Configure Nagios Core 4.5 SSL certificates and security hardening with authentication controls

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
DOMAIN=""
EMAIL=""
NAGIOS_USER="nagiosadmin"

# Print usage
usage() {
    echo "Usage: $0 -d <domain> -e <email> [-u <nagios_user>]"
    echo "  -d: Domain name for SSL certificate (e.g., nagios.example.com)"
    echo "  -e: Email address for Let's Encrypt"
    echo "  -u: Nagios admin username (default: nagiosadmin)"
    exit 1
}

# Parse arguments
while getopts "d:e:u:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        e) EMAIL="$OPTARG" ;;
        u) NAGIOS_USER="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
    usage
fi

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}Error: This script must be run as root or with sudo${NC}"
    exit 1
fi

# Detect distribution
if [[ ! -f /etc/os-release ]]; then
    echo -e "${RED}Error: Cannot detect distribution${NC}"
    exit 1
fi

. /etc/os-release
case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_UPDATE="apt update"
        PKG_INSTALL="apt install -y"
        WEB_SERVICE="apache2"
        WEB_CONFIG_DIR="/etc/apache2/sites-available"
        WEB_ENABLE_CMD="a2ensite"
        WEB_MODULES_CMD="a2enmod"
        PACKAGES="certbot python3-certbot-apache apache2-utils openssl"
        ;;
    almalinux|rocky|centos|rhel|ol|fedora)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf update -y"
        PKG_INSTALL="dnf install -y"
        WEB_SERVICE="httpd"
        WEB_CONFIG_DIR="/etc/httpd/conf.d"
        WEB_ENABLE_CMD=""
        WEB_MODULES_CMD=""
        PACKAGES="certbot python3-certbot-apache httpd-tools openssl mod_ssl"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_UPDATE="yum update -y"
        PKG_INSTALL="yum install -y"
        WEB_SERVICE="httpd"
        WEB_CONFIG_DIR="/etc/httpd/conf.d"
        WEB_ENABLE_CMD=""
        WEB_MODULES_CMD=""
        PACKAGES="certbot python3-certbot-apache httpd-tools openssl mod_ssl"
        ;;
    *)
        echo -e "${RED}Error: Unsupported distribution: $ID${NC}"
        exit 1
        ;;
esac

# Cleanup function
cleanup() {
    echo -e "${YELLOW}Cleaning up on error...${NC}"
    systemctl reload $WEB_SERVICE 2>/dev/null || true
}

trap cleanup ERR

echo -e "${GREEN}Starting Nagios Core 4.5 SSL and Security Hardening${NC}"

# Check prerequisites
echo -e "${YELLOW}[1/8] Checking prerequisites...${NC}"
if [[ ! -d /usr/local/nagios ]]; then
    echo -e "${RED}Error: Nagios Core installation not found at /usr/local/nagios${NC}"
    exit 1
fi

if ! systemctl is-active --quiet $WEB_SERVICE; then
    echo -e "${RED}Error: $WEB_SERVICE is not running${NC}"
    exit 1
fi

# Install required packages
echo -e "${YELLOW}[2/8] Installing required packages...${NC}"
$PKG_UPDATE
$PKG_INSTALL $PACKAGES

# Create virtual host configuration
echo -e "${YELLOW}[3/8] Creating Apache virtual host configuration...${NC}"

if [[ "$ID" == "ubuntu" || "$ID" == "debian" ]]; then
    VHOST_FILE="$WEB_CONFIG_DIR/nagios-ssl.conf"
else
    VHOST_FILE="$WEB_CONFIG_DIR/nagios-ssl.conf"
fi

cat > "$VHOST_FILE" << EOF
<VirtualHost *:80>
    ServerName $DOMAIN
    DocumentRoot /usr/local/nagios/share
    Redirect permanent / https://$DOMAIN/
</VirtualHost>

<VirtualHost *:443>
    ServerName $DOMAIN
    DocumentRoot /usr/local/nagios/share
    
    # SSL Configuration
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder off
    SSLSessionTickets off
    
    # Security Headers
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
    
    # Nagios Configuration
    ScriptAlias /nagios/cgi-bin "/usr/local/nagios/sbin"
    Alias /nagios "/usr/local/nagios/share"
    
    <Directory "/usr/local/nagios/sbin">
        Options ExecCGI
        AllowOverride None
        Require valid-user
        AuthType Basic
        AuthName "Nagios Access"
        AuthUserFile /usr/local/nagios/etc/htpasswd.users
    </Directory>
    
