sosetup-network

#!/bin/bash
#
# Copyright (C) 2010,2011,2012,2013,2014 Doug Burks
# Copyright (C) 2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License Version 2 as
# published by the Free Software Foundation.  You may not use, modify or
# distribute this program under any other version of the GNU General
# Public License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

source /usr/sbin/sosetup-common

#########################################
# Variables
#########################################
LOGDIR=/var/log/nsm
LOG=$LOGDIR/sosetup-network.log

function ASK_FOR_NETWORK_CONFIG() {
#########################################
# Check if we've already run
#########################################
if grep "Security Onion" /etc/network/interfaces >/dev/null 2>&1; then
	TEXT='It looks like /etc/network/interfaces has already been configured by this script.\n\nWould you like to skip network configuration?'
	YES='Yes, skip network configuration!'
	NO='No, I need to re-configure /etc/network/interfaces.'
	promptyesno
	ANSWER="$?"
	if [ $ANSWER -eq 1 ]; then
	    [ $DEBUG -eq 1 ] && echo "DEBUG: Selected No.  Reconfiguring network interfaces."
	else
	    [ $DEBUG -eq 1 ] && echo "DEBUG: Selected Yes.  Skipping network configuration."
	    # exit 0 so we can continue running Setup
	    exit 0
	fi
else
	# First-time user.  Ask if they want to continue.
	TEXT='Would you like to configure /etc/network/interfaces now?\n\nThis is HIGHLY recommended as it will automatically optimize your network interfaces.\n\nThis includes disabling any NIC offload features which may interfere with traffic analysis.\n\nIf you choose NO, you should manually configure your interfaces per the instructions at:\nhttps://securityonion.net/docs/NetworkConfiguration'
	YES='Yes, configure /etc/network/interfaces!'
	NO='No, not right now.'
	promptyesno
	ANSWER="$?"
	if [ $ANSWER -eq 1 ]; then
	    [ $DEBUG -eq 1 ] && echo "DEBUG: Selected No."
	    # exit 0 so we can continue running Setup
	    exit 0
	else
	    [ $DEBUG -eq 1 ] && echo "DEBUG: Selected Yes."
	fi
fi

#########################################
# Check hostname
#########################################
NEWHOSTNAME="$HOSTNAME"
if [ "$HOSTNAME" = "securityonion" ]; then
	VALID="no"
        while [ $VALID = "no" ]; do
		NEWHOSTNAME=$(promptinput "Your hostname is currently $HOSTNAME.  If this machine will be part of a distributed deployment, we recommend a more unique name to avoid name collisions." "$HOSTNAME")
		if [ $? = 1 ]; then
			if [ $DEBUG -eq 1 ]; then
				echo "DEBUG: Selected Cancel.  Exiting."   && exit 1
			else
				exit 1
			fi
		fi
		if [ "$NEWHOSTNAME" = "" ]; then
			prompterror "Please enter hostname!"
		else
			VALID="yes"
			if [ "$HOSTNAME" != "$NEWHOSTNAME" ]; then
				HOSTNAME_TEXT="- Set hostname to $NEWHOSTNAME.\n"
			else
				HOSTNAME_TEXT=""
			fi
			[ $DEBUG -eq 1 ] && echo "DEBUG: NEWHOSTNAME set to $NEWHOSTNAME."
		fi
	done

fi

#########################################
# Choose management interface
#########################################
# Get a list of all possible interfaces
#VALID="no"
MGMT_INTERFACE=`awk '/:/ {print $1}' /proc/net/dev | tr -d ':' | grep -v "^lo$" | grep -v "^docker" | grep -v "^br-" | grep -v "^veth" | sort`
# If there's only one interface, then MGMT_INTERFACE will have the right one
# Otherwise, let the user select
NUM_MGMT_INTERFACES=0
for i in `echo $MGMT_INTERFACE`; do
	let NUM_MGMT_INTERFACES=NUM_MGMT_INTERFACES+1
done

