Configure SSL encryption and authentication for ClamAV cluster with high availability scanning

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default configuration
DEFAULT_NODE_IPS="192.168.1.10,192.168.1.11,192.168.1.12"
NODE_IPS="${1:-$DEFAULT_NODE_IPS}"
CURRENT_NODE="${2:-1}"

usage() {
    echo "Usage: $0 [NODE_IPS] [CURRENT_NODE]"
    echo "  NODE_IPS: Comma-separated list of cluster node IPs (default: $DEFAULT_NODE_IPS)"
    echo "  CURRENT_NODE: Current node number 1-3 (default: 1)"
    echo "Example: $0 '10.0.1.10,10.0.1.11,10.0.1.12' 1"
    exit 1
}

error_exit() {
    echo -e "${RED}ERROR: $1${NC}" >&2
    exit 1
}

warn() {
    echo -e "${YELLOW}WARNING: $1${NC}"
}

success() {
    echo -e "${GREEN}SUCCESS: $1${NC}"
}

# Validate arguments
if [[ ! "$NODE_IPS" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    error_exit "Invalid NODE_IPS format. Use comma-separated IPs like: 192.168.1.10,192.168.1.11,192.168.1.12"
fi

if [[ ! "$CURRENT_NODE" =~ ^[1-3]$ ]]; then
    error_exit "CURRENT_NODE must be 1, 2, or 3"
fi

# Parse node IPs
IFS=',' read -ra NODE_ARRAY <<< "$NODE_IPS"
NODE1_IP="${NODE_ARRAY[0]}"
NODE2_IP="${NODE_ARRAY[1]}"
NODE3_IP="${NODE_ARRAY[2]}"

# Get current node IP
case $CURRENT_NODE in
    1) CURRENT_IP="$NODE1_IP" ;;
    2) CURRENT_IP="$NODE2_IP" ;;
    3) CURRENT_IP="$NODE3_IP" ;;
esac

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    error_exit "This script must be run as root"
fi

# Cleanup function for rollback
cleanup() {
    warn "Script failed. Cleaning up..."
    systemctl stop clamav-daemon haproxy 2>/dev/null || true
    rm -rf /etc/clamav/ssl 2>/dev/null || true
}

trap cleanup ERR

# Detect distribution
echo "[1/10] Detecting operating system..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            SERVICE_CMD="systemctl"
            CLAMAV_CONF="/etc/clamav/clamd.conf"
            FRESHCLAM_CONF="/etc/clamav/freshclam.conf"
            HAPROXY_CONF="/etc/haproxy/haproxy.cfg"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            SERVICE_CMD="systemctl"
            CLAMAV_CONF="/etc/clamd.d/scan.conf"
            FRESHCLAM_CONF="/etc/freshclam.conf"
            HAPROXY_CONF="/etc/haproxy/haproxy.cfg"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            SERVICE_CMD="systemctl"
            CLAMAV_CONF="/etc/clamd.d/scan.conf"
            FRESHCLAM_CONF="/etc/freshclam.conf"
            HAPROXY_CONF="/etc/haproxy/haproxy.cfg"
            ;;
        *)
            error_exit "Unsupported distribution: $ID"
            ;;
    esac
    success "Detected $PRETTY_NAME"
else
    error_exit "Cannot detect operating system"
fi

# Update system packages
echo "[2/10] Updating system packages..."
case $PKG_MGR in
    apt) apt update && apt upgrade -y ;;
    *) $PKG_INSTALL update -y ;;
esac

# Install packages
echo "[3/10] Installing ClamAV and dependencies..."
case $ID in
    ubuntu|debian)
        $PKG_INSTALL clamav clamav-daemon clamav-freshclam openssl haproxy
        ;;
    *)
        $PKG_INSTALL clamav clamd clamav-update openssl haproxy
        # Enable EPEL for additional packages if needed
        if command -v dnf >/dev/null 2>&1; then
            dnf install -y epel-release 2>/dev/null || true
        fi
        ;;
esac

# Create SSL directory and certificates
echo "[4/10] Creating SSL Certificate Authority..."
mkdir -p /etc/clamav/ssl
cd /etc/clamav/ssl

# Generate CA
openssl genrsa -out ca-key.pem 4096
openssl req -new -x509 -days 3650 -key ca-key.pem -out ca-cert.pem -subj "/CN=ClamAV-CA/O=Internal/C=US"

echo "[5/10] Generating node certificates..."
# Generate certificates for all nodes
for i in {1..3}; do
    node_ip="${NODE_ARRAY[$((i-1))]}"
    openssl genrsa -out "node${i}-key.pem" 2048
    openssl req -new -key "node${i}-key.pem" -out "node${i}-csr.pem" -subj "/CN=${node_ip}/O=ClamAV-Node/C=US"
    openssl x509 -req -days 365 -in "node${i}-csr.pem" -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out "node${i}-cert.pem"
    rm "node${i}-csr.pem"
done

echo "[6/10] Setting SSL certificate permissions..."
chown -R root:clamav /etc/clamav/ssl
chmod 750 /etc/clamav/ssl
chmod 640 /etc/clamav/ssl/*.pem
chmod 600 /etc/clamav/ssl/*-key.pem

