and services ------"
                        current_section = re.sub(r'\s*-+\s*$', '', current_section)
                        current_checks = []
                        continue

                # Skip separator lines, empty, banner lines
                if stripped.startswith('---') or not stripped:
                    continue
                if stripped.startswith('===') or stripped.startswith('#'):
                    current_section = None  # Stop parsing after results summary
                    continue

                # Detect any line with [ STATUS ] pattern (covers -, File:, Directory:, etc.)
                # After ANSI cleaning, cursor-positioning sequences are removed so
                # there may be only 1 space between the name and [ STATUS ].
                # Strategy: find the LAST occurrence of [ ... ] on the line.
                bracket_match = re.search(r'\[\s*([A-Za-z0-9_ /.:!-]+?)\s*\]\s*$', stripped)
                if bracket_match and current_section:
                    # Everything before the bracket is the check name
                    bracket_start = bracket_match.start()
                    check_name = stripped[:bracket_start].strip()
                    check_status = bracket_match.group(1).strip()
                    # Remove leading - or * from name
                    check_name = re.sub(r'^[-*]+\s*', '', check_name).strip()
                    # Skip noise lines (too short, dots-only, plugin progress)
                    if (check_name
                            and not check_name.startswith('..')
                            and len(check_name) > 2
                            and check_name not in ('..', '...', '....')):
                        current_checks.append({
                            "name": check_name,
                            "status": check_status,
                        })
                    continue

                # Detect sub-results: "      Result: found 35 running services"
                # After strip(), line becomes "Result: ..." (no leading spaces)
                if stripped.startswith("Result:") and current_section and current_checks:
                    detail = stripped[7:].strip()
                    if detail:
                        current_checks[-1]["detail"] = detail
                    continue

                # Extract key data from the info block and summary
                # Format: "Key:           value" or "Key : value"
                if ":" in stripped:
                    if not report["hardening_index"] and "Hardening index" in stripped:
                        m = re.search(r'Hardening index\s*:\s*(\d+)', stripped)
                        if m:
                            report["hardening_index"] = int(m.group(1))
                    elif report["tests_performed"] == 0 and "Tests performed" in stripped:
                        m = re.search(r'Tests performed\s*:\s*(\d+)', stripped)
                        if m:
                            report["tests_performed"] = int(m.group(1))
                    elif not report["kernel_version"] and "Kernel version" in stripped:
                        m = re.search(r'Kernel version\s*:\s*(.+)', stripped)
                        if m:
                            report["kernel_version"] = m.group(1).strip()
                    elif not report["hostname"] and stripped.startswith("Hostname"):
                        m = re.search(r'Hostname\s*:\s*(.+)', stripped)
                        if m:
                            val = m.group(1).strip()
                            if val and val != "N/A":
                                report["hostname"] = val
                    elif not report["os_name"] and "Operating system name" in stripped:
                        m = re.search(r'Operating system name\s*:\s*(.+)', stripped)
                        if m:
                            report["os_name"] = m.group(1).strip()
                    elif not report["os_version"] and "Operating system version" in stripped:
                        m = re.search(r'Operating system version\s*:\s*(.+)', stripped)
                        if m:
                            report["os_version"] = m.group(1).strip()
                    elif not report["os_fullname"] and "Operating system:" in stripped:
                        m = re.search(r'Operating system\s*:\s*(.+)', stripped)
                        if m:
                            report["os_fullname"] = m.group(1).strip()
                    elif not report["lynis_version"] and "Program version" in stripped:
                        m = re.search(r'Program version\s*:\s*(.+)', stripped)
                        if m:
                            report["lynis_version"] = m.group(1).strip()
                    elif not report["datetime_start"] and "report_datetime_start" in stripped:
                        pass  # already from .dat

            # Save last section
            if current_section and current_checks:
                report["sections"].append({
                    "name": current_section,
                    "checks": current_checks,
                })

