#!/bin/bash
# 修复 Administrators 组成员的 authorized_keys 配置

SERVER_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCm/leXfpZ1Ycm7uL3sXYU1Hp5TO42EqUnD5H7SwveTIusF14e5oZf5P72fttGLIxQMFgGdXzu4+coWPmpGsUHjqm4g0FbeL+mjM+0cnqeggoueoFm3dk9y+9jaogjuR2VY9oqbdOvD+L0IfvS+t6WJrYif1MdXOYnH5MfNYtrLb/MWCDiTT4w/Cw0QKSSB3S3+nvYqxD1Ep+wdLrd+SfgiMi2qU/bO7ccEgXwjqiI/4LDHh2r5oajkvdRSuQ75PLSRdFfR+aq/NcV/NJE3YOcb8wVhvVjZZSXQyy8PlqLn6N58qckharwAj6vRxC9CbWB+XDrLOMWOtdq7T7iBPJmy1wVDDyva9wEnKiprdXf+2F/Q57SJjcbPTCt6TqXggQ0hVf7tOK6Wefk5dwPW0P3mdzPTp91s9iU96kM+9VSY0dhKEnim+6IncxEK+hnbAbGOX66MuRmK9u7dYlsjhFq345rNXmkXIIY3VU2GuCBLB4bk88pNubrd8y9S03JbZIU= root@vps21249823.hosteons.com"
MAC_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDuLPlB6X9JC2uP9urgA94wCr7VBPKAX+4j9hR5wc5U5rPDxhKWbFBzRiFU/cssCZlcZbuoWPjrxwtTKR6Tq1++ugHffa2poulXCoufaN5s9kN6US8DNe/q7dulAomwd0pjSDTjhQR4OQG847PqfXz/quU96RfpOrn1WqSRTrzPnVZ885ApNUB7SHd74jrYslwoDRsJu+mS6jjI7NHdNUKTAUBsZWWPmjNO4X1+vEwwK6dZg9i1Z+sz5kLxZ0w+fI1hO6rtR5MPZh8G9JRWiVw3HN0vQtf3zxYtDnzPxELfiE10cctDaDqwMKZ6K73WNlkmoNuM7we7eRlarPGWmGu9 houzi@MichaeldeMBP.lan"
ED25519_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdDnOymO9MaCEwl8q6ewHKCwBHxDKDSud1orvUXEKz+ houzi"

ADMIN_AUTH_KEYS="/c/ProgramData/ssh/administrators_authorized_keys"

echo "=== 诊断 Administrators 组成员问题 ==="
echo ""

# 检查 houzi 是否在 Administrators 组中
echo "步骤 1/5: 检查用户组"
net.exe user houzi | findstr /i "Administrators" > /tmp/admin_check.txt
if [ -s /tmp/admin_check.txt ]; then
    echo "✓ 确认：houzi 是 Administrators 组成员"
    echo "  → 必须使用 C:\\ProgramData\\ssh\\administrators_authorized_keys"
else
    echo "✗ houzi 不是 Administrators 组成员"
    echo "  → 应该使用 C:\\Users\\houzi\\.ssh\\authorized_keys"
    exit 1
fi
echo ""

# 创建 ProgramData\.ssh 目录
echo "步骤 2/5: 创建目录"
mkdir -p "/c/ProgramData/ssh"
echo "✓ 目录已创建"
echo ""

# 写入所有公钥
echo "步骤 3/5: 写入所有公钥"
cat > "$ADMIN_AUTH_KEYS" << 'EOF'
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCm/leXfpZ1Ycm7uL3sXYU1Hp5TO42EqUnD5H7SwveTIusF14e5oZf5P72fttGLIxQMFgGdXzu4+coWPmpGsUHjqm4g0FbeL+mjM+0cnqeggoueoFm3dk9y+9jaogjuR2VY9oqbdOvD+L0IfvS+t6WJrYif1MdXOYnH5MfNYtrLb/MWCDiTT4w/Cw0QKSSB3S3+nvYqxD1Ep+wdLrd+SfgiMi2qU/bO7ccEgXwjqiI/4LDHh2r5oajkvdRSuQ75PLSRdFfR+aq/NcV/NJE3YOcb8wVhvVjZZSXQyy8PlqLn6N58qckharwAj6vRxC9CbWB+XDrLOMWOtdq7T7iBPJmy1wVDDyva9wEnKiprdXf+2F/Q57SJjcbPTCt6TqXggQ0hVf7tOK6Wefk5dwPW0P3mdzPTp91s9iU96kM+9VSY0dhKEnim+6IncxEK+hnbAbGOX66MuRmK9u7dYlsjhFq345rNXmkXIIY3VU2GuCBLB4bk88pNubrd8y9S03JbZIU= root@vps21249823.hosteons.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDuLPlB6X9JC2uP9urgA94wCr7VBPKAX+4j9hR5wc5U5rPDxhKWbFBzRiFU/cssCZlcZbuoWPjrxwtTKR6Tq1++ugHffa2poulXCoufaN5s9kN6US8DNe/q7dulAomwd0pjSDTjhQR4OQG847PqfXz/quU96RfpOrn1WqSRTrzPnVZ885ApNUB7SHd74jrYslwoDRsJu+mS6jjI7NHdNUKTAUBsZWWPmjNO4X1+vEwwK6dZg9i1Z+sz5kLxZ0w+fI1hO6rtR5MPZh8G9JRWiVw3HN0vQtf3zxYtDnzPxELfiE10cctDaDqwMKZ6K73WNlkmoNuM7we7eRlarPGWmGu9 houzi@MichaeldeMBP.lan
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdDnOymO9MaCEwl8q6ewHKCwBHxDKDSud1orvUXEKz+ houzi
EOF
echo "✓ 已写入 3 个公钥"
echo ""

# 设置权限（Administrators 组和 SYSTEM）
echo "步骤 4/5: 设置文件权限"
WIN_PATH="C:\\ProgramData\\ssh\\administrators_authorized_keys"
icacls.exe "$WIN_PATH" //inheritance:r > /dev/null 2>&1
icacls.exe "$WIN_PATH" //grant "BUILTIN\\Administrators:(F)" > /dev/null 2>&1
icacls.exe "$WIN_PATH" //grant "SYSTEM:(F)" > /dev/null 2>&1
echo "✓ 权限已设置（Administrators + SYSTEM）"
echo ""

# 不重启 SSH Server（避免隧道断开）
echo "步骤 5/5: 刷新 SSH 配置（不重启服务）"
echo "注意：不重启 sshd，避免隧道断开"
echo "新连接将自动使用新配置"
echo ""

# 验证
echo "=== 验证配置 ==="
echo "文件路径: C:\\ProgramData\\ssh\\administrators_authorized_keys"
echo "行数: $(wc -l < "$ADMIN_AUTH_KEYS")"
echo ""
echo "文件内容:"
cat "$ADMIN_AUTH_KEYS"
echo ""
echo "✓ 配置完成！现在可以从 Mac 测试连接"
echo ""
echo "测试命令（Mac）:"
echo "  ssh -i ~/.ssh/id_ed25519 -p 26002 houzi@82.29.54.80"
