mirror of
https://github.com/9technologygroup/patchmon.net.git
synced 2025-10-23 07:42:05 +00:00
1599 lines
58 KiB
Bash
Executable File
1599 lines
58 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# PatchMon Agent Script v1.2.8
|
||
# This script sends package update information to the PatchMon server using API credentials
|
||
|
||
# Configuration
|
||
PATCHMON_SERVER="${PATCHMON_SERVER:-http://localhost:3001}"
|
||
API_VERSION="v1"
|
||
AGENT_VERSION="1.2.8"
|
||
CONFIG_FILE="/etc/patchmon/agent.conf"
|
||
CREDENTIALS_FILE="/etc/patchmon/credentials"
|
||
LOG_FILE="/var/log/patchmon-agent.log"
|
||
|
||
# This placeholder will be dynamically replaced by the server when serving this
|
||
# script based on the "ignore SSL self-signed" setting. If set to -k, curl will
|
||
# ignore certificate validation. Otherwise, it will be empty for secure default.
|
||
CURL_FLAGS=""
|
||
|
||
# Colors for output
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
BLUE='\033[0;34m'
|
||
NC='\033[0m' # No Color
|
||
|
||
# Logging function
|
||
log() {
|
||
# Try to write to log file, but don't fail if we can't
|
||
if [[ -w "$(dirname "$LOG_FILE")" ]] 2>/dev/null; then
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE" 2>/dev/null
|
||
fi
|
||
}
|
||
|
||
# Error handling
|
||
error() {
|
||
echo -e "${RED}ERROR: $1${NC}" >&2
|
||
log "ERROR: $1"
|
||
exit 1
|
||
}
|
||
|
||
# Info logging (cleaner output - only stdout, no duplicate logging)
|
||
info() {
|
||
echo -e "${BLUE}ℹ️ $1${NC}"
|
||
log "INFO: $1"
|
||
}
|
||
|
||
# Success logging (cleaner output - only stdout, no duplicate logging)
|
||
success() {
|
||
echo -e "${GREEN}✅ $1${NC}"
|
||
log "SUCCESS: $1"
|
||
}
|
||
|
||
# Warning logging (cleaner output - only stdout, no duplicate logging)
|
||
warning() {
|
||
echo -e "${YELLOW}⚠️ $1${NC}"
|
||
log "WARNING: $1"
|
||
}
|
||
|
||
# Get or generate machine ID
|
||
get_machine_id() {
|
||
# Try standard locations for machine-id
|
||
if [[ -f /etc/machine-id ]]; then
|
||
cat /etc/machine-id
|
||
elif [[ -f /var/lib/dbus/machine-id ]]; then
|
||
cat /var/lib/dbus/machine-id
|
||
else
|
||
# Fallback: generate from hardware UUID or hostname+MAC
|
||
if command -v dmidecode &> /dev/null; then
|
||
local uuid=$(dmidecode -s system-uuid 2>/dev/null | tr -d ' -' | tr '[:upper:]' '[:lower:]')
|
||
if [[ -n "$uuid" && "$uuid" != "notpresent" ]]; then
|
||
echo "$uuid"
|
||
return
|
||
fi
|
||
fi
|
||
# Last resort: hash hostname + primary MAC address
|
||
local primary_mac=$(ip link show | grep -oP '(?<=link/ether\s)[0-9a-f:]+' | head -1 | tr -d ':')
|
||
echo "$HOSTNAME-$primary_mac" | sha256sum | cut -d' ' -f1 | cut -c1-32
|
||
fi
|
||
}
|
||
|
||
# Check if running as root
|
||
check_root() {
|
||
if [[ $EUID -ne 0 ]]; then
|
||
error "This script must be run as root"
|
||
fi
|
||
}
|
||
|
||
# Verify system datetime and timezone
|
||
verify_datetime() {
|
||
info "Verifying system datetime and timezone..."
|
||
|
||
# Get current system time
|
||
local system_time=$(date)
|
||
local timezone="Unknown"
|
||
|
||
# Try to get timezone with timeout protection
|
||
if command -v timedatectl >/dev/null 2>&1; then
|
||
timezone=$(timedatectl show --property=Timezone --value 2>/dev/null || echo "Unknown")
|
||
fi
|
||
|
||
# Log datetime info (non-blocking)
|
||
log "System datetime check - time: $system_time, timezone: $timezone" 2>/dev/null || true
|
||
|
||
# Simple check - just log the info, don't block execution
|
||
if [[ "$timezone" == "Unknown" ]] || [[ -z "$timezone" ]]; then
|
||
warning "System timezone not configured: $timezone"
|
||
log "WARNING: System timezone not configured - timezone: $timezone" 2>/dev/null || true
|
||
fi
|
||
|
||
return 0
|
||
}
|
||
|
||
# Create necessary directories
|
||
setup_directories() {
|
||
mkdir -p /etc/patchmon
|
||
mkdir -p /var/log
|
||
touch "$LOG_FILE"
|
||
chmod 600 "$LOG_FILE"
|
||
}
|
||
|
||
# Load configuration
|
||
load_config() {
|
||
if [[ -f "$CONFIG_FILE" ]]; then
|
||
source "$CONFIG_FILE"
|
||
fi
|
||
}
|
||
|
||
# Load API credentials
|
||
load_credentials() {
|
||
if [[ ! -f "$CREDENTIALS_FILE" ]]; then
|
||
error "Credentials file not found at $CREDENTIALS_FILE. Please configure API credentials first."
|
||
fi
|
||
|
||
source "$CREDENTIALS_FILE"
|
||
|
||
if [[ -z "$API_ID" ]] || [[ -z "$API_KEY" ]]; then
|
||
error "API_ID and API_KEY must be configured in $CREDENTIALS_FILE"
|
||
fi
|
||
|
||
# Use PATCHMON_URL from credentials if available, otherwise use default
|
||
if [[ -n "$PATCHMON_URL" ]]; then
|
||
PATCHMON_SERVER="$PATCHMON_URL"
|
||
fi
|
||
}
|
||
|
||
# Configure API credentials
|
||
configure_credentials() {
|
||
info "Setting up API credentials..."
|
||
|
||
if [[ -z "$1" ]] || [[ -z "$2" ]]; then
|
||
echo "Usage: $0 configure <API_ID> <API_KEY> [SERVER_URL]"
|
||
echo ""
|
||
echo "Example:"
|
||
echo " $0 configure patchmon_1a2b3c4d abcd1234567890abcdef1234567890abcdef1234567890abcdef1234567890"
|
||
echo " $0 configure patchmon_1a2b3c4d abcd1234567890abcdef1234567890abcdef1234567890abcdef1234567890 http://patchmon.example.com"
|
||
echo ""
|
||
echo "Contact your PatchMon administrator to get your API credentials."
|
||
exit 1
|
||
fi
|
||
|
||
local api_id="$1"
|
||
local api_key="$2"
|
||
local server_url="${3:-$PATCHMON_SERVER}"
|
||
|
||
# Validate API ID format
|
||
if [[ ! "$api_id" =~ ^patchmon_[a-f0-9]{16}$ ]]; then
|
||
error "Invalid API ID format. API ID should be in format: patchmon_xxxxxxxxxxxxxxxx"
|
||
fi
|
||
|
||
# Validate API Key format (64 hex characters)
|
||
if [[ ! "$api_key" =~ ^[a-f0-9]{64}$ ]]; then
|
||
error "Invalid API Key format. API Key should be 64 hexadecimal characters."
|
||
fi
|
||
|
||
# Validate server URL format
|
||
if [[ ! "$server_url" =~ ^https?:// ]]; then
|
||
error "Invalid server URL format. Must start with http:// or https://"
|
||
fi
|
||
|
||
# Create credentials file
|
||
cat > "$CREDENTIALS_FILE" << EOF
|
||
# PatchMon API Credentials
|
||
# Generated on $(date)
|
||
PATCHMON_URL="$server_url"
|
||
API_ID="$api_id"
|
||
API_KEY="$api_key"
|
||
EOF
|
||
|
||
chmod 600 "$CREDENTIALS_FILE"
|
||
success "API credentials configured successfully"
|
||
info "Credentials saved to: $CREDENTIALS_FILE"
|
||
|
||
# Test credentials
|
||
info "Testing API credentials..."