            # Filter out sections with no meaningful checks
            report["sections"] = [
                s for s in report["sections"]
                if len(s["checks"]) > 0
            ]

            # Store debug info about parsing
            report["_parse_debug"] = {
                "source": log_file,
                "total_lines": len(log_lines),
                "sections_found": len(report["sections"]),
                "section_names": [s["name"] for s in report["sections"]],
            }

        except Exception as e:
            report["sections"] = []
            report["_parse_debug"] = {"error": str(e)}

    # Post-processing: extract firewall/malware status from parsed sections
    # This catches cases where report.dat doesn't have firewall_active but the
    # stdout shows "Checking host based firewall [ ACTIVE ]"
    if not report["firewall_active"] and report["sections"]:
        for section in report["sections"]:
            section_lower = section["name"].lower()
            if "firewall" in section_lower:
                for check in section["checks"]:
                    name_lower = check["name"].lower()
                    status_upper = check["status"].upper()
                    if "host based firewall" in name_lower or "checking host" in name_lower:
                        if status_upper in ("ACTIVE", "ENABLED", "FOUND", "OK"):
                            report["firewall_active"] = True
                            break
                    if "iptables" in name_lower and status_upper in ("ACTIVE", "FOUND", "OK"):
                        report["firewall_active"] = True
                        break
                if report["firewall_active"]:
                    break

    # Also check pve-firewall directly (Proxmox uses its own firewall service)
    if not report["firewall_active"]:
        try:
            rc, out, _ = _run_cmd(["systemctl", "is-active", "pve-firewall"])
            if rc == 0 and out.strip() == "active":
                report["firewall_active"] = True
        except Exception:
            pass

    # Extract malware scanner status from sections
    if not report["malware_scanner"] and report["sections"]:
        for section in report["sections"]:
            for check in section["checks"]:
                name_lower = check["name"].lower()
                status_upper = check["status"].upper()
                if any(x in name_lower for x in ["malware", "clamav", "rkhunter", "chkrootkit"]):
                    if status_upper in ("FOUND", "INSTALLED", "OK"):
                        report["malware_scanner"] = True
                        break
            if report["malware_scanner"]:
                break

    # Always parse lynis-output.log for warnings, suggestions, software
    # components. The report.dat is often sparse/empty on many systems.
    # Reuse `_log_lines` already loaded above instead of re-opening the file.
    if _log_lines:
        try:
            import re
            stdout_lines = _log_lines

            in_warnings = False
            in_suggestions = False
            in_software = False
            stdout_warnings = []
            stdout_suggestions = []
            last_suggestion = None

            for sline in stdout_lines:
                sline = sline.rstrip('\n')
                sstripped = sline.strip()

                # Detect "Warnings (N):" header
                if re.match(r'^Warnings\s*\(\d+\)\s*:', sstripped):
                    in_warnings = True
                    in_suggestions = False
                    in_software = False
                    last_suggestion = None
                    continue
                # Detect "Suggestions (N):" header
                if re.match(r'^Suggestions\s*\(\d+\)\s*:', sstripped):
                    in_suggestions = True
                    in_warnings = False
                    in_software = False
                    last_suggestion = None
                    continue
                # Detect "Software components:" section
                if "Software components:" in sstripped:
                    in_software = True
                    in_warnings = False
                    in_suggestions = False
                    last_suggestion = None
                    continue
                # End of sections on major separators
                if sstripped.startswith('==='):
                    in_warnings = False
                    in_suggestions = False
                    in_software = False
                    last_suggestion = None
                    continue

                # Parse "Software components" for firewall/malware
                # Format: "- Firewall               [V]" or "[X]"
                if in_software:
                    sw_match = re.match(r'^-\s+(.+?)\s+\[([VX])\]', sstripped)
                    if sw_match:
                        sw_name = sw_match.group(1).strip().lower()
                        sw_status = sw_match.group(2)
                        if "firewall" in sw_name and sw_status == "V":
                            report["firewall_active"] = True
                        if "malware" in sw_name and sw_status == "V":
                            report["malware_scanner"] = True

