#!/bin/bash
# Filename: Auditd_Deploy.sh
# Funciton: 审计系统部署
# Author: shuhui


### Define Variables

SERVER_ADDR="127.0.0.1"                        # Auditd Server Address
LISTEN_PORT='60'                               # Auditd Listen Port
STAFF_NETWORK='192.168.10.0/24'                # Allow Sub network


function Server() { 
    yum -y install audit

    sed -i "s/.*tcp_listen_port.*/tcp_listen_port = ${LISTEN_PORT}/" /etc/audit/auditd.conf 

    service auditd restart 

    echo -en "\n# deny all by default\nauditd: ALL" >> /etc/hosts.deny
    echo -en "\n# Allow Network\nauditd: ${STAFF_NETWORK}" >> /etc/hosts.allow

}

function Client() {
    yum -y install audispd-plugins

    sed -i "s/^active.*/active = yes/" /etc/audisp/plugins.d/au-remote.conf
    sed -i "s/^remote_server/remote_server = ${SERVER_ADDR}" /etc/audisp/audisp-remote.conf
    sed -i "s/^port.*/port = ${LISTEN_PORT}/" /etc/audisp/audisp-remote.conf
    sed -i "s/^log_format.*/log_format = NOLOG/" /etc/audit/auditd.conf 

    service auditd restart 
}

case $1 in 
    server)
        Server
        ;;

    client)
        Client
        ;;
    *)
        echo "Usage: $(basename $0) Server | Client"
esac