|
||
test_credentials
|
||
}
|
||
|
||
# Test API credentials
|
||
test_credentials() {
|
||
load_credentials
|
||
|
||
local response=$(curl $CURL_FLAGS -X POST \
|
||
-H "Content-Type: application/json" \
|
||
-H "X-API-ID: $API_ID" \
|
||
-H "X-API-KEY: $API_KEY" \
|
||
"$PATCHMON_SERVER/api/$API_VERSION/hosts/ping")
|
||
|
||
if [[ $? -eq 0 ]] && echo "$response" | grep -q "success"; then
|
||
success "API credentials are valid"
|
||
local hostname=$(echo "$response" | grep -o '"hostname":"[^"]*' | cut -d'"' -f4)
|
||
if [[ -n "$hostname" ]]; then
|
||
info "Connected as host: $hostname"
|
||
fi
|
||
else
|
||
error "API credentials test failed: $response"
|
||
fi
|
||
}
|
||
|
||
# Detect OS and version
|
||
detect_os() {
|
||
if [[ -f /etc/os-release ]]; then
|
||
source /etc/os-release
|
||
OS_TYPE=$(echo "$ID" | tr '[:upper:]' '[:lower:]')
|
||
OS_VERSION="$VERSION_ID"
|
||
|
||
# Map OS variations to their appropriate categories
|
||
case "$OS_TYPE" in
|
||
"pop"|"linuxmint"|"elementary")
|
||
OS_TYPE="ubuntu"
|
||
;;
|
||
"opensuse"|"opensuse-leap"|"opensuse-tumbleweed")
|
||
OS_TYPE="suse"
|
||
;;
|
||
"almalinux")
|
||
OS_TYPE="rhel"
|
||
;;
|
||
"ol")
|
||
# Keep Oracle Linux as 'ol' for proper frontend identification
|
||
OS_TYPE="ol"
|
||
;;
|
||
# Rocky Linux keeps its own identity for proper frontend display
|
||
esac
|
||
|
||
elif [[ -f /etc/redhat-release ]]; then
|
||
if grep -q "CentOS" /etc/redhat-release; then
|
||
OS_TYPE="centos"
|
||
elif grep -q "Red Hat" /etc/redhat-release; then
|
||
OS_TYPE="rhel"
|
||
fi
|
||
OS_VERSION=$(grep -oE '[0-9]+\.[0-9]+' /etc/redhat-release | head -1)
|
||
else
|
||
error "Unable to detect OS version"
|
||
fi
|
||
|
||
ARCHITECTURE=$(uname -m)
|
||
HOSTNAME=$(hostname)
|
||
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||
}
|
||
|
||
# Get repository information based on OS
|
||
get_repository_info() {
|
||
local repos_json="["
|
||
local first=true
|
||
|
||
case "$OS_TYPE" in
|
||
"ubuntu"|"debian")
|
||
get_apt_repositories repos_json first
|
||
;;
|
||
"centos"|"rhel"|"fedora"|"ol"|"rocky")
|
||
get_yum_repositories repos_json first
|
||
;;
|
||
*)
|
||
# Return empty array for unsupported OS
|
||
;;
|
||
esac
|
||
|
||
repos_json+="]"
|
||
echo "$repos_json"
|
||
}
|
||
|
||
# Get repository info for APT-based systems
|
||
get_apt_repositories() {
|
||
local -n repos_ref=$1
|
||
local -n first_ref=$2
|
||
|
||
# Parse traditional .list files
|
||
local sources_files="/etc/apt/sources.list"
|
||
if [[ -d "/etc/apt/sources.list.d" ]]; then
|
||
sources_files="$sources_files $(find /etc/apt/sources.list.d -name '*.list' 2>/dev/null)"
|
||
fi
|
||
|
||
for file in $sources_files; do
|
||
if [[ -f "$file" ]]; then
|
||
while IFS= read -r line; do
|
||
# Skip comments and empty lines
|
||
if [[ "$line" =~ ^[[:space:]]*# ]] || [[ -z "$line" ]]; then
|
||
continue
|
||
fi
|
||
|
||
# Parse repository line (deb or deb-src)
|
||
if [[ "$line" =~ ^[[:space:]]*(deb|deb-src)[[:space:]]+ ]]; then
|
||
# Clean the line and extract components
|
||
local clean_line=$(echo "$line" | xargs)
|
||
local repo_type=$(echo "$clean_line" | awk '{print $1}')
|
||
|
||
# Handle modern APT format with options like [signed-by=...]
|
||
local url=""
|
||
local distribution=""
|
||
local components=""
|
||
|
||
if [[ "$clean_line" =~ \[.*\] ]]; then
|
||
# Modern format: deb [options] URL distribution components
|
||
# Extract URL (first field after the options)
|
||
url=$(echo "$clean_line" | sed 's/deb[^[:space:]]* \[[^]]*\] //' | awk '{print $1}')
|
||
distribution=$(echo "$clean_line" | sed 's/deb[^[:space:]]* \[[^]]*\] //' | awk '{print $2}')
|
||
components=$(echo "$clean_line" | sed 's/deb[^[:space:]]* \[[^]]*\] [^[:space:]]* [^[:space:]]* //')
|
||
else
|
||
# Traditional format: deb URL distribution components
|
||
url=$(echo "$clean_line" | awk '{print $2}')
|
||
distribution=$(echo "$clean_line" | awk '{print $3}')
|
||
components=$(echo "$clean_line" | cut -d' ' -f4- | xargs)
|
||
fi
|
||
|
||
# Skip if URL doesn't look like a valid URL
|
||
if [[ ! "$url" =~ ^https?:// ]] && [[ ! "$url" =~ ^ftp:// ]]; then
|
||
continue
|
||
fi
|
||
|
||
# Skip if distribution is empty or looks malformed
|
||
if [[ -z "$distribution" ]] || [[ "$distribution" =~ \[.*\] ]]; then
|
||
continue
|
||
fi
|
||
|
||
# Determine if repository uses HTTPS
|
||
local is_secure=false
|
||
if [[ "$url" =~ ^https:// ]]; then
|
||
is_secure=true
|
||
fi
|
||
|
||
# Generate repository name from URL and distribution
|
||
local repo_name="$distribution"
|
||
|
||
# Extract meaningful name from URL for better identification
|
||
if [[ "$url" =~ archive\.ubuntu\.com ]]; then
|
||
repo_name="ubuntu-$distribution"
|
||
elif [[ "$url" =~ security\.ubuntu\.com ]]; then
|
||
repo_name="ubuntu-$distribution-security"
|
||
elif [[ "$url" =~ deb\.nodesource\.com ]]; then
|
||
repo_name="nodesource-$distribution"
|
||
elif [[ "$url" =~ packagecloud\.io ]]; then
|
||
repo_name="packagecloud-$(echo "$url" | cut -d'/' -f4-5 | tr '/' '-')"
|
||
elif [[ "$url" =~ ppa\.launchpad ]]; then
|
||
repo_name="ppa-$(echo "$url" | cut -d'/' -f4-5 | tr '/' '-')"
|
||
elif [[ "$url" =~ packages\.microsoft\.com ]]; then
|
||
repo_name="microsoft-$(echo "$url" | cut -d'/' -f4-)"
|
||
elif [[ "$url" =~ download\.docker\.com ]]; then
|
||
repo_name="docker-$distribution"
|
||
else
|
||
# Fallback: use domain name + distribution
|
||
local domain=$(echo "$url" | cut -d'/' -f3 | cut -d':' -f1)
|
||
repo_name="$domain-$distribution"
|
||
fi
|
||
|
||
# Add component suffix if relevant
|
||
if [[ "$components" =~ updates ]]; then
|
||
repo_name="$repo_name-updates"
|
||
elif [[ "$components" =~ security ]]; then
|
||
repo_name="$repo_name-security"
|
||
elif [[ "$components" =~ backports ]]; then
|
||
repo_name="$repo_name-backports"
|
||
fi
|
||
|
||
if [[ "$first_ref" == true ]]; then
|
||
first_ref=false
|
||
else
|
||
repos_ref+=","
|
||
fi
|
||
|
||
repos_ref+="{\"name\":\"$repo_name\",\"url\":\"$url\",\"distribution\":\"$distribution\",\"components\":\"$components\",\"repoType\":\"$repo_type\",\"isEnabled\":true,\"isSecure\":$is_secure}"
|
||
fi
|
||
done < "$file"
|
||
fi
|
||
done
|
||
|
||
# Parse modern DEB822 format (.sources files)
|
||
if [[ -d "/etc/apt/sources.list.d" ]]; then
|
||
