Configure Cassandra SSL encryption and authentication with security hardening

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Usage function
usage() {
    echo "Usage: $0 [CLUSTER_NAME] [KEYSTORE_PASSWORD]"
    echo "  CLUSTER_NAME: Name for the Cassandra cluster (default: cassandra-cluster)"
    echo "  KEYSTORE_PASSWORD: Password for SSL keystore (default: generated)"
    exit 1
}

# Error handling
cleanup() {
    echo -e "${RED}[ERROR]${NC} Installation failed. Cleaning up..."
    systemctl stop cassandra 2>/dev/null || true
    rm -f /tmp/cassandra-ssl-setup.lock
}
trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}[ERROR]${NC} This script must be run as root"
    exit 1
fi

# Parse arguments
CLUSTER_NAME="${1:-cassandra-cluster}"
KEYSTORE_PASS="${2:-$(openssl rand -base64 32 | tr -d '=+/' | cut -c1-25)}"

if [[ $# -gt 2 ]]; then
    usage
fi

# Lock file to prevent multiple runs
LOCK_FILE="/tmp/cassandra-ssl-setup.lock"
if [[ -f "$LOCK_FILE" ]]; then
    echo -e "${RED}[ERROR]${NC} Another instance is running"
    exit 1
fi
touch "$LOCK_FILE"

echo -e "${GREEN}[INFO]${NC} Starting Cassandra SSL configuration for cluster: $CLUSTER_NAME"

# Auto-detect distribution
echo -e "${YELLOW}[1/8]${NC} Detecting distribution..."
if [[ ! -f /etc/os-release ]]; then
    echo -e "${RED}[ERROR]${NC} Cannot detect distribution"
    exit 1
fi

source /etc/os-release
case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_UPDATE="apt update"
        PKG_INSTALL="apt install -y"
        JAVA_PKG="openjdk-11-jdk-headless"
        CASSANDRA_USER="cassandra"
        CASSANDRA_GROUP="cassandra"
        CASSANDRA_HOME="/var/lib/cassandra"
        CASSANDRA_CONF="/etc/cassandra"
        ;;
    almalinux|rocky|centos|rhel|ol)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf check-update || true"
        PKG_INSTALL="dnf install -y"
        JAVA_PKG="java-11-openjdk-headless"
        CASSANDRA_USER="cassandra"
        CASSANDRA_GROUP="cassandra"
        CASSANDRA_HOME="/var/lib/cassandra"
        CASSANDRA_CONF="/etc/cassandra/default.conf"
        ;;
    fedora)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf check-update || true"
        PKG_INSTALL="dnf install -y"
        JAVA_PKG="java-11-openjdk-headless"
        CASSANDRA_USER="cassandra"
        CASSANDRA_GROUP="cassandra"
        CASSANDRA_HOME="/var/lib/cassandra"
        CASSANDRA_CONF="/etc/cassandra/default.conf"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_UPDATE="yum check-update || true"
        PKG_INSTALL="yum install -y"
        JAVA_PKG="java-11-amazon-corretto-headless"
        CASSANDRA_USER="cassandra"
        CASSANDRA_GROUP="cassandra"
        CASSANDRA_HOME="/var/lib/cassandra"
        CASSANDRA_CONF="/etc/cassandra/default.conf"
        ;;
    *)
        echo -e "${RED}[ERROR]${NC} Unsupported distribution: $ID"
        exit 1
        ;;
esac

# Update package repositories
echo -e "${YELLOW}[2/8]${NC} Updating package repositories..."
$PKG_UPDATE > /dev/null

# Install prerequisites
echo -e "${YELLOW}[3/8]${NC} Installing prerequisites..."
$PKG_INSTALL wget curl gnupg2 openssl > /dev/null

# Install Java and Cassandra
echo -e "${YELLOW}[4/8]${NC} Installing Java and Cassandra..."
$PKG_INSTALL $JAVA_PKG > /dev/null

