#!/bin/sh
# OSx OSSEC Agent Installer
# Name: osx-agent-installer.sh
# Copyright Atomicorp 2020
# License: Commercial. Unauthorized redistribution prohibited.

# Variables
PROTOCOL=udp
PORT=1514
AGENT_NAME=$agent_name
ROOT_UID=0
VERSION=031720201532
IS_UPDATE=0

usage_menu () {
  echo "OSx Agent Installer Usage"
  echo "Usage: osx-agent-installer.sh <param>"
  echo "    -h: Shows this message."
  echo
  echo "Mandatory"
  echo "    --server_ip:   IP address of AEO/AWP Hub."
  echo
  echo "Optional"
  echo "    --agent_name: Specify the name to use when registering the agent. [Default: hostname]"
  echo "    --port: Specify the port to register the agent on. [Default: 1514]"
  echo "    --udp/--tcp: Protocol to use to communicate with AEO/AWP Hub. [Default: udp]"
  echo "    --uninstall: Removes the OSSEC agent from this device."
  echo "    --update: Updates the OSSEC agent on this device."

  echo


}


if [[ $* == *--uninstall* ]]; then
  echo "    INFO: Uninstalling ossec-hids-agent ..."
  pkgutil --forget com.atomicorp.ossec.agent
  rm -rf /var/ossec/
  echo "Complete!"
  echo
  exit 0
fi


while [ -n "$1" ]; do
  param=$(echo $1 | awk -F"=" '{print $1}')
  value=$(echo $1 | awk -F"=" '{print $2}')

  case $param in
    *"server_ip"*)
      SERVER_IP=$value
      ;;
    *"auth_ip"*)
      AUTH_IP=$value
      ;;
    *"agent_name"*)
      AGENT_NAME=$value
      ;;

    *"update"*)
      IS_UPDATE=1
      ;;

  esac

  shift
done

if [ ! ${SERVER_IP} ]; then
  echo "    ERROR: AEO/AWP Hub IP address was not specified."
  usage_menu
  exit 1
fi

if [ ! ${AUTH_IP} ]; then
  AUTH_IP=$SERVER_IP
fi

if [[ $* == *--tcp* ]]; then
  PROTOCOL=tcp
fi

if [[ $* == *--udp* ]]; then
  PROTOCOL=udp
fi

if [ ! "$UID" ]; then
  UID=$(id -u)
fi

if [ "$UID" -ne "$ROOT_UID" ] ; then
  echo
  echo "    ERROR: You must be root to run this program."
  echo "    exiting..."
  echo
  exit 1
fi

if [[ "$IS_UPDATE" -eq "1" ]]; then
  VERSION=$(curl -s http://${SERVER_IP}/channels/awp-hub-repo/osx/VERSION | grep VERSION | awk -F'=' '{print $2}')
  RELEASE=$(curl -s http://${SERVER_IP}/channels/awp-hub-repo/osx/VERSION | grep RELEASE | awk -F'=' '{print $2}')

  if [ ! -f ossec-hids-agent-${VERSION}-${RELEASE}.pkg ]; then
    echo "Downloading ossec-hids-agent-${VERSION}-${RELEASE}.pkg ... "
    curl http://${SERVER_IP}/channels/awp-hub-repo/osx/ossec-hids-agent-${VERSION}-${RELEASE}.pkg -O
    echo
  fi

  cp /var/ossec/etc/ossec.conf .

  echo "Installing ossec-hids-agent-${VERSION}-${RELEASE}.pkg ..."
  installer -pkg ossec-hids-agent-${VERSION}-${RELEASE}.pkg -target /

  if [ "$?" -ne "0" ]; then
    echo "   ERROR: Installing ossec-hids-agent-${VERSION}-${RELEASE}.pkg"
    installer -pkg ossec-hids-agent-${VERSION}-${RELEASE}.pkg -target /
    echo "   exiting ..."
    echo
    exit 1
  fi
  echo "VERSION="${VERSION} > /var/ossec/etc/.version
  echo "RELEASE="${RELEASE} >> /var/ossec/etc/.version

  mv ./ossec.conf /var/ossec/etc/ossec.conf

  /var/ossec/bin/ossec-control restart
  echo "Update Complete!"
  exit 0

fi


if [ ! ${AGENT_NAME} ]; then
  echo
  echo "   INFO: Agent name was not detected."
  echo "   Registering agent using default settings."
  echo
fi

osx_install() {
  VERSION=$(curl -s http://${SERVER_IP}/channels/awp-hub-repo/osx/VERSION | grep VERSION | awk -F'=' '{print $2}')
  RELEASE=$(curl -s http://${SERVER_IP}/channels/awp-hub-repo/osx/VERSION | grep RELEASE | awk -F'=' '{print $2}')

  if [ ! -f ossec-hids-agent-${VERSION}-${RELEASE}.pkg ]; then
    echo "Downloading ossec-hids-agent-${VERSION}-${RELEASE}.pkg ... "
    curl http://${SERVER_IP}/channels/awp-hub-repo/osx/ossec-hids-agent-${VERSION}-${RELEASE}.pkg -O
    echo
  fi

  if  pkgutil --packages | egrep -q atomicorp.ossec.agent ; then
  echo
  echo "    ERROR: ossec-hids-agent installation already detected."
  echo "    exiting ..."
  echo
  exit 1
  fi

  echo "Installing ossec-hids-agent-${VERSION}-${RELEASE}.pkg ..."
  installer -pkg ossec-hids-agent-${VERSION}-${RELEASE}.pkg -target /

  if [ "$?" -ne "0" ]; then
    echo "   ERROR: Installing ossec-hids-agent-${VERSION}-${RELEASE}.pkg"
    installer -pkg ossec-hids-agent-${VERSION}-${RELEASE}.pkg -target /
    echo "   exiting ..."
    echo
    exit 1
  fi

  echo "VERSION="${VERSION} > /var/ossec/etc/.version
  echo "RELEASE="${RELEASE} >> /var/ossec/etc/.version

  #Configure the agent.
  echo "Configuring ossec-hids-agent ... "
  osx_configure

  #Register the agent.
  echo "Registering agent with manager ${SERVER_IP} "
  osx_register




  #Error handle
  if [ $? -ne 0 ];then
      echo
      echo "  ERROR: agent-auth failed during registration"
      echo "  exiting ..."
      exit 1
  fi


  echo "Restarting agent to finalize installation"
  /var/ossec/bin/ossec-control restart  >/dev/null 2>&1

  if [ "$?" -ne "0" ]; then
    echo "    ERROR: Restarting ossec-hids-agent"
    echo "    exiting ..."
    exit 1
  fi


  echo
  echo "Installation Complete!"
}


osx_configure () {
  # Test for ossec.conf server-ip
  if ! grep -q ${SERVER_IP} /var/ossec/etc/ossec.conf ; then
      sed -i '' "s/<address>.*/<address>${SERVER_IP}<\/address><port>${PORT}<\/port><protocol>${PROTOCOL}<\/protocol>/g" /var/ossec/etc/ossec-agent.conf
      if [ $? -ne 0 ];then
          echo
          echo "  ERROR: Agent configuration failed "
          echo "  exiting ..."
          exit 1
      fi
  fi
}

osx_register () {

    if [ ${AGENT_NAME} ]; then
      /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${AGENT_NAME}

    else
      /var/ossec/bin/agent-auth -m ${AUTH_IP}
    fi
}


osx_install