#Version 1.1 Splunk Linux remote Automated Intallation Script
#Written on 06/11/2019 initially
#Author: Donald Phillips 
#Based on information garnered from https://one.rackspace.com/display/gss/Splunk+PCI+Playbook

#Updated 06/12/2019
#Updated line 30 to accept the license and automatically respond by adding --answer-yes --no-prompt
#Added service restart at end of script, last two lines

#! /bin/bash
#Script to install and edit file permissions and conf files to allow Splunk to function correctly

#Run the package manager to install the downloaded package
rpm -ivh splunkforwarder-current-x86_64.rpm

#Identify hostname to insert into config file later
Hostname="hostname -f"

#Unzip the file downloaded by the BES client
unzip /var/opt/BESClient/__BESData/__Global/__Download/zzz_deploymentclient.zip

#Move the unzipped folder to the correct location
sudo mv zzz_deploymentclient /opt/splunkforwarder/etc/apps/

#Change file ownership
sudo chown -R splunk:splunk /opt/splunkforwarder/etc/apps/zzz_deploymentclient

#Provide file names via variables for easier reference later
ServerConf="/opt/splunkforwarder/etc/system/local/server.conf"
InputConf="/opt/splunkforwarder/etc/system/local/inputs.conf"

#Modify the server conf to include the servers host name to match ERIS
sed 's/.*serverName.*/serverName = $Hostname/' $ServerConf

#Modify the input conf to include the hostname to match ERIS
sed 's/.*host.*/host = $Hostname/' $InputConf

#Initialize the service
sudo -iu splunk ./bin/splunk start --accept-license --answer-yes --no-prompt
sudo -iu splunk ./bin/splunk restart

sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk

#Step 6 "Configure the logging directories" which already appear to be set up in most cases, further configuration is done in step 8 below. 
#Logging directories for RHEL and CentOS
# /var/log/audit/audit.log
# /var/log/messages
# /var/log/secure

#Step 7 "Configure the auditd Daemon"
sudo cat /opt/splunkforwarder/etc/apps/AuditdRules.txt > /etc/audit/audit.rules

#Step 8 "Create the splunk user and grant permissions"
#Create an audit group
sudo -i groupadd audit
#Add splunk user to group
sudo -i usermod -a -G audit splunk
#Change group ownership of target log files for forwarder access
sudo chgrp -R audit /var/log/audit
sudo chgrp audit /var/log/messages
sudo chgrp audit /var/log/secure
#Change group permissions of target log files to ensure forwarder only has read access
sudo chmod -R g+r-w /var/log/audit
sudo chmod g+r-wx /var/log/messages
sudo chmod g+r-wx /var/log/secure
#Verify Splunk can read these files
sudo -iu splunk tailf /var/log/audit
sudo -iu splunk tailf /var/log/messages
sudo -iu splunk tailf /var/log/secure

#Restart the Splunk forwarder service to confirm all changes are applied and the service is able to confirm the changes
sudo -iu splunk ./bin/splunk restart