# Add Cassandra repository and install
case "$ID" in
    ubuntu|debian)
        wget -q -O - https://www.apache.org/dist/cassandra/KEYS | apt-key add - > /dev/null 2>&1
        echo "deb https://debian.cassandra.apache.org 40x main" > /etc/apt/sources.list.d/cassandra.sources.list
        apt update > /dev/null
        $PKG_INSTALL cassandra > /dev/null
        CASSANDRA_CONF="/etc/cassandra"
        ;;
    *)
        cat > /etc/yum.repos.d/cassandra.repo << 'EOF'
[cassandra]
name=Apache Cassandra
baseurl=https://redhat.cassandra.apache.org/40x/
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://www.apache.org/dist/cassandra/KEYS
EOF
        $PKG_INSTALL cassandra > /dev/null
        # Adjust config path for RHEL-based systems
        if [[ -d "/etc/cassandra/default.conf" ]]; then
            CASSANDRA_CONF="/etc/cassandra/default.conf"
        elif [[ -d "/etc/cassandra" ]]; then
            CASSANDRA_CONF="/etc/cassandra"
        fi
        ;;
esac

# Create SSL directory structure
echo -e "${YELLOW}[5/8]${NC} Setting up SSL certificate infrastructure..."
SSL_DIR="$CASSANDRA_CONF/ssl"
mkdir -p "$SSL_DIR"
chown root:$CASSANDRA_GROUP "$SSL_DIR"
chmod 750 "$SSL_DIR"

# Generate SSL certificates
cd "$SSL_DIR"

# Create keystore for server certificate
keytool -genkeypair \
    -keyalg RSA \
    -alias cassandra \
    -keystore cassandra-server-keystore.jks \
    -storepass "$KEYSTORE_PASS" \
    -keypass "$KEYSTORE_PASS" \
    -validity 365 \
    -keysize 2048 \
    -dname "CN=$(hostname -f),OU=IT,O=$CLUSTER_NAME,L=City,ST=State,C=US" \
    > /dev/null 2>&1

# Export certificate from keystore
keytool -export \
    -alias cassandra \
    -file cassandra-server-cert.crt \
    -keystore cassandra-server-keystore.jks \
    -storepass "$KEYSTORE_PASS" \
    > /dev/null 2>&1

# Create truststore and import certificate
keytool -import \
    -alias cassandra \
    -file cassandra-server-cert.crt \
    -keystore cassandra-server-truststore.jks \
    -storepass "$KEYSTORE_PASS" \
    -noprompt \
    > /dev/null 2>&1

# Set proper permissions on SSL files
chown root:$CASSANDRA_GROUP *.jks *.crt
chmod 640 *.jks *.crt

# Configure Cassandra SSL settings
echo -e "${YELLOW}[6/8]${NC} Configuring Cassandra SSL encryption..."
CASSANDRA_YAML="$CASSANDRA_CONF/cassandra.yaml"

# Backup original configuration
cp "$CASSANDRA_YAML" "$CASSANDRA_YAML.backup.$(date +%Y%m%d_%H%M%S)"

# Configure client-to-node encryption
cat >> "$CASSANDRA_YAML" << EOF

# SSL Configuration added by installation script
client_encryption_options:
    enabled: true
    optional: false
    keystore: $SSL_DIR/cassandra-server-keystore.jks
    keystore_password: $KEYSTORE_PASS
    truststore: $SSL_DIR/cassandra-server-truststore.jks
    truststore_password: $KEYSTORE_PASS
    protocol: TLS
    algorithm: SunX509
    store_type: JKS
    cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]
    require_client_auth: false

# Inter-node encryption
server_encryption_options:
    internode_encryption: all
    keystore: $SSL_DIR/cassandra-server-keystore.jks
    keystore_password: $KEYSTORE_PASS
    truststore: $SSL_DIR/cassandra-server-truststore.jks
    truststore_password: $KEYSTORE_PASS
    protocol: TLS
    algorithm: SunX509
    store_type: JKS
    cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]
    require_client_auth: false