    <Directory "/usr/local/nagios/share">
        Options None
        AllowOverride None
        Require valid-user
        AuthType Basic
        AuthName "Nagios Access"
        AuthUserFile /usr/local/nagios/etc/htpasswd.users
    </Directory>
</VirtualHost>
EOF

chown root:root "$VHOST_FILE"
chmod 644 "$VHOST_FILE"

# Enable Apache modules and site
echo -e "${YELLOW}[4/8] Enabling Apache modules and configuration...${NC}"
if [[ "$ID" == "ubuntu" || "$ID" == "debian" ]]; then
    $WEB_MODULES_CMD ssl headers rewrite
    $WEB_ENABLE_CMD nagios-ssl.conf
fi

systemctl reload $WEB_SERVICE

# Obtain SSL certificate
echo -e "${YELLOW}[5/8] Obtaining SSL certificate...${NC}"
certbot --apache -d "$DOMAIN" --non-interactive --agree-tos --email "$EMAIL"

# Create secure user authentication
echo -e "${YELLOW}[6/8] Creating secure user authentication...${NC}"
mkdir -p /usr/local/nagios/etc
chown nagios:nagcmd /usr/local/nagios/etc
chmod 755 /usr/local/nagios/etc

echo -e "${GREEN}Creating admin user: $NAGIOS_USER${NC}"
echo -e "${YELLOW}Please enter a strong password (12+ characters with mixed case, numbers, symbols):${NC}"
htpasswd -c -B /usr/local/nagios/etc/htpasswd.users "$NAGIOS_USER"

chown nagios:nagcmd /usr/local/nagios/etc/htpasswd.users
chmod 640 /usr/local/nagios/etc/htpasswd.users

# Configure user authorization
echo -e "${YELLOW}[7/8] Configuring user authorization...${NC}"
CGI_CONFIG="/usr/local/nagios/etc/cgi.cfg"

if [[ -f "$CGI_CONFIG" ]]; then
    # Backup original config
    cp "$CGI_CONFIG" "$CGI_CONFIG.backup"
    
    # Update authorization settings
    sed -i "s/authorized_for_system_information=.*/authorized_for_system_information=$NAGIOS_USER/" "$CGI_CONFIG"
    sed -i "s/authorized_for_configuration_information=.*/authorized_for_configuration_information=$NAGIOS_USER/" "$CGI_CONFIG"
    sed -i "s/authorized_for_system_commands=.*/authorized_for_system_commands=$NAGIOS_USER/" "$CGI_CONFIG"
    sed -i "s/authorized_for_all_services=.*/authorized_for_all_services=$NAGIOS_USER/" "$CGI_CONFIG"
    sed -i "s/authorized_for_all_hosts=.*/authorized_for_all_hosts=$NAGIOS_USER/" "$CGI_CONFIG"
    sed -i "s/authorized_for_all_service_commands=.*/authorized_for_all_service_commands=$NAGIOS_USER/" "$CGI_CONFIG"
    sed -i "s/authorized_for_all_host_commands=.*/authorized_for_all_host_commands=$NAGIOS_USER/" "$CGI_CONFIG"
fi

# Configure firewall
if command -v ufw >/dev/null 2>&1; then
    ufw allow 443/tcp
    ufw allow 80/tcp
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=https
    firewall-cmd --permanent --add-service=http
    firewall-cmd --reload
fi

# Restart services
systemctl restart nagios
systemctl restart $WEB_SERVICE

# Verification
echo -e "${YELLOW}[8/8] Performing verification checks...${NC}"

# Check SSL certificate
if certbot certificates | grep -q "$DOMAIN"; then
    echo -e "${GREEN}✓ SSL certificate installed successfully${NC}"
else
    echo -e "${RED}✗ SSL certificate verification failed${NC}"
    exit 1
fi

# Check services
if systemctl is-active --quiet nagios; then
    echo -e "${GREEN}✓ Nagios service is running${NC}"
else
    echo -e "${RED}✗ Nagios service is not running${NC}"
    exit 1
fi

if systemctl is-active --quiet $WEB_SERVICE; then
    echo -e "${GREEN}✓ $WEB_SERVICE service is running${NC}"
else
    echo -e "${RED}✗ $WEB_SERVICE service is not running${NC}"
    exit 1
fi

# Check configuration files
if [[ -f /usr/local/nagios/etc/htpasswd.users ]]; then
    echo -e "${GREEN}✓ User authentication file created${NC}"
else
    echo -e "${RED}✗ User authentication file missing${NC}"
    exit 1
fi

echo -e "${GREEN}Nagios Core SSL and security hardening completed successfully!${NC}"
echo -e "${GREEN}Access your secure Nagios installation at: https://$DOMAIN/nagios${NC}"
echo -e "${YELLOW}Certificate will auto-renew. Check status with: certbot certificates${NC}"