if [ $NUM_MGMT_INTERFACES -eq 0 ]; then
	prompterror "No interfaces found!"
	exit
elif [ $NUM_MGMT_INTERFACES -eq 1 ]; then
	TEXT="You only have one interface ($MGMT_INTERFACE), which will be configured as a management interface."
	if [ "$OUTPUT" = "gui" ]; then
		zenity --info --title="$TITLE" --text="$TEXT" --no-wrap
	else
		whiptail --title="$TITLE" --msgbox "$TEXT" 10 75
	fi
elif [ $NUM_MGMT_INTERFACES -gt 1 ]; then
VALID="no"
while [ $VALID = "no" ]; do
	TEXT='Which network interface should be the management interface?'
	if [ "$OUTPUT" = "gui" ]; then
		INPUT=`awk '/:/ {print $1}' /proc/net/dev | tr -d ':' | grep -v "^lo$" | grep -v "^docker" | grep -v "^br-" | grep -v "^veth" | sort | while read INT; do echo -n "FALSE $INT "; done`
		MGMT_INTERFACE=`zenity --list --radiolist --column "1" --column="2" --hide-header --title="$TITLE" --text="$TEXT" $INPUT 2>/dev/null`
	else
		INPUT=`awk '/:/ {print $1}' /proc/net/dev | tr -d ':' | grep -v "^lo$" | grep -v "^docker" | grep -v "^br-" | grep -v "^veth" | sort | while read INT; do echo -n "$INT OFF "; done`
		MGMT_INTERFACE=$(whiptail --title="$TITLE" --radiolist --noitem "$TEXT" 20 75 13 $INPUT 3>&1 1>&2 2>&3)
	fi

        if [ $? = 1 ]; then
		if [ $DEBUG -eq 1 ]; then
			 echo "DEBUG: Selected Cancel.  Exiting." && exit 1
		else
			exit 1
		fi
	fi
        if ! [ -z $MGMT_INTERFACE ]; then
		VALID="yes" && [ $DEBUG -eq 1 ] && echo "DEBUG: Selected $MGMT_INTERFACE as the management interface."
        else
		prompterror "Please select a management interface!"
	fi
done
fi

#########################################
# Choose static or DHCP configuration for management interface
#########################################
VALID="no"
while [ $VALID = "no" ]; do
	TEXT="Should $MGMT_INTERFACE use DHCP or static addressing?\n\nStatic addressing is highly recommended for production deployments."
	if [ "$OUTPUT" = "gui" ]; then
		MGMT_CONFIG_TYPE=`zenity --list --radiolist --column "1" --column "2" --hide-header --title="$TITLE" TRUE static FALSE DHCP --text="$TEXT"`
	else
		MGMT_CONFIG_TYPE=$(whiptail --title="$TITLE" --radiolist --noitem "$TEXT" 12 75 2 static ON DHCP OFF 3>&1 1>&2 2>&3)
	fi
	if [ $? = 1 ]; then
		if [ $DEBUG -eq 1 ]; then
			echo "DEBUG: Selected Cancel.  Exiting." && exit 1
		else
			exit 1
		fi
	fi

	if ! [ -z $MGMT_CONFIG_TYPE ]; then
		VALID="yes"
	elif [ -z $MGMT_CONFIG_TYPE ]; then
        	prompterror "Please select DHCP or static addressing!"
	fi
done

#Define a function to validate IP addresses
is_ip() {
	case "$*" in
		""|*[!0-9.]*) return 1 ;;
	esac
	oldIFS=$IFS
	IFS='.'
	set -- $*
	IFS=$oldIFS
	[ $# -eq 4 ] || return 1
	for ipseg in $1 $2 $3 $4; do
		case $ipseg in
			*[!0-9]*) return 1 ;;
		esac
		[ $ipseg -le 255 ] || return 1
	done
}

if [ "$MGMT_CONFIG_TYPE" = "DHCP" ]; then
	MANAGEMENT_TEXT="Configure the management interface $MGMT_INTERFACE using DHCP."
	[ $DEBUG -eq 1 ] && echo "DEBUG: Configuring $MGMT_INTERFACE using DHCP."
elif [ "$MGMT_CONFIG_TYPE" = "static" ]; then
	# Obtain network settings for management interface 
	# Enter static management IP address
	[  $DEBUG -eq 1 ] && echo "DEBUG: Configuring $MGMT_INTERFACE with a static IP address."