local sources_files_deb822=$(find /etc/apt/sources.list.d -name '*.sources' 2>/dev/null)
|
||
for file in $sources_files_deb822; do
|
||
if [[ -f "$file" ]]; then
|
||
local deb822_result=$(parse_deb822_sources_simple "$file")
|
||
if [[ -n "$deb822_result" ]]; then
|
||
if [[ "$first_ref" == true ]]; then
|
||
first_ref=false
|
||
repos_ref+="$deb822_result"
|
||
else
|
||
repos_ref+=",$deb822_result"
|
||
fi
|
||
fi
|
||
fi
|
||
done
|
||
fi
|
||
}
|
||
|
||
# Simple DEB822 parser that returns JSON string
|
||
parse_deb822_sources_simple() {
|
||
local file=$1
|
||
local result=""
|
||
local enabled=""
|
||
local types=""
|
||
local uris=""
|
||
local suites=""
|
||
local components=""
|
||
local name=""
|
||
local first_entry=true
|
||
|
||
while IFS= read -r line; do
|
||
# Skip empty lines and comments
|
||
if [[ -z "$line" ]] || [[ "$line" =~ ^[[:space:]]*# ]]; then
|
||
continue
|
||
fi
|
||
|
||
# Parse key-value pairs
|
||
if [[ "$line" =~ ^([^:]+):[[:space:]]*(.*)$ ]]; then
|
||
local key="${BASH_REMATCH[1]}"
|
||
local value="${BASH_REMATCH[2]}"
|
||
|
||
case "$key" in
|
||
"Enabled")
|
||
enabled="$value"
|
||
;;
|
||
"Types")
|
||
types="$value"
|
||
;;
|
||
"URIs")
|
||
uris="$value"
|
||
;;
|
||
"Suites")
|
||
suites="$value"
|
||
;;
|
||
"Components")
|
||
components="$value"
|
||
;;
|
||
"X-Repolib-Name")
|
||
name="$value"
|
||
;;
|
||
esac
|
||
fi
|
||
|
||
# Process repository entry when we hit a blank line
|
||
if [[ -z "$line" ]] || [[ "$line" =~ ^[[:space:]]*$ ]]; then
|
||
if [[ -n "$uris" && -n "$suites" && "$enabled" == "yes" ]]; then
|
||
local entry_result=$(process_deb822_entry_simple "$name" "$types" "$uris" "$suites" "$components")
|
||
if [[ -n "$entry_result" ]]; then
|
||
if [[ "$first_entry" == true ]]; then
|
||
first_entry=false
|
||
result="$entry_result"
|
||
else
|
||
result="$result,$entry_result"
|
||
fi
|
||
fi
|
||
fi
|
||
# Reset variables for next entry
|
||
enabled=""
|
||
types=""
|
||
uris=""
|
||
suites=""
|
||
components=""
|
||
name=""
|
||
fi
|
||
done < "$file"
|
||
|
||
# Process the last entry if file doesn't end with blank line
|
||
if [[ -n "$uris" && -n "$suites" && "$enabled" == "yes" ]]; then
|
||
local entry_result=$(process_deb822_entry_simple "$name" "$types" "$uris" "$suites" "$components")
|
||
if [[ -n "$entry_result" ]]; then
|
||
if [[ "$first_entry" == true ]]; then
|
||
result="$entry_result"
|
||
else
|
||
result="$result,$entry_result"
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
echo "$result"
|
||
}
|
||
|
||
# Process a DEB822 repository entry and return JSON
|
||
process_deb822_entry_simple() {
|
||
local name=$1
|
||
local types=$2
|
||
local uris=$3
|
||
local suites=$4
|
||
local components=$5
|
||
local result=""
|
||
local first_entry=true
|
||
|
||
# Handle multiple URIs
|
||
for uri in $uris; do
|
||
# Skip if URI doesn't look like a valid URL
|
||
if [[ ! "$uri" =~ ^https?:// ]] && [[ ! "$uri" =~ ^ftp:// ]]; then
|
||
continue
|
||
fi
|
||
|
||
# Handle multiple suites
|
||
for suite in $suites; do
|
||
# Skip if suite looks malformed
|
||
if [[ -z "$suite" ]]; then
|
||
continue
|
||
fi
|
||
|
||
# Determine if repository uses HTTPS
|
||
local is_secure=false
|
||
if [[ "$uri" =~ ^https:// ]]; then
|
||
is_secure=true
|
||
fi
|
||
|
||
# Generate repository name
|
||
local repo_name=""
|
||
if [[ -n "$name" ]]; then
|
||
repo_name=$(echo "$name" | tr ' ' '-' | tr '[:upper:]' '[:lower:]')
|
||
else
|
||
repo_name="$suite"
|
||
fi
|
||
|
||
# Extract meaningful name from URI for better identification
|
||
if [[ "$uri" =~ apt\.pop-os\.org/ubuntu ]]; then
|
||
repo_name="pop-os-ubuntu-$suite"
|
||
elif [[ "$uri" =~ apt\.pop-os\.org/release ]]; then
|
||
repo_name="pop-os-release-$suite"
|
||
elif [[ "$uri" =~ apt\.pop-os\.org/proprietary ]]; then
|
||
repo_name="pop-os-apps-$suite"
|
||
elif [[ "$uri" =~ archive\.ubuntu\.com ]]; then
|
||
repo_name="ubuntu-$suite"
|
||
elif [[ "$uri" =~ security\.ubuntu\.com ]]; then
|
||
repo_name="ubuntu-$suite-security"
|
||
else
|
||
# Fallback: use domain name + suite
|
||
local domain=$(echo "$uri" | cut -d'/' -f3 | cut -d':' -f1)
|
||
repo_name="$domain-$suite"
|
||
fi
|
||
|
||
# Add component suffix if relevant and not already included
|
||
if [[ "$suite" != *"security"* && "$components" =~ security ]]; then
|
||
repo_name="$repo_name-security"
|
||
elif [[ "$suite" != *"updates"* && "$components" =~ updates ]]; then
|
||
repo_name="$repo_name-updates"
|
||
elif [[ "$suite" != *"backports"* && "$components" =~ backports ]]; then
|
||
repo_name="$repo_name-backports"
|
||
fi
|
||
|
||
# Determine repo type (prefer deb over deb-src)
|
||
local repo_type="deb"
|
||
if [[ "$types" =~ deb-src ]] && [[ ! "$types" =~ ^deb[[:space:]] ]]; then
|
||
repo_type="deb-src"
|
||
fi
|
||
|
||
local json_entry="{\"name\":\"$repo_name\",\"url\":\"$uri\",\"distribution\":\"$suite\",\"components\":\"$components\",\"repoType\":\"$repo_type\",\"isEnabled\":true,\"isSecure\":$is_secure}"
|
||
|
||
if [[ "$first_entry" == true ]]; then
|
||
first_entry=false
|
||
result="$json_entry"
|
||
else
|
||
result="$result,$json_entry"
|
||
fi
|
||
done
|
||
done
|
||
|
||
echo "$result"
|
||
}
|
||
|
||
# Get repository info for YUM-based systems
|
||
get_yum_repositories() {
|
||
local -n repos_ref=$1
|
||
local -n first_ref=$2
|
||
|
||
# Parse yum/dnf repository configuration
|
||
local repo_info=""
|
||
if command -v dnf >/dev/null 2>&1; then
|
||
repo_info=$(dnf repolist all --verbose 2>/dev/null | grep -E "^Repo-id|^Repo-baseurl|^Repo-mirrors|^Repo-name|^Repo-status")
|
||
elif command -v yum >/dev/null 2>&1; then
|
||
repo_info=$(yum repolist all -v 2>/dev/null | grep -E "^Repo-id|^Repo-baseurl|^Repo-mirrors|^Repo-name|^Repo-status")
|
||
fi
|
||
|
||
if [[ -z "$repo_info" ]]; then
|
||
return
|
||
fi
|
||
|
||
# Parse repository information
|
||
local current_repo=""
|
||
local repo_id=""
|
||
local repo_name=""
|
||
local repo_url=""
|
||
local repo_mirrors=""
|
||
local repo_status=""
|
||
|
||
while IFS= read -r line; do
|
||
if [[ "$line" =~ ^Repo-id[[:space:]]+:[[:space:]]+(.+)$ ]]; then
|
||
# Process previous repository if we have one
|
||
if [[ -n "$current_repo" ]]; then
|
||
process_yum_repo repos_ref first_ref "$repo_id" "$repo_name" "$repo_url" "$repo_mirrors" "$repo_status"
|
||
fi
|
||
|
||
# Start new repository
|
