Configure SNMP v3 authentication and encryption for secure network monitoring

#!/usr/bin/env bash
set -euo pipefail

# SNMP v3 Configuration Script
# Configures secure SNMP v3 monitoring with authentication and encryption

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default values
MONITORING_IP=""
AUTH_PASS="MyAuthPass123!"
PRIV_PASS="MyPrivPass456!"
ADMIN_AUTH_PASS="AdminAuth789!"
ADMIN_PRIV_PASS="AdminPriv012!"
SNMP_USER="snmpuser"
ADMIN_USER="adminuser"

# Usage function
usage() {
    echo "Usage: $0 -i MONITORING_IP [OPTIONS]"
    echo "Options:"
    echo "  -i IP    Monitoring server IP address (required)"
    echo "  -u USER  SNMP username (default: snmpuser)"
    echo "  -h       Show this help"
    exit 1
}

# Parse arguments
while getopts "i:u:h" opt; do
    case $opt in
        i) MONITORING_IP="$OPTARG" ;;
        u) SNMP_USER="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

if [[ -z "$MONITORING_IP" ]]; then
    echo -e "${RED}Error: Monitoring IP address is required${NC}"
    usage
fi

# Validate IP address format
if [[ ! $MONITORING_IP =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
    echo -e "${RED}Error: Invalid IP address format${NC}"
    exit 1
fi

# Cleanup function for rollback
cleanup() {
    echo -e "${YELLOW}Error occurred. Cleaning up...${NC}"
    systemctl start snmpd 2>/dev/null || true
}
trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}Error: This script must be run as root${NC}"
    exit 1
fi

echo -e "${GREEN}Starting SNMP v3 configuration...${NC}"

# Detect distribution and set package manager
echo "[1/10] Detecting distribution..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            FIREWALL_CMD="ufw"
            SNMP_PACKAGES="snmpd snmp snmp-mibs-downloader"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            FIREWALL_CMD="firewall-cmd"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-devel"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            FIREWALL_CMD="firewall-cmd"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-devel"
            ;;
        *) 
            echo -e "${RED}Error: Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}Error: Cannot detect distribution${NC}"
    exit 1
fi

# Update package repositories
echo "[2/10] Updating package repositories..."
$PKG_UPDATE >/dev/null 2>&1

# Install SNMP packages
echo "[3/10] Installing SNMP packages..."
$PKG_INSTALL $SNMP_PACKAGES >/dev/null 2>&1

# Stop SNMP daemon for configuration
echo "[4/10] Stopping SNMP daemon..."
systemctl stop snmpd

# Create SNMP v3 user with authentication
echo "[5/10] Creating SNMP v3 user..."
net-snmp-create-v3-user -ro -A SHA -X AES -a "$AUTH_PASS" -x "$PRIV_PASS" "$SNMP_USER" >/dev/null 2>&1

# Configure SNMP daemon settings
echo "[6/10] Configuring SNMP daemon..."
cat > /etc/snmp/snmpd.conf << EOF
# SNMP v3 Configuration
# System information
sysLocation "Server Room A"
sysContact "admin@example.com"
sysServices 72

# SNMP v3 user access - read-only access to system tree
rouser $SNMP_USER

# Security settings - Only allow SNMP v3
# Disable community strings
#rocommunity public default

# Process and disk monitoring
proc sshd
proc httpd 5 10
disk / 10%
disk /var 10%
disk /tmp 10%

# Load monitoring
load 12 14 14

# Network interface monitoring
interface lo
interface eth0
EOF

# Configure firewall access
echo "[7/10] Configuring firewall..."
case "$PKG_MGR" in
    apt)
        if command -v ufw >/dev/null 2>&1; then
            ufw --force enable >/dev/null 2>&1
            ufw allow from "$MONITORING_IP" to any port 161 >/dev/null 2>&1
            ufw reload >/dev/null 2>&1
        fi
        ;;
    dnf|yum)
        if systemctl is-active firewalld >/dev/null 2>&1; then
            firewall-cmd --add-rich-rule="rule family=\"ipv4\" source address=\"$MONITORING_IP\" port protocol=\"udp\" port=\"161\" accept" --permanent >/dev/null 2>&1
            firewall-cmd --reload >/dev/null 2>&1
        fi
        ;;
esac

# Set file permissions
echo "[8/10] Setting secure file permissions..."
chmod 600 /etc/snmp/snmpd.conf
chown root:root /etc/snmp/snmpd.conf
chmod 755 /var/lib/snmp
if [[ -f /var/lib/snmp/snmpd.conf ]]; then
    chmod 600 /var/lib/snmp/snmpd.conf
    chown root:root /var/lib/snmp/snmpd.conf
fi

# Start and enable SNMP daemon
echo "[9/10] Starting SNMP daemon..."
systemctl enable snmpd >/dev/null 2>&1
systemctl start snmpd

# Create additional admin user
echo "[10/10] Creating administrative user..."
systemctl stop snmpd
net-snmp-create-v3-user -A SHA -X AES -a "$ADMIN_AUTH_PASS" -x "$ADMIN_PRIV_PASS" "$ADMIN_USER" >/dev/null 2>&1

# Add admin user to configuration
echo "rwuser $ADMIN_USER" >> /etc/snmp/snmpd.conf
systemctl start snmpd

# Verify installation
echo -e "${YELLOW}Verifying configuration...${NC}"
sleep 2

if systemctl is-active snmpd >/dev/null 2>&1; then
    echo -e "${GREEN}✓ SNMP daemon is running${NC}"
else
    echo -e "${RED}✗ SNMP daemon failed to start${NC}"
    exit 1
fi

if ss -ulnp | grep -q ":161 "; then
    echo -e "${GREEN}✓ SNMP listening on port 161${NC}"
else
    echo -e "${RED}✗ SNMP not listening on port 161${NC}"
    exit 1
fi

echo -e "${GREEN}SNMP v3 configuration completed successfully!${NC}"
echo ""
echo -e "${YELLOW}Configuration Summary:${NC}"
echo "SNMP Version: v3"
echo "Read-only user: $SNMP_USER"
echo "Read-write user: $ADMIN_USER"
echo "Monitoring IP allowed: $MONITORING_IP"
echo "Authentication: SHA"
echo "Privacy: AES"
echo ""
echo -e "${YELLOW}Monitoring Tool Configuration:${NC}"
echo "SNMP version: SNMPv3"
echo "Security name: $SNMP_USER"
echo "Security level: authPriv"
echo "Authentication protocol: SHA"
echo "Authentication passphrase: $AUTH_PASS"
echo "Privacy protocol: AES"
echo "Privacy passphrase: $PRIV_PASS"
echo "Port: 161"