	VALID="no"
        while [ $VALID = "no" ]; do
		ADDRESS=$(promptinput "Enter a static IP address for your management interface (e.g., 192.168.1.100):")
		if [ $? = 1 ]; then
			if [ $DEBUG -eq 1 ]; then
				echo "DEBUG: Selected Cancel.  Exiting." && exit 1
			else
				exit 1
			fi
		fi
		if [ "$ADDRESS" = "" ]; then
			prompterror "Please enter a valid IP address!"
		fi
		is_ip $ADDRESS && VALID="yes"
	done
          
	# Enter subnet mask
	VALID="no"
        while [ $VALID = "no" ]; do
		NETMASK=$(promptinput "Enter your network's subnet mask (e.g., 255.255.255.0):")
		if [ $? = 1 ]; then
			if [ $DEBUG -eq 1 ]; then
				echo "DEBUG: Selected Cancel.  Exiting" && exit 1
			else
				exit 1
			fi
		fi
		if [ "$NETMASK" = "" ]; then
			prompterror "Please enter a valid subnet mask!"
		else
			is_ip $NETMASK && VALID="yes"
			[ $DEBUG -eq 1 ] && echo "DEBUG: Subnet mask set to $NETMASK."
		fi
	done

	# Enter gateway IP address
	VALID="no"
        while [ $VALID = "no" ]; do
		GATEWAY=$(promptinput "Enter your gateway's IP address (e.g., 192.168.1.1):")
		if [ $? = 1 ]; then
			if [ $DEBUG -eq 1 ]; then
				echo "DEBUG: Selected Cancel.  Exiting." && exit 1
			else
				exit 1
			fi
		fi
		if [ "$GATEWAY" = "" ]; then
			prompterror "Please enter a valid IP address!"
		fi

		is_ip $GATEWAY && VALID="yes"
	done

        [ $DEBUG -eq 1 ] && echo "DEBUG: Gateway IP address set to $GATEWAY."

	# Enter DNS server address
	VALID="no"
        while [ $VALID = "no" ]; do
        	NAMESERVER=$(promptinput "Enter one or more DNS server IP addresses, separated by spaces:")
		if [ $? = 1 ]; then
			if [ $DEBUG -eq 1 ] ;then
				echo "DEBUG: Selected Cancel.  Exiting." && exit 1
			else
				exit 1
			fi
		fi
		if [ "$NAMESERVER" = "" ]; then
			prompterror "Please enter a valid IP address!"
		else
			VALID="yes"
		fi
		for i in `echo $NAMESERVER`; do
			is_ip $i || VALID="no"
			[ $DEBUG -eq 1 ] && echo "DEBUG: DNS server(s) set to $NAMESERVER."
		done
	done
          
	# Enter domain search order
	VALID="no"
        while [ $VALID = "no" ]; do
		DOMAIN=$(promptinput "Enter your local domain name (e.g., example.com):")
		if [ $? = 1 ]; then
			if [ $DEBUG -eq 1 ]; then
				echo "DEBUG: Selected Cancel.  Exiting."   && exit 1
			else
				exit 1
			fi
		fi
		if [ "$DOMAIN" = "" ]; then
			prompterror "Please enter local domain name!"
		else
			VALID="yes"
			[ $DEBUG -eq 1 ] && echo "DEBUG: Domain set to $DOMAIN."
		fi
	done
          
	MANAGEMENT_TEXT="Configure the management interface $MGMT_INTERFACE as follows:\n   Set static IP address of $ADDRESS\n   Set the gateway IP address to $GATEWAY\n   Set the network mask to $NETMASK\n   Set the DNS server(s) to $NAMESERVER\n   Set the DNS domain to $DOMAIN"
fi
#########################################
# Sniffing interfaces
#########################################
# Get potential monitor interfaces (i.e., additional interfaces other than previously configured management interface)
MON_INTERFACES=`awk '/:/ {print $1}' /proc/net/dev | tr -d ':' | grep -v "^lo$" | grep -v "^docker" | grep -v "^br-" | grep -v "^veth" | sort | sed "s|$MGMT_INTERFACE||g"`

NUM_MON_INTERFACES=0
for i in `echo $MON_INTERFACES`; do
	let NUM_MON_INTERFACES=NUM_MON_INTERFACES+1
done

