Configure Linux kernel parameters with sysctl for system optimization

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Script configuration
SCRIPT_NAME="$(basename "$0")"
BACKUP_DIR="/etc/sysctl.backup.$(date +%Y%m%d_%H%M%S)"

# Usage message
usage() {
    echo "Usage: $SCRIPT_NAME [OPTIONS]"
    echo "Configure Linux kernel parameters with sysctl for system optimization"
    echo ""
    echo "OPTIONS:"
    echo "  --network-only    Apply only network optimizations"
    echo "  --security-only   Apply only security hardening"
    echo "  --memory-only     Apply only memory management settings"
    echo "  --custom FILE     Apply settings from custom file"
    echo "  --rollback        Rollback to previous configuration"
    echo "  --help           Show this help message"
    exit 1
}

# Logging functions
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function
cleanup() {
    if [ $? -ne 0 ]; then
        log_error "Script failed. Keeping backup at $BACKUP_DIR for manual recovery."
        log_error "To rollback: sudo cp $BACKUP_DIR/sysctl.conf /etc/sysctl.conf && sudo sysctl -p"
    fi
}

trap cleanup EXIT

# Check if running as root or with sudo
check_privileges() {
    if [ "$EUID" -ne 0 ]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Auto-detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                SYSCTL_PKG="procps"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                SYSCTL_PKG="procps-ng"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                SYSCTL_PKG="procps-ng"
                ;;
            *)
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
}

# Install required packages
install_packages() {
    echo "[1/7] Installing required packages..."
    
    if [ "$PKG_MGR" = "apt" ]; then
        apt update > /dev/null 2>&1
    fi
    
    if ! command -v sysctl >/dev/null 2>&1; then
        log_info "Installing $SYSCTL_PKG package"
        $PKG_INSTALL $SYSCTL_PKG > /dev/null 2>&1
    else
        log_info "sysctl already installed"
    fi
}

# Create backup
create_backup() {
    echo "[2/7] Creating backup of current configuration..."
    
    mkdir -p "$BACKUP_DIR"
    chmod 755 "$BACKUP_DIR"
    
    if [ -f /etc/sysctl.conf ]; then
        cp /etc/sysctl.conf "$BACKUP_DIR/"
    fi
    
    if [ -d /etc/sysctl.d ]; then
        cp -r /etc/sysctl.d "$BACKUP_DIR/"
    fi
    
    log_info "Backup created at $BACKUP_DIR"
}

# Apply network optimizations
apply_network_settings() {
    log_info "Applying network optimizations"
    
    cat > /etc/sysctl.d/99-network-optimization.conf << 'EOF'
# Network buffer sizes
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.core.rmem_default = 65536
net.core.wmem_default = 65536

# Network performance
net.core.netdev_max_backlog = 5000
net.core.somaxconn = 1024

# TCP settings
net.ipv4.tcp_rmem = 4096 87380 134217728
net.ipv4.tcp_wmem = 4096 65536 134217728
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 120
net.ipv4.tcp_max_syn_backlog = 8192

# Enable BBR congestion control if available
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq
EOF
    chmod 644 /etc/sysctl.d/99-network-optimization.conf
}

# Apply security settings
apply_security_settings() {
    log_info "Applying security hardening"
    
    cat > /etc/sysctl.d/99-security-hardening.conf << 'EOF'
# Kernel security
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.kexec_load_disabled = 1
kernel.yama.ptrace_scope = 2

# Network security
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1

# ICMP security
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
EOF
    chmod 644 /etc/sysctl.d/99-security-hardening.conf
}

# Apply memory management settings
apply_memory_settings() {
    log_info "Applying memory management optimizations"
    
    cat > /etc/sysctl.d/99-memory-optimization.conf << 'EOF'
# Memory management
vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5
vm.vfs_cache_pressure = 50
vm.min_free_kbytes = 65536

# Shared memory
kernel.shmmax = 268435456
kernel.shmall = 4194304

# File handles
fs.file-max = 2097152
EOF
    chmod 644 /etc/sysctl.d/99-memory-optimization.conf
}

# Apply custom settings from file
apply_custom_settings() {
    local custom_file="$1"
    
    if [ ! -f "$custom_file" ]; then
        log_error "Custom file not found: $custom_file"
        exit 1
    fi
    
    log_info "Applying custom settings from $custom_file"
    cp "$custom_file" /etc/sysctl.d/99-custom-settings.conf
    chmod 644 /etc/sysctl.d/99-custom-settings.conf
}