||
repo_id="${BASH_REMATCH[1]}"
|
||
repo_name="$repo_id"
|
||
repo_url=""
|
||
repo_mirrors=""
|
||
repo_status=""
|
||
current_repo="$repo_id"
|
||
|
||
elif [[ "$line" =~ ^Repo-name[[:space:]]+:[[:space:]]+(.+)$ ]]; then
|
||
repo_name="${BASH_REMATCH[1]}"
|
||
|
||
elif [[ "$line" =~ ^Repo-baseurl[[:space:]]+:[[:space:]]+(.+)$ ]]; then
|
||
repo_url="${BASH_REMATCH[1]}"
|
||
|
||
elif [[ "$line" =~ ^Repo-mirrors[[:space:]]+:[[:space:]]+(.+)$ ]]; then
|
||
repo_mirrors="${BASH_REMATCH[1]}"
|
||
|
||
elif [[ "$line" =~ ^Repo-status[[:space:]]+:[[:space:]]+(.+)$ ]]; then
|
||
repo_status="${BASH_REMATCH[1]}"
|
||
fi
|
||
done <<< "$repo_info"
|
||
|
||
# Process the last repository
|
||
if [[ -n "$current_repo" ]]; then
|
||
process_yum_repo repos_ref first_ref "$repo_id" "$repo_name" "$repo_url" "$repo_mirrors" "$repo_status"
|
||
fi
|
||
}
|
||
|
||
# Process a single YUM repository and add it to the JSON
|
||
process_yum_repo() {
|
||
local -n _repos_ref=$1
|
||
local -n _first_ref=$2
|
||
local repo_id="$3"
|
||
local repo_name="$4"
|
||
local repo_url="$5"
|
||
local repo_mirrors="$6"
|
||
local repo_status="$7"
|
||
|
||
# Skip if we don't have essential info
|
||
if [[ -z "$repo_id" ]]; then
|
||
return
|
||
fi
|
||
|
||
# Determine if repository is enabled
|
||
local is_enabled=false
|
||
if [[ "$repo_status" == "enabled" ]]; then
|
||
is_enabled=true
|
||
fi
|
||
|
||
# Use baseurl if available, otherwise use mirrors URL
|
||
local final_url=""
|
||
if [[ -n "$repo_url" ]]; then
|
||
# Extract first URL if multiple are listed
|
||
final_url=$(echo "$repo_url" | head -n 1 | awk '{print $1}')
|
||
elif [[ -n "$repo_mirrors" ]]; then
|
||
final_url="$repo_mirrors"
|
||
fi
|
||
|
||
# Skip if we don't have any URL
|
||
if [[ -z "$final_url" ]]; then
|
||
return
|
||
fi
|
||
|
||
# Determine if repository uses HTTPS
|
||
local is_secure=false
|
||
if [[ "$final_url" =~ ^https:// ]]; then
|
||
is_secure=true
|
||
fi
|
||
|
||
# Generate repository name if not provided
|
||
if [[ -z "$repo_name" ]]; then
|
||
repo_name="$repo_id"
|
||
fi
|
||
|
||
# Clean up repository name and URL - escape quotes and backslashes
|
||
repo_name=$(echo "$repo_name" | sed 's/\\/\\\\/g' | sed 's/"/\\"/g')
|
||
final_url=$(echo "$final_url" | sed 's/\\/\\\\/g' | sed 's/"/\\"/g')
|
||
|
||
# Add to JSON
|
||
if [[ "$_first_ref" == true ]]; then
|
||
_first_ref=false
|
||
else
|
||
_repos_ref+=","
|
||
fi
|
||
|
||
_repos_ref+="{\"name\":\"$repo_name\",\"url\":\"$final_url\",\"distribution\":\"$OS_VERSION\",\"components\":\"main\",\"repoType\":\"rpm\",\"isEnabled\":$is_enabled,\"isSecure\":$is_secure}"
|
||
}
|
||
|
||
# Get package information based on OS
|
||
get_package_info() {
|
||
local packages_json="["
|
||
local first=true
|
||
|
||
case "$OS_TYPE" in
|
||
"ubuntu"|"debian")
|
||
get_apt_packages packages_json first
|
||
;;
|
||
"centos"|"rhel"|"fedora"|"ol"|"rocky")
|
||
get_yum_packages packages_json first
|
||
;;
|
||
*)
|
||
warning "Unsupported OS type: $OS_TYPE - returning empty package list"
|
||
;;
|
||
esac
|
||
|
||
packages_json+="]"
|
||
echo "$packages_json"
|
||
}
|
||
|
||
# Get package info for APT-based systems
|
||
get_apt_packages() {
|
||
local -n packages_ref=$1
|
||
local -n first_ref=$2
|
||
|
||
# Update package lists with retry logic for lock conflicts
|
||
local retry_count=0
|
||
local max_retries=3
|
||
local retry_delay=5
|
||
|
||
while [[ $retry_count -lt $max_retries ]]; do
|
||
if apt-get update -qq 2>/dev/null; then
|
||
break
|
||
else
|
||
retry_count=$((retry_count + 1))
|
||
if [[ $retry_count -lt $max_retries ]]; then
|
||
warning "APT lock detected, retrying in ${retry_delay} seconds... (attempt $retry_count/$max_retries)"
|
||
sleep $retry_delay
|
||
else
|
||
warning "APT lock persists after $max_retries attempts, continuing without update..."
|
||
fi
|
||
fi
|
||
done
|
||
|
||
# Determine upgradable packages using apt-get simulation (compatible with Ubuntu 18.04)
|
||
# Example line format:
|
||
# Inst bash [4.4.18-2ubuntu1] (4.4.18-2ubuntu1.2 Ubuntu:18.04/bionic-updates [amd64])
|
||
local upgradable_sim=$(apt-get -s -o Debug::NoLocking=1 upgrade 2>/dev/null | grep "^Inst ")
|
||
|
||
while IFS= read -r line; do
|
||
# Extract package name, current version (in brackets), and available version (first token inside parentheses)
|
||
if [[ "$line" =~ ^Inst[[:space:]]+([^[:space:]]+)[[:space:]]+\[([^\]]+)\][[:space:]]+\(([^[:space:]]+) ]]; then
|
||
local package_name="${BASH_REMATCH[1]}"
|
||
local current_version="${BASH_REMATCH[2]}"
|
||
local available_version="${BASH_REMATCH[3]}"
|
||
local is_security_update=false
|
||
|
||
# Mark as security update if the line references a security pocket
|
||
if echo "$line" | grep -qiE "(-|/)security"; then
|
||
is_security_update=true
|
||
fi
|
||
|
||
# Escape JSON special characters in package data
|
||
package_name=$(echo "$package_name" | sed 's/"/\\"/g' | sed 's/\\/\\\\/g')
|
||
current_version=$(echo "$current_version" | sed 's/"/\\"/g' | sed 's/\\/\\\\/g')
|
||
available_version=$(echo "$available_version" | sed 's/"/\\"/g' | sed 's/\\/\\\\/g')
|
||
|
||
if [[ "$first_ref" == true ]]; then
|
||
first_ref=false
|
||
else
|
||
packages_ref+=","
|
||
fi
|
||
|
||
packages_ref+="{\"name\":\"$package_name\",\"currentVersion\":\"$current_version\",\"availableVersion\":\"$available_version\",\"needsUpdate\":true,\"isSecurityUpdate\":$is_security_update}"
|
||
fi
|
||
done <<< "$upgradable_sim"
|
||
|
||
# Get installed packages that are up to date
|
||
local installed=$(dpkg-query -W -f='${Package} ${Version}\n')
|
||
|
||
while IFS=' ' read -r package_name version; do
|
||
if [[ -n "$package_name" && -n "$version" ]]; then
|
||
# Check if this package is not in the upgrade list
|
||
if ! echo "$upgradable_sim" | grep -q "^Inst $package_name "; then
|
||
# Escape JSON special characters in package data
|
||
package_name=$(echo "$package_name" | sed 's/"/\\"/g' | sed 's/\\/\\\\/g')
|
||
version=$(echo "$version" | sed 's/"/\\"/g' | sed 's/\\/\\\\/g')
|
||
|
||
if [[ "$first_ref" == true ]]; then
|
||
first_ref=false
|
||
else
|
||
packages_ref+=","
|
||
fi
|
||
|
||
packages_ref+="{\"name\":\"$package_name\",\"currentVersion\":\"$version\",\"needsUpdate\":false,\"isSecurityUpdate\":false}"
|
||
fi
|
||
fi
|
||
done <<< "$installed"