# If there are additional interfaces, offer option to configure them as monitor interfaces
CONFIG_MON_INTERFACES=0
if [ $NUM_MON_INTERFACES -gt 0 ]; then
    TEXT='Would you like to configure sniffing (monitor) interfaces?\n
    - Choose YES if this is a Standalone or Sensor installation\n
    - Choose NO if this is a Server-only installation
      (only management interface will be configured)'
    YES='Yes, configure sniffing interfaces.'
    NO='No, only configure a management interface.'
	promptyesno
	ANSWER="$?"
	if [ $ANSWER -eq 1 ]; then
		[ $DEBUG -eq 1 ] && echo "DEBUG: Selected No.  Configuring management interface only."
		# Set MON_INTERFACES to null so that later when we iterate over the list it won't do anything
		MON_INTERFACES=""
	else
		[ $DEBUG -eq 1 ] && echo "DEBUG: Selected Yes.  Configuring monitor interfaces."
		CONFIG_MON_INTERFACES=1
	fi
	
	# If user selected "Yes" to configure monitor interfaces, continue configuration
	if [ $CONFIG_MON_INTERFACES -eq 1 ]; then
		SNIFF_TEXT=""
		if [ $NUM_MON_INTERFACES -gt 0 ]; then
			TEXT='Please select any additional interfaces that will be used for sniffing.'
			if [ "$OUTPUT" = "gui" ]; then
				INPUT=`for i in $MON_INTERFACES; do echo -n "TRUE $i "; done`
				MON_INTERFACES=`zenity --list --checklist --column "Enabled" --column "Interface" --hide-header --title="$TITLE" --text="$TEXT" $INPUT |sed 's/|/ /g'`
			else
				INPUT=`for i in $MON_INTERFACES; do echo -n "$i ON "; done`
				MON_INTERFACES=$(whiptail --title="$TITLE" --checklist --noitem "$TEXT" 20 75 13 $INPUT 3>&1 1>&2 2>&3 |sed 's/"//g')
			fi
			if [ "$MON_INTERFACES" = "" ]; then
				[ $DEBUG -eq 1 ] && echo "DEBUG: Selected Cancel.  Exiting."
				exit 1
			else
				[ $DEBUG -eq 1 ] && echo "DEBUG: Configuring the following interfaces: $MON_INTERFACES."
			fi
			SNIFF_TEXT="- Configure the following interface(s) for sniffing:\n   $MON_INTERFACES"
		fi
	fi
fi
#########################################
# Confirmation dialog box
#########################################
TEXT="We're about to do the following:\n$HOSTNAME_TEXT- $MANAGEMENT_TEXT \n$SNIFF_TEXT \n\nWe're about to make changes to your system!\n\nWould you like to continue?"
YES="Yes, make changes!"
NO="No, do not make changes."
promptyesno
ANSWER="$?"
if [ $ANSWER -eq 1 ]; then
	[ $DEBUG -eq 1 ] && echo "DEBUG: Selected No. Do not proceed."
        exit 1
else
        [ $DEBUG -eq 1 ] && echo "DEBUG: Selected Yes to proceed with all changes."
fi
}

#########################################
# Make changes
#########################################
function CONFIGURE_NETWORK() {

# Create the log directory
mkdir -p $LOGDIR

# Change hostname if necessary
if [ "$HOSTNAME" != "$NEWHOSTNAME" ]; then
	sed -i "s|$HOSTNAME|$NEWHOSTNAME|" /etc/hosts
	sed -i "s|$HOSTNAME|$NEWHOSTNAME|" /etc/hostname
fi

# Disable network-manager
if [ -f /etc/init/network-manager.conf ]; then
	echo "manual" > /etc/init/network-manager.override
fi

# Remastersys deletes /etc/resolv.conf by default
# This prevents resolvconf from executing and breaks DNS if user chooses Static IP
[ -f /run/resolvconf/resolv.conf ] || touch /run/resolvconf/resolv.conf
[ -f /etc/resolv.conf ] || ln -s /run/resolvconf/resolv.conf /etc/resolv.conf

# Backup existing network interface configuration first
FILE=/etc/network/interfaces
if [ -f $FILE ]; then
	cp $FILE /etc/network/interfaces.bak
fi

