Set up network interface monitoring with SNMP and basic traffic analysis

#!/usr/bin/env bash

set -euo pipefail

# SNMP Network Interface Monitoring Setup Script
# Configures SNMP daemon with secure settings and monitoring tools

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Variables
MONITORING_NETWORK="${1:-192.168.1.0/24}"
ADMIN_EMAIL="${2:-admin@example.com}"
COMMUNITY_RO="${3:-monitoring}"

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Rolling back changes...${NC}"
    if [[ -f /etc/snmp/snmpd.conf.backup ]]; then
        mv /etc/snmp/snmpd.conf.backup /etc/snmp/snmpd.conf 2>/dev/null || true
    fi
    systemctl stop snmpd 2>/dev/null || true
    systemctl disable snmpd 2>/dev/null || true
}

trap cleanup ERR

usage() {
    echo "Usage: $0 [monitoring_network] [admin_email] [ro_community]"
    echo "Example: $0 192.168.1.0/24 admin@company.com monitoring"
    exit 1
}

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

# Auto-detect distribution
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            FIREWALL_CMD="ufw"
            SNMP_PACKAGES="snmp snmp-mibs-downloader snmpd"
            SNMP_CONF_CMD="sed -i 's/mibs :/# mibs :/' /etc/snmp/snmp.conf"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewall-cmd"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-devel"
            SNMP_CONF_CMD="echo '# MIBs enabled' > /etc/snmp/snmp.conf"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewall-cmd"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-devel"
            SNMP_CONF_CMD="echo '# MIBs enabled' > /etc/snmp/snmp.conf"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            FIREWALL_CMD="firewall-cmd"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-devel"
            SNMP_CONF_CMD="echo '# MIBs enabled' > /etc/snmp/snmp.conf"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution. /etc/os-release not found.${NC}"
    exit 1
fi

echo -e "${GREEN}Starting SNMP Network Interface Monitoring Setup${NC}"
echo "Distribution: $PRETTY_NAME"
echo "Monitoring Network: $MONITORING_NETWORK"
echo "Admin Email: $ADMIN_EMAIL"
echo ""

# Step 1: Update system packages
echo -e "${YELLOW}[1/8] Updating system packages...${NC}"
$PKG_UPDATE > /dev/null 2>&1

# Step 2: Install SNMP packages
echo -e "${YELLOW}[2/8] Installing SNMP daemon and utilities...${NC}"
$PKG_INSTALL $SNMP_PACKAGES > /dev/null 2>&1

# Step 3: Backup original configuration
echo -e "${YELLOW}[3/8] Creating configuration backup...${NC}"
if [[ -f /etc/snmp/snmpd.conf ]]; then
    cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.backup
fi

# Step 4: Configure SNMP daemon
echo -e "${YELLOW}[4/8] Configuring SNMP daemon...${NC}"
cat > /etc/snmp/snmpd.conf << EOF
# SNMP v2c configuration
agentAddress udp:161,udp6:[::1]:161

# System information
sysLocation Server Room A
sysContact $ADMIN_EMAIL
sysServices 72

# Community strings
rocommunity public localhost
rocommunity $COMMUNITY_RO $MONITORING_NETWORK
rwcommunity private localhost

# Security settings
dontLogTCPWrappersConnects yes

# Process monitoring
proc sshd
proc snmpd

# Disk monitoring (80% threshold)
disk / 10000

# Load monitoring (1, 5, 15 minute averages)
load 12 14 14

# Interface monitoring
includeAllDisks 10%

# Extended functionality
extend interface-stats /usr/local/bin/interface-stats.sh
extend bandwidth-check /usr/local/bin/bandwidth-check.sh
EOF

# Step 5: Configure MIB access
echo -e "${YELLOW}[5/8] Configuring MIB access...${NC}"
eval $SNMP_CONF_CMD

# Step 6: Set proper permissions
echo -e "${YELLOW}[6/8] Setting file permissions...${NC}"
chown root:root /etc/snmp/snmpd.conf
chmod 640 /etc/snmp/snmpd.conf
mkdir -p /var/lib/snmp
chown snmp:snmp /var/lib/snmp 2>/dev/null || chown root:root /var/lib/snmp
chmod 755 /var/lib/snmp