|
||
}
|
||
|
||
# Get package info for YUM/DNF-based systems
|
||
get_yum_packages() {
|
||
local -n packages_ref=$1
|
||
local -n first_ref=$2
|
||
|
||
local package_manager="yum"
|
||
if command -v dnf &> /dev/null; then
|
||
package_manager="dnf"
|
||
fi
|
||
|
||
# Get upgradable packages
|
||
local upgradable=$($package_manager check-update 2>/dev/null | grep -v "^$" | grep -v "^Loaded" | grep -v "^Last metadata" | grep -v "^Security" | tail -n +2)
|
||
|
||
while IFS= read -r line; do
|
||
# Skip empty lines and lines with special characters
|
||
[[ -z "$line" ]] && continue
|
||
[[ "$line" =~ ^[[:space:]]*$ ]] && continue
|
||
|
||
if [[ "$line" =~ ^([^[:space:]]+)[[:space:]]+([^[:space:]]+)[[:space:]]+([^[:space:]]+) ]]; then
|
||
local package_name="${BASH_REMATCH[1]}"
|
||
local available_version="${BASH_REMATCH[2]}"
|
||
local repo="${BASH_REMATCH[3]}"
|
||
|
||
# Sanitize package name and versions (remove any control characters)
|
||
package_name=$(echo "$package_name" | tr -d '[:cntrl:]' | sed 's/[^a-zA-Z0-9._+-]//g')
|
||
available_version=$(echo "$available_version" | tr -d '[:cntrl:]' | sed 's/[^a-zA-Z0-9._+-]//g')
|
||
repo=$(echo "$repo" | tr -d '[:cntrl:]')
|
||
|
||
# Skip if package name is empty after sanitization
|
||
[[ -z "$package_name" ]] && continue
|
||
|
||
# Get current version
|
||
local current_version=$($package_manager list installed "$package_name" 2>/dev/null | grep "^$package_name" | awk '{print $2}' | tr -d '[:cntrl:]' | sed 's/[^a-zA-Z0-9._+-]//g')
|
||
|
||
# Skip if we couldn't get current version
|
||
[[ -z "$current_version" ]] && current_version="unknown"
|
||
|
||
local is_security_update=false
|
||
if echo "$repo" | grep -q "security"; then
|
||
is_security_update=true
|
||
fi
|
||
|
||
if [[ "$first_ref" == true ]]; then
|
||
first_ref=false
|
||
else
|
||
packages_ref+=","
|
||
fi
|
||
|
||
packages_ref+="{\"name\":\"$package_name\",\"currentVersion\":\"$current_version\",\"availableVersion\":\"$available_version\",\"needsUpdate\":true,\"isSecurityUpdate\":$is_security_update}"
|
||
fi
|
||
done <<< "$upgradable"
|
||
|
||
# Get some installed packages that are up to date
|
||
local installed=$($package_manager list installed 2>/dev/null | grep -v "^Loaded" | grep -v "^Installed")
|
||
|
||
while IFS= read -r line; do
|
||
# Skip empty lines
|
||
[[ -z "$line" ]] && continue
|
||
[[ "$line" =~ ^[[:space:]]*$ ]] && continue
|
||
|
||
if [[ "$line" =~ ^([^[:space:]]+)[[:space:]]+([^[:space:]]+) ]]; then
|
||
local package_name="${BASH_REMATCH[1]}"
|
||
local version="${BASH_REMATCH[2]}"
|
||
|
||
# Sanitize package name and version
|
||
package_name=$(echo "$package_name" | tr -d '[:cntrl:]' | sed 's/[^a-zA-Z0-9._+-]//g')
|
||
version=$(echo "$version" | tr -d '[:cntrl:]' | sed 's/[^a-zA-Z0-9._+-]//g')
|
||
|
||
# Skip if package name is empty after sanitization
|
||
[[ -z "$package_name" ]] && continue
|
||
[[ -z "$version" ]] && version="unknown"
|
||
|
||
# Check if this package is not in the upgrade list
|
||
if ! echo "$upgradable" | grep -q "^$package_name "; then
|
||
if [[ "$first_ref" == true ]]; then
|
||
first_ref=false
|
||
else
|
||
packages_ref+=","
|
||
fi
|
||
|
||
packages_ref+="{\"name\":\"$package_name\",\"currentVersion\":\"$version\",\"needsUpdate\":false,\"isSecurityUpdate\":false}"
|
||
fi
|
||
fi
|
||
done <<< "$installed"
|
||
}
|
||
|
||
# Get hardware information
|
||
get_hardware_info() {
|
||
local cpu_model=""
|
||
local cpu_cores=0
|
||
local ram_installed=0
|
||
local swap_size=0
|
||
local disk_details="[]"
|
||
|
||
# CPU Information
|
||
if command -v lscpu >/dev/null 2>&1; then
|
||
cpu_model=$(lscpu | grep "Model name" | cut -d':' -f2 | xargs)
|
||
cpu_cores=$(lscpu | grep "^CPU(s):" | cut -d':' -f2 | xargs)
|
||
elif [[ -f /proc/cpuinfo ]]; then
|
||
cpu_model=$(grep "model name" /proc/cpuinfo | head -1 | cut -d':' -f2 | xargs)
|
||
cpu_cores=$(grep -c "^processor" /proc/cpuinfo)
|
||
fi
|
||
|
||
# Memory Information
|
||
if command -v free >/dev/null 2>&1; then
|
||
# Use free -m to get MB, then convert to GB with decimal precision
|
||
ram_installed=$(free -m | grep "^Mem:" | awk '{printf "%.2f", $2/1024}')
|
||
swap_size=$(free -m | grep "^Swap:" | awk '{printf "%.2f", $2/1024}')
|
||
elif [[ -f /proc/meminfo ]]; then
|
||
# Convert KB to GB with decimal precision
|
||
ram_installed=$(grep "MemTotal" /proc/meminfo | awk '{printf "%.2f", $2/1048576}')
|
||
swap_size=$(grep "SwapTotal" /proc/meminfo | awk '{printf "%.2f", $2/1048576}')
|
||
fi
|
||
|
||
# Ensure minimum value of 0.01GB to prevent 0 values
|
||
if (( $(echo "$ram_installed < 0.01" | bc -l) )); then
|
||
ram_installed="0.01"
|
||
fi
|
||
if (( $(echo "$swap_size < 0" | bc -l) )); then
|
||
swap_size="0"
|
||
fi
|
||
|
||
# Disk Information
|
||
if command -v lsblk >/dev/null 2>&1; then
|
||
disk_details=$(lsblk -J -o NAME,SIZE,TYPE,MOUNTPOINT | jq -c '[.blockdevices[] | select(.type == "disk") | {name: .name, size: .size, mountpoint: .mountpoint}]')
|
||
elif command -v df >/dev/null 2>&1; then
|
||
disk_details=$(df -h | grep -E "^/dev/" | awk '{print "{\"name\":\""$1"\",\"size\":\""$2"\",\"mountpoint\":\""$6"\"}"}' | jq -s .)
|
||
fi
|
||
|
||
echo "{\"cpuModel\":\"$cpu_model\",\"cpuCores\":$cpu_cores,\"ramInstalled\":$ram_installed,\"swapSize\":$swap_size,\"diskDetails\":$disk_details}"
|
||
}
|
||
|
||
# Get network information
|
||
get_network_info() {
|
||
local gateway_ip=""
|
||
local dns_servers="[]"
|
||
local network_interfaces="[]"
|
||
|
||
# Gateway IP
|
||
if command -v ip >/dev/null 2>&1; then
|
||
gateway_ip=$(ip route | grep default | head -1 | awk '{print $3}')
|
||
elif command -v route >/dev/null 2>&1; then
|
||
gateway_ip=$(route -n | grep '^0.0.0.0' | head -1 | awk '{print $2}')
|
||
fi
|
||
|
||
# DNS Servers
|
||
if [[ -f /etc/resolv.conf ]]; then
|
||
dns_servers=$(grep "nameserver" /etc/resolv.conf | awk '{print $2}' | jq -R . | jq -s .)
|
||
fi
|
||
|
||
# Network Interfaces
|
||
if command -v ip >/dev/null 2>&1; then
|
||
network_interfaces=$(ip -j addr show | jq -c '[.[] | {name: .ifname, type: .link_type, addresses: [.addr_info[]? | {address: .local, family: .family}]}]')
|
||
elif command -v ifconfig >/dev/null 2>&1; then
|
||
network_interfaces=$(ifconfig -a | grep -E "^[a-zA-Z]" | awk '{print $1}' | jq -R . | jq -s .)