                # Parse warning lines: "! Warning text [TEST-ID]"
                if in_warnings and sstripped.startswith('!'):
                    wm = re.match(r'^!\s+(.+?)\s+\[([A-Z0-9_-]+)\]', sstripped)
                    if wm:
                        stdout_warnings.append({
                            "test_id": wm.group(2),
                            "severity": "Warning",
                            "description": wm.group(1).strip(),
                            "solution": "",
                        })

                # Parse suggestion lines: "* Suggestion text [TEST-ID]"
                if in_suggestions:
                    if sstripped.startswith('*'):
                        sm = re.match(r'^\*\s+(.+?)\s+\[([A-Z0-9_-]+)\]', sstripped)
                        if sm:
                            last_suggestion = {
                                "test_id": sm.group(2),
                                "description": sm.group(1).strip(),
                                "solution": "",
                                "details": "",
                            }
                            stdout_suggestions.append(last_suggestion)
                    elif last_suggestion and sstripped.startswith('- Details'):
                        dm = re.match(r'^-\s*Details\s*:\s*(.+)', sstripped)
                        if dm:
                            last_suggestion["details"] = dm.group(1).strip()
                    elif last_suggestion and sstripped.startswith('- Solution'):
                        sm2 = re.match(r'^-\s*Solution\s*:\s*(.+)', sstripped)
                        if sm2:
                            last_suggestion["solution"] = sm2.group(1).strip()

            # Use stdout data if report.dat had none
            if len(report["warnings"]) == 0 and stdout_warnings:
                report["warnings"] = stdout_warnings
            if len(report["suggestions"]) == 0 and stdout_suggestions:
                report["suggestions"] = stdout_suggestions

        except Exception:
            pass

    # Fallback: datetime from file modification time
    if not report["datetime_start"]:
        for fpath in ["/var/log/lynis-output.log", "/var/log/lynis-report.dat"]:
            if os.path.isfile(fpath):
                try:
                    import time
                    mtime = os.path.getmtime(fpath)
                    report["datetime_start"] = time.strftime(
                        "%Y-%m-%d %H:%M", time.localtime(mtime)
                    )
                    break
                except Exception:
                    pass

    # Fallback: get kernel from uname if still empty
    if not report["kernel_version"]:
        try:
            rc, out, _ = _run_cmd(["uname", "-r"])
            if rc == 0 and out.strip():
                report["kernel_version"] = out.strip()
        except Exception:
            pass

    # Fallback: get hostname from system
    if not report["hostname"]:
        try:
            import socket
            report["hostname"] = socket.gethostname()
        except Exception:
            pass

    # Fallback: get installed packages count
    if report["installed_packages"] == 0:
        try:
            rc, out, _ = _run_cmd(["dpkg", "-l"])
            if rc == 0 and out:
                # Count lines that start with "ii " (installed packages)
                count = sum(1 for l in out.splitlines() if l.startswith("ii "))
                if count > 0:
                    report["installed_packages"] = count
        except Exception:
            pass

    # ── Proxmox Context: classify warnings/suggestions ────────────────
    # Proxmox VE is a hypervisor with specific requirements that cause
    # Lynis to flag items that are normal/expected in this environment.
    # We classify each finding and calculate an adjusted score.

