Set up OSSEC agent deployment and centralized management with automated configuration

#!/usr/bin/env bash

set -euo pipefail

# OSSEC HIDS Server Installation Script
# Production-quality script for centralized security monitoring

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Configuration
OSSEC_VERSION="3.7.0"
OSSEC_USER="ossec"
OSSEC_GROUP="ossec"
OSSEC_DIR="/var/ossec"
ADMIN_EMAIL=""
SMTP_SERVER="localhost"
ALLOWED_NETWORK=""

# Error handling and cleanup
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
        [ -d "/tmp/ossec-hids-${OSSEC_VERSION}" ] && rm -rf "/tmp/ossec-hids-${OSSEC_VERSION}"
        [ -f "/tmp/${OSSEC_VERSION}.tar.gz" ] && rm -f "/tmp/${OSSEC_VERSION}.tar.gz"
        systemctl stop ossec 2>/dev/null || true
    fi
}
trap cleanup ERR EXIT

usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  -e EMAIL     Admin email address (required)"
    echo "  -s SERVER    SMTP server (default: localhost)"
    echo "  -n NETWORK   Allowed network CIDR (default: auto-detect)"
    echo "  -h           Show this help"
    exit 1
}

# Parse arguments
while getopts "e:s:n:h" opt; do
    case $opt in
        e) ADMIN_EMAIL="$OPTARG" ;;
        s) SMTP_SERVER="$OPTARG" ;;
        n) ALLOWED_NETWORK="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

[ -z "$ADMIN_EMAIL" ] && { echo -e "${RED}Error: Admin email is required${NC}"; usage; }

# Check prerequisites
if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}Error: This script must be run as root${NC}"
    exit 1
fi

echo -e "${BLUE}OSSEC HIDS Server Installation${NC}"
echo "================================="

# Detect distribution
echo -e "${YELLOW}[1/10] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            FIREWALL_CMD="ufw"
            BUILD_DEPS="build-essential gcc make libevent-dev zlib1g-dev libssl-dev libpcre2-dev wget"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            FIREWALL_CMD="firewall-cmd"
            BUILD_DEPS="gcc make libevent-devel zlib-devel openssl-devel pcre2-devel wget"
            if [ "$ID" = "centos" ] && [ "${VERSION_ID%%.*}" -lt 8 ]; then
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                BUILD_DEPS="gcc make libevent-devel zlib-devel openssl-devel pcre-devel wget"
            fi
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            FIREWALL_CMD="firewall-cmd"
            BUILD_DEPS="gcc make libevent-devel zlib-devel openssl-devel pcre-devel wget"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"

# Auto-detect network if not specified
if [ -z "$ALLOWED_NETWORK" ]; then
    echo -e "${YELLOW}[2/10] Auto-detecting network...${NC}"
    DEFAULT_ROUTE=$(ip route | grep default | head -1 | awk '{print $3}')
    if [ -n "$DEFAULT_ROUTE" ]; then
        NETWORK_PREFIX=$(echo "$DEFAULT_ROUTE" | cut -d'.' -f1-3)
        ALLOWED_NETWORK="${NETWORK_PREFIX}.0/24"
    else
        ALLOWED_NETWORK="192.168.1.0/24"
    fi
    echo -e "${GREEN}Using network: $ALLOWED_NETWORK${NC}"
fi

# Update system packages
echo -e "${YELLOW}[3/10] Updating system packages...${NC}"
$PKG_UPDATE

# Install build dependencies
echo -e "${YELLOW}[4/10] Installing build dependencies...${NC}"
if [ "$PKG_MGR" = "dnf" ] || [ "$PKG_MGR" = "yum" ]; then
    if command -v dnf >/dev/null 2>&1; then
        dnf groupinstall -y "Development Tools" 2>/dev/null || yum groupinstall -y "Development Tools"
    else
        yum groupinstall -y "Development Tools"
    fi
fi
$PKG_INSTALL $BUILD_DEPS

# Download OSSEC source
echo -e "${YELLOW}[5/10] Downloading OSSEC source...${NC}"
cd /tmp
wget -q "https://github.com/ossec/ossec-hids/archive/${OSSEC_VERSION}.tar.gz"
tar -xzf "${OSSEC_VERSION}.tar.gz"
cd "ossec-hids-${OSSEC_VERSION}"

# Create installation response file
echo -e "${YELLOW}[6/10] Preparing installation configuration...${NC}"
cat > install_answers.txt << EOF
en
server
/var/ossec
y
${ADMIN_EMAIL}
${SMTP_SERVER}
y
y
y
y
EOF