|
||
fi
|
||
|
||
echo "{\"gatewayIp\":\"$gateway_ip\",\"dnsServers\":$dns_servers,\"networkInterfaces\":$network_interfaces}"
|
||
}
|
||
|
||
# Get system information
|
||
get_system_info() {
|
||
local kernel_version=""
|
||
local selinux_status=""
|
||
local system_uptime=""
|
||
local load_average="[]"
|
||
|
||
# Kernel Version
|
||
if [[ -f /proc/version ]]; then
|
||
kernel_version=$(cat /proc/version | awk '{print $3}')
|
||
elif command -v uname >/dev/null 2>&1; then
|
||
kernel_version=$(uname -r)
|
||
fi
|
||
|
||
# SELinux Status
|
||
if command -v getenforce >/dev/null 2>&1; then
|
||
selinux_status=$(getenforce 2>/dev/null | tr '[:upper:]' '[:lower:]')
|
||
# Map "enforcing" to "enabled" for server validation
|
||
if [[ "$selinux_status" == "enforcing" ]]; then
|
||
selinux_status="enabled"
|
||
fi
|
||
elif [[ -f /etc/selinux/config ]]; then
|
||
selinux_status=$(grep "^SELINUX=" /etc/selinux/config | cut -d'=' -f2 | tr '[:upper:]' '[:lower:]')
|
||
# Map "enforcing" to "enabled" for server validation
|
||
if [[ "$selinux_status" == "enforcing" ]]; then
|
||
selinux_status="enabled"
|
||
fi
|
||
else
|
||
selinux_status="disabled"
|
||
fi
|
||
|
||
# System Uptime
|
||
if [[ -f /proc/uptime ]]; then
|
||
local uptime_seconds=$(cat /proc/uptime | awk '{print int($1)}')
|
||
local days=$((uptime_seconds / 86400))
|
||
local hours=$(((uptime_seconds % 86400) / 3600))
|
||
local minutes=$(((uptime_seconds % 3600) / 60))
|
||
system_uptime="${days}d ${hours}h ${minutes}m"
|
||
elif command -v uptime >/dev/null 2>&1; then
|
||
system_uptime=$(uptime | awk -F'up ' '{print $2}' | awk -F', load' '{print $1}')
|
||
fi
|
||
|
||
# Load Average
|
||
if [[ -f /proc/loadavg ]]; then
|
||
load_average=$(cat /proc/loadavg | awk '{print "["$1","$2","$3"]"}')
|
||
elif command -v uptime >/dev/null 2>&1; then
|
||
load_average=$(uptime | awk -F'load average: ' '{print "["$2"]"}' | tr -d ' ')
|
||
fi
|
||
|
||
echo "{\"kernelVersion\":\"$kernel_version\",\"selinuxStatus\":\"$selinux_status\",\"systemUptime\":\"$system_uptime\",\"loadAverage\":$load_average}"
|
||
}
|
||
|
||
# Send package update to server
|
||
send_update() {
|
||
load_credentials
|
||
|
||
# Track execution start time
|
||
local start_time=$(date +%s.%N)
|
||
|
||
# Verify datetime before proceeding
|
||
if ! verify_datetime; then
|
||
warning "Datetime verification failed, but continuing with update..."
|
||
fi
|
||
|
||
info "Collecting system information..."
|
||
local packages_json=$(get_package_info)
|
||
local repositories_json=$(get_repository_info)
|
||
local hardware_json=$(get_hardware_info)
|
||
local network_json=$(get_network_info)
|
||
local system_json=$(get_system_info)
|
||
|
||
# Validate JSON before sending
|
||
if ! echo "$packages_json" | jq empty 2>/dev/null; then
|
||
error "Invalid packages JSON generated: $packages_json"
|
||
fi
|
||
|
||
if ! echo "$repositories_json" | jq empty 2>/dev/null; then
|
||
error "Invalid repositories JSON generated: $repositories_json"
|
||
fi
|
||
|
||
info "Sending update to PatchMon server..."
|
||
|
||
# Merge all JSON objects into one
|
||
local merged_json=$(echo "$hardware_json $network_json $system_json" | jq -s '.[0] * .[1] * .[2]')
|
||
# Get machine ID
|
||
local machine_id=$(get_machine_id)
|
||
|
||
# Calculate execution time (in seconds with decimals)
|
||
local end_time=$(date +%s.%N)
|
||
local execution_time=$(echo "$end_time - $start_time" | bc)
|
||
|
||
# Create the base payload and merge with system info
|
||
local base_payload=$(cat <<EOF
|
||
{
|
||
"packages": $packages_json,
|
||
"repositories": $repositories_json,
|
||
"osType": "$OS_TYPE",
|
||
"osVersion": "$OS_VERSION",
|
||
"hostname": "$HOSTNAME",
|
||
"ip": "$IP_ADDRESS",
|
||
"architecture": "$ARCHITECTURE",
|
||
"agentVersion": "$AGENT_VERSION",
|
||
"machineId": "$machine_id",
|
||
"executionTime": $execution_time
|
||
}
|
||
EOF
|
||
)
|
||
|
||
# Merge the base payload with the system information
|
||
local payload=$(echo "$base_payload $merged_json" | jq -s '.[0] * .[1]')
|
||
|
||
# Write payload to temporary file to avoid "Argument list too long" error
|
||
local temp_payload_file=$(mktemp)
|
||
echo "$payload" > "$temp_payload_file"
|
||
|
||
# Debug: Show payload size
|
||
local payload_size=$(wc -c < "$temp_payload_file")
|
||
echo -e "${BLUE}ℹ️ 📊 Payload size: $payload_size bytes${NC}"
|
||
|
||
local response=$(curl $CURL_FLAGS -X POST \
|
||
-H "Content-Type: application/json" \
|
||
-H "X-API-ID: $API_ID" \
|
||
-H "X-API-KEY: $API_KEY" \
|
||
-d @"$temp_payload_file" \
|
||
"$PATCHMON_SERVER/api/$API_VERSION/hosts/update" 2>&1)
|
||
|
||
local curl_exit_code=$?
|
||
|
||
# Clean up temporary file
|
||
rm -f "$temp_payload_file"
|
||
|
||
if [[ $curl_exit_code -eq 0 ]]; then
|
||
if echo "$response" | grep -q "success"; then
|
||
local packages_count=$(echo "$response" | grep -o '"packagesProcessed":[0-9]*' | cut -d':' -f2)
|
||
success "Update sent successfully (${packages_count} packages processed)"
|
||
|
||
# Check if auto-update is enabled and check for agent updates locally
|
||
if check_auto_update_enabled; then
|
||
info "Checking for agent updates..."
|
||
if check_agent_update_needed; then
|
||
info "Agent update available, updating..."
|
||
if "$0" update-agent; then
|
||
success "Agent updated successfully"
|
||
else
|
||
warning "Agent update failed, but data was sent successfully"
|
||
fi
|
||
else
|
||
info "Agent is up to date"
|
||
fi
|
||
fi
|
||
|
||
# Automatically check if crontab needs updating based on server settings
|
||
info "Checking crontab configuration..."
|
||
"$0" update-crontab
|
||
local crontab_exit_code=$?
|
||
if [[ $crontab_exit_code -eq 0 ]]; then
|
||
success "Crontab updated successfully"
|
||
elif [[ $crontab_exit_code -eq 2 ]]; then
|
||
# Already up to date - no additional message needed
|
||
true
|
||
else
|
||
warning "Crontab update failed, but data was sent successfully"
|
||
fi
|
||
else
|
||
error "Update failed: $response"
|
||
fi
|
||
else
|
||
error "Failed to send update (curl exit code: $curl_exit_code): $response"
|
||
fi
|
||
}
|
||
|
||
# Ping server to check connectivity
|
||
ping_server() {
|
||
load_credentials
|
||
|
||
local response=$(curl $CURL_FLAGS -X POST \
|
||
-H "Content-Type: application/json" \
|
||
-H "X-API-ID: $API_ID" \
|
||
-H "X-API-KEY: $API_KEY" \
|
||
"$PATCHMON_SERVER/api/$API_VERSION/hosts/ping")
|
||
|
||
if [[ $? -eq 0 ]] && echo "$response" | grep -q "success"; then
|
||
success "Ping successful"
|
||
local hostname=$(echo "$response" | grep -o '"hostname":"[^"]*' | cut -d'"' -f4)
|
||
if [[ -n "$hostname" ]]; then
|
||
info "Connected as host: $hostname"
|
||
fi
|
||
|
||
# Check for crontab update instructions
|
||
local should_update_crontab=$(echo "$response" | grep -o '"shouldUpdate":true' | cut -d':' -f2)
|
||
if [[ "$should_update_crontab" == "true" ]]; then
|
||
local message=$(echo "$response" | grep -o '"message":"[^"]*' | cut -d'"' -f4)
|
||
local command=$(echo "$response" | grep -o '"command":"[^"]*' | cut -d'"' -f4)
|
||
|
||
if [[ -n "$message" ]]; then
|
||
info "$message"
|
||
fi
|
||
|
||
if [[ "$command" == "update-crontab" ]]; then
|
||
info "Updating crontab with new interval..."
|
||
"$0" update-crontab
|
||
local crontab_exit_code=$?
|
||
if [[ $crontab_exit_code -eq 0 ]]; then
|
||
success "Crontab updated successfully"
|
||
elif [[ $crontab_exit_code -eq 2 ]]; then
|
||
# Already up to date - no additional message needed
|
||
true
|
||
else
|
||
warning "Crontab update failed, but data was sent successfully"
|
||
fi
|
||
fi
|
||
fi
|
||
else
|
||
error "Ping failed: $response"
|
||
fi
|
||
}
|
||
|
||
# Check for agent updates
|
||
check_version() {
|
||
load_credentials
|
||
|
||
info "Checking for agent updates..."
|
||
|
||
local response=$(curl $CURL_FLAGS -H "X-API-ID: $API_ID" -H "X-API-KEY: $API_KEY" -X GET "$PATCHMON_SERVER/api/$API_VERSION/hosts/agent/version")
|
||
|
||
if [[ $? -eq 0 ]]; then
|
||
local current_version=$(echo "$response" | grep -o '"currentVersion":"[^"]*' | cut -d'"' -f4)
|
||
local download_url=$(echo "$response" | grep -o '"downloadUrl":"[^"]*' | cut -d'"' -f4)
|
||
local release_notes=$(echo "$response" | grep -o '"releaseNotes":"[^"]*' | cut -d'"' -f4)
|
||
|
||
if [[ -n "$current_version" ]]; then
|
||
if [[ "$current_version" != "$AGENT_VERSION" ]]; then
|
||
warning "Agent update available!"