# Step 7: Create monitoring scripts
echo -e "${YELLOW}[7/8] Creating monitoring scripts...${NC}"
mkdir -p /usr/local/bin

# Interface stats script
cat > /usr/local/bin/interface-stats.sh << 'EOF'
#!/bin/bash
# Network interface statistics monitoring script

INTERFACE=${1:-eth0}
COMMUNITY="public"
HOST="localhost"

echo "=== Interface Statistics for $INTERFACE ==="
echo "Interface Name: $(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.2.2 2>/dev/null | cut -d: -f4 | tr -d ' ')"
echo "Interface Status: $(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.8.2 2>/dev/null | cut -d: -f4 | tr -d ' ')"
echo "Interface Speed: $(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.5.2 2>/dev/null | cut -d: -f4 | tr -d ' ') bps"

# Traffic counters
IN_OCTETS=$(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.10.2 2>/dev/null | cut -d: -f4 | tr -d ' ')
OUT_OCTETS=$(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.16.2 2>/dev/null | cut -d: -f4 | tr -d ' ')

echo "Bytes In: $IN_OCTETS"
echo "Bytes Out: $OUT_OCTETS"
EOF

# Bandwidth check script
cat > /usr/local/bin/bandwidth-check.sh << 'EOF'
#!/bin/bash
# Basic bandwidth monitoring script

INTERFACE=${1:-eth0}
THRESHOLD_MB=${2:-100}
COMMUNITY="public"
HOST="localhost"

# Get current counters
IN_OCTETS=$(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.10.2 2>/dev/null | cut -d: -f4 | tr -d ' ')
OUT_OCTETS=$(snmpget -v2c -c $COMMUNITY $HOST 1.3.6.1.2.1.2.2.1.16.2 2>/dev/null | cut -d: -f4 | tr -d ' ')

if [[ -n "$IN_OCTETS" && -n "$OUT_OCTETS" ]]; then
    TOTAL_MB=$((($IN_OCTETS + $OUT_OCTETS) / 1048576))
    echo "Current bandwidth usage: ${TOTAL_MB}MB"
    
    if [[ $TOTAL_MB -gt $THRESHOLD_MB ]]; then
        echo "WARNING: Bandwidth usage exceeds threshold of ${THRESHOLD_MB}MB"
        exit 1
    fi
else
    echo "ERROR: Could not retrieve SNMP data"
    exit 1
fi
EOF

chmod 755 /usr/local/bin/interface-stats.sh
chmod 755 /usr/local/bin/bandwidth-check.sh

# Configure firewall
echo -e "${YELLOW}[8/8] Configuring firewall and starting services...${NC}"
case "$FIREWALL_CMD" in
    ufw)
        if command -v ufw > /dev/null 2>&1; then
            ufw allow from $MONITORING_NETWORK to any port 161 > /dev/null 2>&1 || true
            ufw --force reload > /dev/null 2>&1 || true
        fi
        ;;
    firewall-cmd)
        if command -v firewall-cmd > /dev/null 2>&1; then
            firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$MONITORING_NETWORK\" port protocol=\"udp\" port=\"161\" accept" > /dev/null 2>&1 || true
            firewall-cmd --reload > /dev/null 2>&1 || true
        fi
        ;;
esac

# Enable and start SNMP daemon
systemctl enable snmpd
systemctl start snmpd

# Verify installation
echo -e "${GREEN}Installation completed successfully!${NC}"
echo ""
echo "Verification:"
if systemctl is-active --quiet snmpd; then
    echo -e "✓ ${GREEN}SNMP daemon is running${NC}"
else
    echo -e "✗ ${RED}SNMP daemon is not running${NC}"
fi

if snmpget -v2c -c public localhost 1.3.6.1.2.1.1.1.0 > /dev/null 2>&1; then
    echo -e "✓ ${GREEN}SNMP queries working${NC}"
else
    echo -e "✗ ${RED}SNMP queries not working${NC}"
fi

echo ""
echo "Configuration summary:"
echo "- Read-only community: $COMMUNITY_RO"
echo "- Monitoring network: $MONITORING_NETWORK"
echo "- Scripts location: /usr/local/bin/"
echo ""
echo "Test with: snmpwalk -v2c -c $COMMUNITY_RO localhost 1.3.6.1.2.1.2.2.1.2"