    PVE_WARNING_CONTEXT = {
        "FIRE-4512": {
            "reason": "Proxmox uses pve-firewall which manages iptables/nftables rules dynamically. Direct iptables rules are not used.",
            "expected": True,
        },
        "NETW-3015": {
            "reason": "Network bridges (vmbr*) operate in promiscuous mode by design to forward traffic between VMs/containers.",
            "expected": True,
        },
        "MAIL-8818": {
            "reason": "Postfix is used by Proxmox for system notifications. The SMTP banner can be customized but is low risk on an internal server.",
            "expected": False,
            "severity_override": "low",
        },
        "NETW-2705": {
            "reason": "Single DNS server is common in home/lab environments. Add a secondary DNS in /etc/resolv.conf if possible.",
            "expected": False,
            "severity_override": "low",
        },
        "PKGS-7392": {
            "reason": "Package updates should be applied regularly. Check if the 'vulnerable' packages are Proxmox-specific packages pending a PVE update.",
            "expected": False,
        },
    }

    PVE_SUGGESTION_CONTEXT = {
        "BOOT-5122": {
            "reason": "GRUB password is recommended for physical servers but less critical for headless/remote Proxmox nodes.",
            "expected": False,
            "severity_override": "low",
        },
        "BOOT-5264": {
            "reason": "Many Proxmox core services (pve-*, corosync, spiceproxy, etc.) run without systemd hardening. This is by design as they need broad system access.",
            "expected": True,
        },
        "KRNL-5788": {
            "reason": "Proxmox uses its own kernel (pve-kernel) which may not place vmlinuz in the standard location.",
            "expected": True,
        },
        "AUTH-9282": {
            "reason": "Proxmox system accounts (www-data, backup, etc.) don't use password expiry. Only applies to interactive user accounts.",
            "expected": True,
        },
        "AUTH-9284": {
            "reason": "Locked system accounts are normal in Proxmox (daemon, nobody, etc.).",
            "expected": True,
        },
        "USB-1000": {
            "reason": "USB passthrough to VMs may require USB drivers. Disable only if USB passthrough is not needed.",
            "expected": False,
            "severity_override": "low",
        },
        "STRG-1846": {
            "reason": "FireWire is typically not used in modern servers. Safe to disable.",
            "expected": False,
            "severity_override": "low",
        },
        "NETW-3200": {
            "reason": "Protocols dccp, sctp, rds, tipc are typically not needed. Can be disabled via modprobe blacklist.",
            "expected": False,
        },
        "SSH-7408": {
            "reason": "SSH hardening is recommended but PermitRootLogin is required for Proxmox API/CLI management. Other SSH settings can be tuned.",
            "expected": False,
        },
        "FILE-6310": {
            "reason": "Separate partitions for /home and /var are best practice but Proxmox typically uses a simple partition layout with LVM-thin for VM storage.",
            "expected": True,
        },
        "KRNL-6000": {
            "reason": "Some sysctl values differ because Proxmox needs IP forwarding, bridge-nf-call, and relaxed kernel settings for VM/container networking.",
            "expected": True,
        },
        "HRDN-7230": {
            "reason": "A malware scanner (rkhunter, ClamAV) is recommended but optional for a dedicated hypervisor.",
            "expected": False,
            "severity_override": "low",
        },
        "HRDN-7222": {
            "reason": "Restricting compiler access is good practice on production servers. Less critical on a hypervisor where only root has access.",
            "expected": False,
            "severity_override": "low",
        },
        "FINT-4350": {
            "reason": "File integrity monitoring (AIDE, Tripwire) is recommended for production but optional for home/lab environments.",
            "expected": False,
            "severity_override": "low",
        },
        "ACCT-9622": {
            "reason": "Process accounting is useful for forensics but not required for a hypervisor.",
            "expected": False,
            "severity_override": "low",
        },
        "ACCT-9626": {
            "reason": "Sysstat is useful for performance monitoring but not a security requirement.",
            "expected": False,
            "severity_override": "low",
        },
        "ACCT-9628": {
            "reason": "Auditd provides detailed audit logging. Recommended for production, optional for home/lab.",
            "expected": False,
            "severity_override": "low",
        },
        "TOOL-5002": {
            "reason": "Automation tools (Ansible, Puppet) are useful for multi-node clusters but not required for single-node setups.",
            "expected": True,
        },
        "LOGG-2154": {
            "reason": "External logging is recommended for production but optional for single-node environments.",
            "expected": False,
            "severity_override": "low",
        },
        "BANN-7126": {
            "reason": "Legal banners in /etc/issue are recommended for compliance but not a security risk.",
            "expected": False,
            "severity_override": "low",
        },
        "BANN-7130": {
            "reason": "Legal banners in /etc/issue.net are recommended for compliance but not a security risk.",
            "expected": False,
            "severity_override": "low",
        },
    }