|
||
echo " Current version: $AGENT_VERSION"
|
||
echo " Latest version: $current_version"
|
||
if [[ -n "$release_notes" ]]; then
|
||
echo " Release notes: $release_notes"
|
||
fi
|
||
echo " Download URL: $download_url"
|
||
echo ""
|
||
echo "To update, run: $0 update-agent"
|
||
else
|
||
success "Agent is up to date (version $AGENT_VERSION)"
|
||
fi
|
||
else
|
||
warning "Could not determine current version from server"
|
||
fi
|
||
else
|
||
error "Failed to check for updates"
|
||
fi
|
||
}
|
||
|
||
# Check if auto-update is enabled (both globally and for this host)
|
||
check_auto_update_enabled() {
|
||
# Get settings from server using API credentials
|
||
local response=$(curl $CURL_FLAGS -H "X-API-ID: $API_ID" -H "X-API-KEY: $API_KEY" -X GET "$PATCHMON_SERVER/api/$API_VERSION/hosts/settings" 2>/dev/null)
|
||
if [[ $? -ne 0 ]]; then
|
||
return 1
|
||
fi
|
||
|
||
# Check if both global and host auto-update are enabled
|
||
local global_auto_update=$(echo "$response" | grep -o '"auto_update":true' | cut -d':' -f2)
|
||
local host_auto_update=$(echo "$response" | grep -o '"host_auto_update":true' | cut -d':' -f2)
|
||
|
||
if [[ "$global_auto_update" == "true" && "$host_auto_update" == "true" ]]; then
|
||
return 0
|
||
else
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
# Check if agent update is needed (internal function for auto-update)
|
||
check_agent_update_needed() {
|
||
# Get current agent timestamp
|
||
local current_timestamp=0
|
||
if [[ -f "$0" ]]; then
|
||
current_timestamp=$(stat -c %Y "$0" 2>/dev/null || stat -f %m "$0" 2>/dev/null || echo "0")
|
||
fi
|
||
|
||
# Get server agent info using API credentials
|
||
local response=$(curl $CURL_FLAGS -H "X-API-ID: $API_ID" -H "X-API-KEY: $API_KEY" -X GET "$PATCHMON_SERVER/api/$API_VERSION/hosts/agent/timestamp" 2>/dev/null)
|
||
|
||
if [[ $? -eq 0 ]]; then
|
||
local server_version=$(echo "$response" | grep -o '"version":"[^"]*' | cut -d'"' -f4)
|
||
local server_timestamp=$(echo "$response" | grep -o '"timestamp":[0-9]*' | cut -d':' -f2)
|
||
local server_exists=$(echo "$response" | grep -o '"exists":true' | cut -d':' -f2)
|
||
|
||
if [[ "$server_exists" != "true" ]]; then
|
||
return 1
|
||
fi
|
||
|
||
# Check if update is needed
|
||
if [[ "$server_version" != "$AGENT_VERSION" ]]; then
|
||
return 0 # Update needed due to version mismatch
|
||
elif [[ "$server_timestamp" -gt "$current_timestamp" ]]; then
|
||
return 0 # Update needed due to newer timestamp
|
||
else
|
||
return 1 # No update needed
|
||
fi
|
||
else
|
||
return 1 # Failed to check
|
||
fi
|
||
}
|
||
|
||
# Check for agent updates based on version and timestamp (interactive command)
|
||
check_agent_update() {
|
||
load_credentials
|
||
|
||
info "Checking for agent updates..."
|
||
|
||
# Get current agent timestamp
|
||
local current_timestamp=0
|
||
if [[ -f "$0" ]]; then
|
||
current_timestamp=$(stat -c %Y "$0" 2>/dev/null || stat -f %m "$0" 2>/dev/null || echo "0")
|
||
fi
|
||
|
||
# Get server agent info using API credentials
|
||
local response=$(curl $CURL_FLAGS -H "X-API-ID: $API_ID" -H "X-API-KEY: $API_KEY" -X GET "$PATCHMON_SERVER/api/$API_VERSION/hosts/agent/timestamp")
|
||
|
||
if [[ $? -eq 0 ]]; then
|
||
local server_version=$(echo "$response" | grep -o '"version":"[^"]*' | cut -d'"' -f4)
|
||
local server_timestamp=$(echo "$response" | grep -o '"timestamp":[0-9]*' | cut -d':' -f2)
|
||
local server_exists=$(echo "$response" | grep -o '"exists":true' | cut -d':' -f2)
|
||
|
||
if [[ "$server_exists" != "true" ]]; then
|
||
warning "No agent script found on server"
|
||
return 1
|
||
fi
|
||
|
||
info "Current agent version: $AGENT_VERSION (timestamp: $current_timestamp)"
|
||
info "Server agent version: $server_version (timestamp: $server_timestamp)"
|
||
|
||
# Check if update is needed
|
||
if [[ "$server_version" != "$AGENT_VERSION" ]]; then
|
||
info "Version mismatch detected - update needed"
|
||
return 0
|
||
elif [[ "$server_timestamp" -gt "$current_timestamp" ]]; then
|
||
info "Server script is newer - update needed"
|
||
return 0
|
||
else
|
||
info "Agent is up to date"
|
||
return 1
|
||
fi
|
||
else
|
||
error "Failed to check agent timestamp from server"
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
# Update agent script
|
||
update_agent() {
|
||
load_credentials
|
||
|
||
info "Updating agent script..."
|
||
|
||
local download_url="$PATCHMON_SERVER/api/$API_VERSION/hosts/agent/download"
|
||
|
||
info "Downloading latest agent from: $download_url"
|
||
|
||
# Clean up old backups (keep only last 3)
|
||
ls -t "$0.backup."* 2>/dev/null | tail -n +4 | xargs -r rm -f
|
||
|
||
# Create backup of current script
|
||
local backup_file="$0.backup.$(date +%Y%m%d_%H%M%S)"
|
||
cp "$0" "$backup_file"
|
||
|
||
# Download new version using API credentials
|
||
if curl $CURL_FLAGS -H "X-API-ID: $API_ID" -H "X-API-KEY: $API_KEY" -o "/tmp/patchmon-agent-new.sh" "$download_url"; then
|
||
# Verify the downloaded script is valid
|
||
if bash -n "/tmp/patchmon-agent-new.sh" 2>/dev/null; then
|
||
# Replace current script
|
||
mv "/tmp/patchmon-agent-new.sh" "$0"
|
||
chmod +x "$0"
|
||
success "Agent updated successfully"
|
||
info "Backup saved as: $backup_file"
|
||
|
||
# Get the new version number
|
||
local new_version=$(grep '^AGENT_VERSION=' "$0" | cut -d'"' -f2)
|
||
info "Updated to version: $new_version"
|
||
|
||
# Automatically run update to send new information to PatchMon
|
||
info "Sending updated information to PatchMon..."
|
||
if "$0" update; then
|
||
success "Successfully sent updated information to PatchMon"
|
||
else
|
||
warning "Failed to send updated information to PatchMon (this is not critical)"
|
||
fi
|
||
else
|
||
error "Downloaded script is invalid"
|
||
rm -f "/tmp/patchmon-agent-new.sh"
|
||
fi
|
||
else
|
||
error "Failed to download new agent script"
|
||
fi
|
||
}
|
||
|
||
# Update crontab with current policy
|
||
update_crontab() {
|
||
load_credentials
|
||
info "Updating crontab with current policy..."