# Configure main sysctl settings
configure_sysctl() {
    echo "[3/7] Configuring sysctl parameters..."
    
    # Create sysctl.d directory if it doesn't exist
    mkdir -p /etc/sysctl.d
    chmod 755 /etc/sysctl.d
    
    case "$MODE" in
        "network")
            apply_network_settings
            ;;
        "security")
            apply_security_settings
            ;;
        "memory")
            apply_memory_settings
            ;;
        "custom")
            apply_custom_settings "$CUSTOM_FILE"
            ;;
        *)
            apply_network_settings
            apply_security_settings
            apply_memory_settings
            ;;
    esac
}

# Apply settings
apply_settings() {
    echo "[4/7] Applying new sysctl settings..."
    
    # Test configuration first
    if ! sysctl -p /etc/sysctl.d/*.conf >/dev/null 2>&1; then
        log_error "Configuration test failed. Rolling back..."
        rollback_settings
        exit 1
    fi
    
    # Apply all settings
    sysctl --system > /dev/null 2>&1
    log_info "Settings applied successfully"
}

# Rollback function
rollback_settings() {
    echo "[5/7] Rolling back to previous configuration..."
    
    if [ -d "$BACKUP_DIR" ]; then
        if [ -f "$BACKUP_DIR/sysctl.conf" ]; then
            cp "$BACKUP_DIR/sysctl.conf" /etc/sysctl.conf
        fi
        
        if [ -d "$BACKUP_DIR/sysctl.d" ]; then
            rm -rf /etc/sysctl.d/*
            cp -r "$BACKUP_DIR/sysctl.d/"* /etc/sysctl.d/ 2>/dev/null || true
        fi
        
        sysctl --system > /dev/null 2>&1
        log_info "Rollback completed"
    else
        log_error "No backup found for rollback"
        exit 1
    fi
}

# Verify configuration
verify_settings() {
    echo "[6/7] Verifying configuration..."
    
    local failed=0
    
    # Test a few key parameters
    if [ "$MODE" != "custom" ]; then
        # Check if we can read some values
        sysctl kernel.dmesg_restrict >/dev/null 2>&1 || ((failed++))
        sysctl vm.swappiness >/dev/null 2>&1 || ((failed++))
        sysctl net.core.rmem_max >/dev/null 2>&1 || ((failed++))
    fi
    
    if [ $failed -eq 0 ]; then
        log_info "Configuration verification passed"
    else
        log_warn "Some parameters may not be available on this kernel"
    fi
}

# Display summary
display_summary() {
    echo "[7/7] Configuration completed successfully!"
    echo ""
    echo "Summary:"
    echo "- Backup created at: $BACKUP_DIR"
    echo "- Configuration files in: /etc/sysctl.d/"
    echo "- Settings applied and active"
    echo ""
    echo "To view current parameters:"
    echo "  sysctl -a | grep <parameter>"
    echo ""
    echo "To rollback if needed:"
    echo "  sudo $SCRIPT_NAME --rollback"
}

# Main execution
main() {
    # Parse arguments
    MODE="all"
    CUSTOM_FILE=""
    ROLLBACK=false
    
    while [[ $# -gt 0 ]]; do
        case $1 in
            --network-only)
                MODE="network"
                shift
                ;;
            --security-only)
                MODE="security"
                shift
                ;;
            --memory-only)
                MODE="memory"
                shift
                ;;
            --custom)
                MODE="custom"
                CUSTOM_FILE="$2"
                shift 2
                ;;
            --rollback)
                ROLLBACK=true
                shift
                ;;
            --help)
                usage
                ;;
            *)
                log_error "Unknown option: $1"
                usage
                ;;
        esac
    done
    
    # Validate custom file argument
    if [ "$MODE" = "custom" ] && [ -z "$CUSTOM_FILE" ]; then
        log_error "Custom file path required with --custom option"
        usage
    fi
    
    check_privileges
    detect_distro
    
    if [ "$ROLLBACK" = true ]; then
        # Find latest backup
        BACKUP_DIR=$(ls -td /etc/sysctl.backup.* 2>/dev/null | head -1)
        if [ -z "$BACKUP_DIR" ]; then
            log_error "No backup found for rollback"
            exit 1
        fi
        rollback_settings
        log_info "Rollback completed successfully"
        exit 0
    fi
    
    install_packages
    create_backup
    configure_sysctl
    apply_settings
    verify_settings
    display_summary
}

# Handle help request
if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
    usage
fi

main "$@"