# Enable authentication
authenticator: PasswordAuthenticator
authorizer: CassandraAuthorizer
EOF

# Configure JVM SSL options
echo -e "${YELLOW}[7/8]${NC} Configuring JVM SSL options..."
JVM_OPTS_FILE="$CASSANDRA_CONF/jvm.options"
if [[ -f "$JVM_OPTS_FILE" ]]; then
    # Add SSL debugging and stronger protocols (commented out debugging for production)
    cat >> "$JVM_OPTS_FILE" << EOF

# SSL Configuration
-Dcom.sun.management.jmxremote.ssl=true
-Dcom.sun.management.jmxremote.ssl.need.client.auth=false
-Dcom.sun.management.jmxremote.ssl.enabled.protocols=TLSv1.2,TLSv1.3
-Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
# -Djavax.net.debug=ssl (uncomment for SSL debugging)
EOF
fi

# Configure firewall
if command -v ufw > /dev/null 2>&1; then
    # Ubuntu/Debian firewall
    ufw allow 9042/tcp comment "Cassandra client SSL" > /dev/null 2>&1 || true
    ufw allow 7001/tcp comment "Cassandra inter-node SSL" > /dev/null 2>&1 || true
elif command -v firewall-cmd > /dev/null 2>&1; then
    # RHEL/CentOS firewall
    firewall-cmd --permanent --add-port=9042/tcp > /dev/null 2>&1 || true
    firewall-cmd --permanent --add-port=7001/tcp > /dev/null 2>&1 || true
    firewall-cmd --reload > /dev/null 2>&1 || true
fi

# Start and enable Cassandra service
systemctl daemon-reload
systemctl enable cassandra > /dev/null 2>&1
systemctl start cassandra

# Wait for Cassandra to start
echo -e "${YELLOW}[8/8]${NC} Starting Cassandra and verifying SSL configuration..."
sleep 10

# Wait for Cassandra to be ready
for i in {1..30}; do
    if netstat -tlnp 2>/dev/null | grep -q ":9042.*LISTEN" || ss -tlnp 2>/dev/null | grep -q ":9042"; then
        break
    fi
    if [[ $i -eq 30 ]]; then
        echo -e "${RED}[ERROR]${NC} Cassandra failed to start within 5 minutes"
        exit 1
    fi
    sleep 10
done

# Verification checks
echo -e "${GREEN}[SUCCESS]${NC} Verifying installation..."

# Check if Cassandra is running
if ! systemctl is-active cassandra > /dev/null 2>&1; then
    echo -e "${RED}[ERROR]${NC} Cassandra service is not running"
    exit 1
fi

# Check SSL port
if ! netstat -tlnp 2>/dev/null | grep -q ":9042.*LISTEN" && ! ss -tlnp 2>/dev/null | grep -q ":9042"; then
    echo -e "${RED}[ERROR]${NC} Cassandra SSL port 9042 is not listening"
    exit 1
fi

# Save keystore password securely
echo "$KEYSTORE_PASS" > "$SSL_DIR/keystore_password"
chown root:$CASSANDRA_GROUP "$SSL_DIR/keystore_password"
chmod 640 "$SSL_DIR/keystore_password"

# Cleanup
rm -f "$LOCK_FILE"

echo -e "${GREEN}[SUCCESS]${NC} Cassandra SSL configuration completed successfully!"
echo ""
echo "SSL Configuration Summary:"
echo "========================="
echo "Cluster Name: $CLUSTER_NAME"
echo "SSL Directory: $SSL_DIR"
echo "Keystore Password: $KEYSTORE_PASS (also saved in $SSL_DIR/keystore_password)"
echo "Client SSL Port: 9042"
echo "Inter-node SSL Port: 7001"
echo ""
echo "Next Steps:"
echo "- Change default cassandra user password using cqlsh --ssl"
echo "- Copy SSL certificates to other cluster nodes"
echo "- Configure client applications to use SSL connection"
echo "- Test SSL connectivity: openssl s_client -connect $(hostname):9042"