# Configure ClamAV daemon
echo "[7/10] Configuring ClamAV daemon..."
# Create clamav user if it doesn't exist
if ! id clamav >/dev/null 2>&1; then
    useradd -r -s /bin/false clamav
fi

# Create log directory
mkdir -p /var/log/clamav
chown clamav:clamav /var/log/clamav
chmod 755 /var/log/clamav

# Configure ClamAV based on distribution
cat > "$CLAMAV_CONF" << EOF
# Network configuration with SSL
TCPSocket 3310
TCPAddr $CURRENT_IP
MaxConnectionQueueLength 200
MaxThreads 20

# SSL Configuration
SSL yes
SSLCertificate /etc/clamav/ssl/node${CURRENT_NODE}-cert.pem
SSLKey /etc/clamav/ssl/node${CURRENT_NODE}-key.pem
SSLCACertificate /etc/clamav/ssl/ca-cert.pem
SSLVerifyClient yes

# Security settings
User clamav
LogFile /var/log/clamav/clamav.log
LogTime yes
LogClean yes
LogSyslog yes
LogRotate yes
ExtendedDetectionInfo yes

# Performance tuning
ReadTimeout 300
CommandReadTimeout 30
SendBufTimeout 500
MaxQueue 1000
IdleTimeout 120
ExcludePath ^/proc/
ExcludePath ^/sys/
ExcludePath ^/dev/

# Database settings
DatabaseDirectory /var/lib/clamav
EOF

# Configure freshclam
echo "[8/10] Configuring FreshClam..."
sed -i 's/^Example/#Example/' "$FRESHCLAM_CONF" 2>/dev/null || true
echo "DatabaseOwner clamav" >> "$FRESHCLAM_CONF"

# Configure HAProxy for load balancing
echo "[9/10] Configuring HAProxy load balancer..."
cat > "$HAPROXY_CONF" << EOF
global
    daemon
    user haproxy
    group haproxy
    log stdout local0

defaults
    mode tcp
    timeout connect 10s
    timeout client 30s
    timeout server 30s
    log global

frontend clamav_frontend
    bind *:3310 ssl crt /etc/clamav/ssl/node${CURRENT_NODE}-cert.pem
    default_backend clamav_cluster

backend clamav_cluster
    balance roundrobin
    option tcp-check
    server node1 $NODE1_IP:3310 check ssl verify required ca-file /etc/clamav/ssl/ca-cert.pem
    server node2 $NODE2_IP:3310 check ssl verify required ca-file /etc/clamav/ssl/ca-cert.pem
    server node3 $NODE3_IP:3310 check ssl verify required ca-file /etc/clamav/ssl/ca-cert.pem
EOF

# Create combined certificate for HAProxy
cat "/etc/clamav/ssl/node${CURRENT_NODE}-cert.pem" "/etc/clamav/ssl/node${CURRENT_NODE}-key.pem" > "/etc/clamav/ssl/node${CURRENT_NODE}-combined.pem"
chmod 600 "/etc/clamav/ssl/node${CURRENT_NODE}-combined.pem"

# Update virus definitions
echo "Updating virus definitions..."
freshclam

# Start and enable services
echo "[10/10] Starting and enabling services..."
case $ID in
    ubuntu|debian)
        $SERVICE_CMD enable clamav-daemon clamav-freshclam haproxy
        $SERVICE_CMD start clamav-freshclam
        $SERVICE_CMD start clamav-daemon
        $SERVICE_CMD start haproxy
        ;;
    *)
        # RHEL-based systems may use clamd@scan
        $SERVICE_CMD enable clamd@scan clamav-freshclam haproxy
        $SERVICE_CMD start clamav-freshclam
        $SERVICE_CMD start clamd@scan
        $SERVICE_CMD start haproxy
        ;;
esac

# Configure firewall
if command -v ufw >/dev/null 2>&1; then
    ufw allow 3310/tcp
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-port=3310/tcp
    firewall-cmd --reload
fi

# Verification
echo "Verifying installation..."
sleep 5

if $SERVICE_CMD is-active --quiet clamav-daemon || $SERVICE_CMD is-active --quiet clamd@scan; then
    success "ClamAV daemon is running"
else
    error_exit "ClamAV daemon failed to start"
fi

if $SERVICE_CMD is-active --quiet haproxy; then
    success "HAProxy is running"
else
    warn "HAProxy may not be running correctly"
fi

if netstat -tlnp | grep -q ":3310"; then
    success "ClamAV is listening on port 3310"
else
    warn "ClamAV may not be listening on the expected port"
fi

success "ClamAV SSL cluster node $CURRENT_NODE installation completed successfully!"
echo "Node IP: $CURRENT_IP"
echo "SSL certificates created for all cluster nodes"
echo "Load balancer configured with SSL termination"
echo ""
echo "Next steps:"
echo "1. Run this script on the other cluster nodes with appropriate CURRENT_NODE values"
echo "2. Copy SSL certificates to other nodes or generate them there"
echo "3. Test connectivity between cluster nodes"
echo "4. Monitor logs at /var/log/clamav/clamav.log"