    # Apply Proxmox context to warnings
    pve_expected_warnings = 0
    for w in report["warnings"]:
        tid = w.get("test_id", "")
        ctx = PVE_WARNING_CONTEXT.get(tid)
        if ctx:
            w["proxmox_context"] = ctx["reason"]
            w["proxmox_expected"] = ctx.get("expected", False)
            if ctx.get("severity_override"):
                w["proxmox_severity"] = ctx["severity_override"]
            if ctx.get("expected", False):
                pve_expected_warnings += 1
        else:
            w["proxmox_context"] = ""
            w["proxmox_expected"] = False

    # Apply Proxmox context to suggestions
    pve_expected_suggestions = 0
    for s in report["suggestions"]:
        tid = s.get("test_id", "")
        ctx = PVE_SUGGESTION_CONTEXT.get(tid)
        if ctx:
            s["proxmox_context"] = ctx["reason"]
            s["proxmox_expected"] = ctx.get("expected", False)
            if ctx.get("severity_override"):
                s["proxmox_severity"] = ctx["severity_override"]
            if ctx.get("expected", False):
                pve_expected_suggestions += 1
        else:
            s["proxmox_context"] = ""
            s["proxmox_expected"] = False

    # Calculate Proxmox-adjusted score
    # Lynis score is based on total tests and findings.
    # We boost the score proportionally to the expected items.
    raw_score = report["hardening_index"] or 0
    total_findings = len(report["warnings"]) + len(report["suggestions"])
    expected_findings = pve_expected_warnings + pve_expected_suggestions
    if total_findings > 0 and raw_score > 0:
        # Each finding roughly reduces the score. Expected findings should
        # not penalize. We estimate the boost proportionally.
        penalty_per_finding = (100 - raw_score) / max(total_findings, 1)
        boost = int(penalty_per_finding * expected_findings * 0.8)
        adjusted_score = min(100, raw_score + boost)
    else:
        adjusted_score = raw_score

    report["proxmox_adjusted_score"] = adjusted_score
    report["proxmox_expected_warnings"] = pve_expected_warnings
    report["proxmox_expected_suggestions"] = pve_expected_suggestions
    report["proxmox_context_applied"] = True

    return report


# -------------------------------------------------------------------
# Uninstall Functions
# -------------------------------------------------------------------

def uninstall_fail2ban():
    """
    Uninstall Fail2Ban and clean up all configuration.
    Returns (success, message).
    """
    try:
        # Stop fail2ban service
        _run_cmd(["systemctl", "stop", "fail2ban"], timeout=30)
        _run_cmd(["systemctl", "disable", "fail2ban"], timeout=10)
        
        # Stop and remove auth logger services
        _run_cmd(["systemctl", "stop", "proxmox-auth-logger.service"], timeout=10)
        _run_cmd(["systemctl", "disable", "proxmox-auth-logger.service"], timeout=10)
        _run_cmd(["systemctl", "stop", "ssh-auth-logger.service"], timeout=10)
        _run_cmd(["systemctl", "disable", "ssh-auth-logger.service"], timeout=10)
        
        # Remove systemd service files
        for svc_file in [
            "/etc/systemd/system/proxmox-auth-logger.service",
            "/etc/systemd/system/ssh-auth-logger.service",
        ]:
            if os.path.exists(svc_file):
                os.remove(svc_file)
        
        _run_cmd(["systemctl", "daemon-reload"], timeout=10)
        