|
||
local response=$(curl $CURL_FLAGS -H "X-API-ID: $API_ID" -H "X-API-KEY: $API_KEY" -X GET "$PATCHMON_SERVER/api/$API_VERSION/settings/update-interval")
|
||
if [[ $? -eq 0 ]]; then
|
||
local update_interval=$(echo "$response" | grep -o '"updateInterval":[0-9]*' | cut -d':' -f2)
|
||
# Fallback if not found
|
||
if [[ -z "$update_interval" ]]; then
|
||
update_interval=60
|
||
fi
|
||
# Normalize interval: 5-59 valid, otherwise snap to hour presets
|
||
if [[ $update_interval -lt 5 ]]; then
|
||
update_interval=5
|
||
elif [[ $update_interval -gt 1440 ]]; then
|
||
update_interval=1440
|
||
fi
|
||
if [[ -n "$update_interval" ]]; then
|
||
# Generate the expected crontab entry
|
||
local expected_crontab=""
|
||
if [[ $update_interval -lt 60 ]]; then
|
||
# Every N minutes (5-59)
|
||
expected_crontab="*/$update_interval * * * * /usr/local/bin/patchmon-agent.sh update >/dev/null 2>&1"
|
||
else
|
||
# Hour-based schedules
|
||
if [[ $update_interval -eq 60 ]]; then
|
||
# Hourly updates starting at current minute to spread load
|
||
local current_minute=$(date +%M)
|
||
expected_crontab="$current_minute * * * * /usr/local/bin/patchmon-agent.sh update >/dev/null 2>&1"
|
||
else
|
||
# For 120, 180, 360, 720, 1440 -> every H hours at minute 0
|
||
local hours=$((update_interval / 60))
|
||
expected_crontab="0 */$hours * * * /usr/local/bin/patchmon-agent.sh update >/dev/null 2>&1"
|
||
fi
|
||
fi
|
||
|
||
# Get current crontab (without patchmon entries)
|
||
local current_crontab_without_patchmon=$(crontab -l 2>/dev/null | grep -v "/usr/local/bin/patchmon-agent.sh update" || true)
|
||
local current_patchmon_entry=$(crontab -l 2>/dev/null | grep "/usr/local/bin/patchmon-agent.sh update" | head -1)
|
||
|
||
# Check if crontab needs updating
|
||
if [[ "$current_patchmon_entry" == "$expected_crontab" ]]; then
|
||
info "Crontab is already up to date (interval: $update_interval minutes)"
|
||
return 2 # Special return code for "already up to date"
|
||
fi
|
||
|
||
info "Setting update interval to $update_interval minutes"
|
||
|
||
# Combine existing cron (without patchmon entries) + new patchmon entry
|
||
{
|
||
if [[ -n "$current_crontab_without_patchmon" ]]; then
|
||
echo "$current_crontab_without_patchmon"
|
||
fi
|
||
echo "$expected_crontab"
|
||
} | crontab -
|
||
|
||
success "Crontab updated successfully (duplicates removed)"
|
||
else
|
||
error "Could not determine update interval from server"
|
||
fi
|
||
else
|
||
error "Failed to get update interval policy"
|
||
fi
|
||
}
|
||
|
||
# Show detailed system diagnostics
|
||
show_diagnostics() {
|
||
info "PatchMon Agent Diagnostics v$AGENT_VERSION"
|
||
echo ""
|
||
|
||
# System information
|
||
echo "=== System Information ==="
|
||
echo "OS: $(uname -s)"
|
||
echo "Architecture: $(uname -m)"
|
||
echo "Kernel: $(uname -r)"
|
||
echo "Hostname: $(hostname)"
|
||
echo "Uptime: $(uptime -p 2>/dev/null || uptime)"
|
||
echo ""
|
||
|
||
# Agent information
|
||
echo "=== Agent Information ==="
|
||
echo "Version: $AGENT_VERSION"
|
||
echo "Script Path: $0"
|
||
echo "Config File: $CONFIG_FILE"
|
||
echo "Credentials File: $CREDENTIALS_FILE"
|
||
echo "Log File: $LOG_FILE"
|
||
echo "Script Size: $(stat -c%s "$0" 2>/dev/null || echo "Unknown") bytes"
|
||
echo "Last Modified: $(stat -c%y "$0" 2>/dev/null || echo "Unknown")"
|
||
echo ""
|
||
|
||
# Configuration
|
||
if [[ -f "$CONFIG_FILE" ]]; then
|
||
echo "=== Configuration ==="
|
||
cat "$CONFIG_FILE"
|
||
echo ""
|
||
else
|
||
echo "=== Configuration ==="
|
||
echo "No configuration file found at $CONFIG_FILE"
|
||
echo ""
|
||
fi
|
||
|
||
# Credentials status
|
||
echo "=== Credentials Status ==="
|
||
if [[ -f "$CREDENTIALS_FILE" ]]; then
|
||
echo "Credentials file exists: Yes"
|
||
echo "File size: $(stat -c%s "$CREDENTIALS_FILE" 2>/dev/null || echo "Unknown") bytes"
|
||
echo "File permissions: $(stat -c%a "$CREDENTIALS_FILE" 2>/dev/null || echo "Unknown")"
|
||
else
|
||
echo "Credentials file exists: No"
|
||
fi
|
||
echo ""
|
||
|
||
# Crontab status
|
||
echo "=== Crontab Status ==="
|
||
local crontab_entries=$(crontab -l 2>/dev/null | grep patchmon-agent || echo "None")
|
||
if [[ "$crontab_entries" != "None" ]]; then
|
||
echo "Crontab entries:"
|
||
echo "$crontab_entries"
|
||
else
|
||
echo "No crontab entries found"
|
||
fi
|
||
echo ""
|
||
|
||
# Network connectivity
|
||
echo "=== Network Connectivity ==="
|
||
if ping -c 1 -W 3 "$(echo "$PATCHMON_SERVER" | sed 's|http://||' | sed 's|https://||' | cut -d: -f1)" >/dev/null 2>&1; then
|
||
echo "Server reachable: Yes"
|
||
else
|
||
echo "Server reachable: No"
|
||
fi
|
||
echo "Server URL: $PATCHMON_SERVER"
|
||
echo ""
|
||
|
||
# Recent logs
|
||
echo "=== Recent Logs (last 10 lines) ==="
|
||
if [[ -f "$LOG_FILE" ]]; then
|
||
tail -10 "$LOG_FILE" 2>/dev/null || echo "Could not read log file"
|
||
else
|
||
echo "Log file does not exist"
|
||
fi
|
||
}
|
||
|
||
# Show current configuration
|
||
show_config() {
|
||
info "Current Configuration:"
|
||
echo " Server: ${PATCHMON_SERVER}"
|
||
echo " API Version: ${API_VERSION}"
|
||
echo " Agent Version: ${AGENT_VERSION}"
|
||
echo " Config File: ${CONFIG_FILE}"
|
||
echo " Credentials File: ${CREDENTIALS_FILE}"
|
||
echo " Log File: ${LOG_FILE}"
|
||
|
||
if [[ -f "$CREDENTIALS_FILE" ]]; then
|
||
source "$CREDENTIALS_FILE"
|
||
echo " API ID: ${API_ID}"
|
||
echo " API Key: ${API_KEY:0:8}..." # Show only first 8 characters
|
||
else
|
||
echo " API Credentials: Not configured"
|
||
fi
|
||
}
|
||
|
||
# Main function
|
||
main() {
|
||
case "$1" in
|
||
"configure")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
configure_credentials "$2" "$3" "$4"
|
||
;;
|
||
"test")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
test_credentials
|
||
;;
|
||
"update")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
detect_os
|
||
send_update
|
||
;;
|
||
"ping")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
ping_server
|
||
;;
|
||
"config")
|
||
load_config
|
||
show_config
|
||
;;
|
||
"check-version")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
check_version
|
||
;;
|
||
"check-agent-update")
|
||
setup_directories
|
||
load_config
|
||
check_agent_update
|
||
;;
|
||
"update-agent")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
update_agent
|
||
;;
|
||
"update-crontab")
|
||
check_root
|
||
setup_directories
|
||
load_config
|
||
update_crontab
|
||
;;
|
||
"diagnostics")
|
||
show_diagnostics
|
||
;;
|
||
*)
|
||
echo "PatchMon Agent v$AGENT_VERSION - API Credential Based"
|
||
echo "Usage: $0 {configure|test|update|ping|config|check-version|check-agent-update|update-agent|update-crontab|diagnostics}"
|
||
echo ""
|
||
echo "Commands:"
|
||
echo " configure <API_ID> <API_KEY> [SERVER_URL] - Configure API credentials for this host"
|
||
echo " test - Test API credentials connectivity"
|
||
echo " update - Send package update information to server"
|
||
echo " ping - Test connectivity to server"
|
||
echo " config - Show current configuration"
|
||
echo " check-version - Check for agent updates"
|
||
echo " check-agent-update - Check for agent updates using timestamp comparison"
|
||
echo " update-agent - Update agent to latest version"
|
||
echo " update-crontab - Update crontab with current policy"
|
||
echo " diagnostics - Show detailed system diagnostics"
|
||
echo ""
|
||
echo "Setup Process:"
|
||
echo " 1. Contact your PatchMon administrator to create a host entry"
|
||
echo " 2. Run: $0 configure <API_ID> <API_KEY> [SERVER_URL] (provided by admin)"
|
||
echo " 3. Run: $0 test (to verify connection)"
|
||
echo " 4. Run: $0 update (to send initial package data)"
|
||
echo ""
|
||
echo "Configuration:"
|
||
echo " Edit $CONFIG_FILE to customize server settings"
|
||
echo " PATCHMON_SERVER=http://your-server:3001"
|
||
exit 1
|
||
;;
|
||
esac
|
||
}
|
||
|
||
# Run main function
|
||
main "$@"
|