# Write new network interface configuration file
cat << EOF > $FILE
# This configuration was created by the Security Onion setup script.
#
# The original network interface configuration file was backed up to:
# /etc/network/interfaces.bak.
#   
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# loopback network interface
auto lo
iface lo inet loopback

EOF
    
if [ "$MGMT_CONFIG_TYPE" = "DHCP" ]; then

cat << EOF >> $FILE
# Management network interface
auto $MGMT_INTERFACE
iface $MGMT_INTERFACE inet dhcp

EOF

else

cat << EOF >> $FILE
# Management network interface
auto $MGMT_INTERFACE
iface $MGMT_INTERFACE inet static
  address $ADDRESS
  gateway $GATEWAY
  netmask $NETMASK
  dns-nameservers $NAMESERVER
  dns-domain $DOMAIN

EOF

fi

# Configure remaining interfaces
for INTERFACE in $MON_INTERFACES
do
            	# Get max RX size for monitored interface
		MAX_RX=$(ethtool -g $INTERFACE | grep -m 1 RX | cut -d\: -f2 | awk '{sub(/^[ \t]+/, "")};1')

cat << EOF >> $FILE
auto $INTERFACE
iface $INTERFACE inet manual
  up ip link set \$IFACE promisc on arp off up
  down ip link set \$IFACE promisc off down
  post-up for i in rx tx sg tso ufo gso gro lro; do ethtool -K \$IFACE \$i off; done
  post-up echo 1 > /proc/sys/net/ipv6/conf/\$IFACE/disable_ipv6
  # You probably don't need to enable or edit the following setting,
  # but it is included for completeness.
  # Note that increasing beyond the default may result in inconsistent traffic:
  # https://taosecurity.blogspot.com/2019/04/troubleshooting-nsm-virtualization.html
  # post-up ethtool -G \$IFACE rx $MAX_RX

EOF

done

} 

function SET_UTC() {
	timedatectl set-timezone Etc/UTC >> $LOG 2>&1
	cp /etc/localtime /var/ossec/etc/localtime
	chown root:ossec /var/ossec/etc/localtime
}

# End of functions

#########################################
# Check to see if the user provided an answer file
#########################################
while getopts "hf:" OPTION
do
     case $OPTION in
         h)
                usage
                exit 0
                ;;
         f)
                ANSWERFILE="$OPTARG"
                # Verify answerfile exists and then read it into memory
                if [ -f "$ANSWERFILE" ]; then
                        source "$ANSWERFILE"
			# copy INTERFACES into MON_INTERFACES
			MON_INTERFACES="$SNIFFING_INTERFACES"
                        ADVANCED_SETUP="1"
                else
                        echo "Error accessing $ANSWERFILE"
                        exit 1
                fi
             ;;
     esac
done

# If the user didn't provide an answerfile, then ask them the questions
[ -f "$ANSWERFILE" ] || ASK_FOR_NETWORK_CONFIG

CONFIGURE_NETWORK

SET_UTC

# Update wallpaper
cp /usr/share/securityonion/securityonion_setup_again.jpg /usr/share/securityonion/securityonion.jpg

#########################################
# Reboot dialog box
#########################################
TEXT="Network configuration complete!\n\nYou'll need to reboot and then launch Setup again to continue the second phase of Setup.\n\nIf you need to manually modify any other network settings, you can edit /etc/network/interfaces now before rebooting.\n\nWould you like to reboot now?"

if [ -f "$ANSWERFILE" ]; then
	echo "$TEXT" | sed 's|\\n|\n|g' | sed 's|\\||g'
	echo "Press Enter to reboot now or Ctrl-c to cancel."
	read input
else
	YES="Yes, reboot!"
	NO="No, do not reboot."
	promptyesno
	ANSWER="$?"
	if [ $ANSWER -eq 1 ]; then
       	 [ $DEBUG -eq 1 ] && echo "DEBUG: Selected No. Do not proceed."
	        exit
	else
	        [ $DEBUG -eq 1 ] && echo "DEBUG: Selected Yes to proceed with all changes."
	fi
fi

reboot
# If we don't sleep, then it will continue onto normal Setup before the actual reboot
sleep 100