        # Remove log files created by auth loggers
        for log_file in ["/var/log/proxmox-auth.log", "/var/log/ssh-auth.log"]:
            if os.path.exists(log_file):
                os.remove(log_file)
        
        # Purge fail2ban package
        _run_cmd(["apt-get", "purge", "-y", "fail2ban"], timeout=120)
        
        # Remove configuration files
        for cfg_file in [
            "/etc/fail2ban/jail.d/proxmox.conf",
            "/etc/fail2ban/jail.d/proxmenux.conf",
            "/etc/fail2ban/filter.d/proxmox.conf",
            "/etc/fail2ban/filter.d/proxmenux.conf",
            "/etc/fail2ban/jail.local",
        ]:
            if os.path.exists(cfg_file):
                os.remove(cfg_file)
        
        # Restore SSH MaxAuthTries if backup exists
        base_dir = "/usr/local/share/proxmenux"
        backup_file = os.path.join(base_dir, "sshd_maxauthtries_backup")
        sshd_config = "/etc/ssh/sshd_config"
        if os.path.exists(backup_file) and os.path.exists(sshd_config):
            try:
                with open(backup_file, 'r') as f:
                    original_val = f.read().strip()
                if original_val:
                    with open(sshd_config, 'r') as f:
                        content = f.read()
                    import re
                    content = re.sub(
                        r'^MaxAuthTries.*$',
                        f'MaxAuthTries {original_val}',
                        content,
                        flags=re.MULTILINE
                    )
                    with open(sshd_config, 'w') as f:
                        f.write(content)
                    _run_cmd(["systemctl", "reload", "sshd"], timeout=10)
                os.remove(backup_file)
            except Exception:
                pass
        
        # Remove journald drop-in
        journald_dropin = "/etc/systemd/journald.conf.d/proxmenux-loglevel.conf"
        if os.path.exists(journald_dropin):
            os.remove(journald_dropin)
            _run_cmd(["systemctl", "restart", "systemd-journald"], timeout=30)
        
        # Update component status
        components_file = os.path.join(base_dir, "components_status.json")
        if os.path.exists(components_file):
            try:
                import json
                with open(components_file, 'r') as f:
                    components = json.load(f)
                if "fail2ban" in components:
                    components["fail2ban"]["status"] = "removed"
                    components["fail2ban"]["version"] = ""
                    with open(components_file, 'w') as f:
                        json.dump(components, f, indent=2)
            except Exception:
                pass
        
        return True, "Fail2Ban has been uninstalled successfully"
    except Exception as e:
        return False, f"Error uninstalling Fail2Ban: {str(e)}"


def uninstall_lynis():
    """
    Uninstall Lynis and clean up all files.
    Returns (success, message).
    """
    try:
        import shutil
        
        # Remove installation directory
        if os.path.exists("/opt/lynis"):
            shutil.rmtree("/opt/lynis")
        
        # Remove wrapper script
        if os.path.exists("/usr/local/bin/lynis"):
            os.remove("/usr/local/bin/lynis")
        
        # Remove report files
        for report_file in [
            "/var/log/lynis-report.dat",
            "/var/log/lynis.log",
            "/var/log/lynis-output.log",
        ]:
            if os.path.exists(report_file):
                os.remove(report_file)
        
        # Update component status
        base_dir = "/usr/local/share/proxmenux"
        components_file = os.path.join(base_dir, "components_status.json")
        if os.path.exists(components_file):
            try:
                import json
                with open(components_file, 'r') as f:
                    components = json.load(f)
                if "lynis" in components:
                    components["lynis"]["status"] = "removed"
                    components["lynis"]["version"] = ""
                    with open(components_file, 'w') as f:
                        json.dump(components, f, indent=2)
            except Exception:
                pass
        
        return True, "Lynis has been uninstalled successfully"
    except Exception as e:
        return False, f"Error uninstalling Lynis: {str(e)}"