# Install OSSEC
echo -e "${YELLOW}[7/10] Installing OSSEC server...${NC}"
./install.sh < install_answers.txt

# Configure OSSEC
echo -e "${YELLOW}[8/10] Configuring OSSEC server...${NC}"
cat > "${OSSEC_DIR}/etc/ossec.conf" << EOF
<ossec_config>
  <global>
    <email_notification>yes</email_notification>
    <smtp_server>${SMTP_SERVER}</smtp_server>
    <email_from>ossec@$(hostname)</email_from>
    <email_to>${ADMIN_EMAIL}</email_to>
    <email_maxperhour>10</email_maxperhour>
  </global>

  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>apache_rules.xml</include>
    <include>nginx_rules.xml</include>
    <include>web_rules.xml</include>
    <include>mysql_rules.xml</include>
    <include>postgresql_rules.xml</include>
    <include>firewall_rules.xml</include>
    <include>ossec_rules.xml</include>
    <include>attack_rules.xml</include>
    <include>local_rules.xml</include>
  </rules>

  <syscheck>
    <frequency>7200</frequency>
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin</directories>
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/adjtime</ignore>
  </syscheck>

  <rootcheck>
    <frequency>43200</frequency>
  </rootcheck>

  <remote>
    <connection>secure</connection>
    <port>1514</port>
    <protocol>udp</protocol>
    <allowed-ips>${ALLOWED_NETWORK}</allowed-ips>
  </remote>

  <alerts>
    <log_alert_level>1</log_alert_level>
    <email_alert_level>7</email_alert_level>
  </alerts>

  <command>
    <name>host-deny</name>
    <executable>host-deny.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>

  <command>
    <name>firewall-drop</name>
    <executable>firewall-drop.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>

  <active-response>
    <disabled>no</disabled>
    <command>host-deny</command>
    <location>local</location>
    <level>6</level>
    <timeout>600</timeout>
  </active-response>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/messages</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/secure</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>
</ossec_config>
EOF

# Set proper permissions
chown root:${OSSEC_GROUP} "${OSSEC_DIR}/etc/ossec.conf"
chmod 640 "${OSSEC_DIR}/etc/ossec.conf"

# Configure firewall
echo -e "${YELLOW}[9/10] Configuring firewall...${NC}"
case "$FIREWALL_CMD" in
    ufw)
        if command -v ufw >/dev/null 2>&1; then
            ufw --force enable
            ufw allow 1514/udp comment "OSSEC Agent Communication"
        fi
        ;;
    firewall-cmd)
        if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active firewalld >/dev/null 2>&1; then
            firewall-cmd --permanent --add-port=1514/udp
            firewall-cmd --reload
        fi
        ;;
esac

# Start and enable OSSEC service
echo -e "${YELLOW}[10/10] Starting OSSEC service...${NC}"
"${OSSEC_DIR}/bin/ossec-control" start

# Create systemd service
cat > /etc/systemd/system/ossec.service << EOF
[Unit]
Description=OSSEC Host Intrusion Detection System
After=network.target

[Service]
Type=forking
ExecStart=${OSSEC_DIR}/bin/ossec-control start
ExecStop=${OSSEC_DIR}/bin/ossec-control stop
ExecReload=${OSSEC_DIR}/bin/ossec-control restart
PIDFile=${OSSEC_DIR}/var/run/ossec-monitord.pid

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable ossec
systemctl start ossec

# Cleanup
cd /
rm -rf "/tmp/ossec-hids-${OSSEC_VERSION}" "/tmp/${OSSEC_VERSION}.tar.gz"

# Verification
echo -e "${BLUE}Verifying installation...${NC}"
sleep 5
if systemctl is-active ossec >/dev/null 2>&1; then
    echo -e "${GREEN}✓ OSSEC service is running${NC}"
else
    echo -e "${RED}✗ OSSEC service is not running${NC}"
    exit 1
fi

if [ -f "${OSSEC_DIR}/logs/ossec.log" ]; then
    echo -e "${GREEN}✓ OSSEC logging is active${NC}"
else
    echo -e "${RED}✗ OSSEC logs not found${NC}"
fi

echo -e "${GREEN}"
echo "========================================="
echo "OSSEC HIDS Server Installation Complete"
echo "========================================="
echo -e "${NC}"
echo "Configuration:"
echo "  - OSSEC Directory: ${OSSEC_DIR}"
echo "  - Admin Email: ${ADMIN_EMAIL}"
echo "  - SMTP Server: ${SMTP_SERVER}"
echo "  - Allowed Network: ${ALLOWED_NETWORK}"
echo "  - Listen Port: 1514/udp"
echo ""
echo "Management Commands:"
echo "  - Start:   systemctl start ossec"
echo "  - Stop:    systemctl stop ossec"
echo "  - Status:  systemctl status ossec"
echo "  - Logs:    tail -f ${OSSEC_DIR}/logs/ossec.log"
echo ""
echo "Add agents with: ${OSSEC_DIR}/bin/manage_agents"