#!/bin/bash # OSSEC Agent installer # Name: ossec-installer.sh # Copyright Atomicorp 2025 # License: Commercial. Unauthorized redistribution prohibited. ################### # Global variables ################### ROOT_UID=0 USE_AWS=0 VERSION=8.4.1 ATOMICORP_GPG_LEGACY_BASENAME="RPM-GPG-KEY.atomicorp.txt" ATOMICORP_GPG_MODERN_BASENAME="RPM-GPG-KEY.atomicorp.2026.txt" ATOMICORP_ALPINE_RSA_BASENAME="atomicorp-alpine.rsa.pub" AWS_IP="169.254.169.254" O_CONF="/var/ossec/etc/ossec.conf" LOG=/var/log/atomicorp.log HTTP="http" HTTP_ENROLL="false" UPGRADE=0 EXCLUDE_CLAMAV=0 OSSEC_CONF_BACKUP="" ################### # Functions ################### function show_help() { echo echo "Atomicorp OSSEC Agent installer ($VERSION)" echo "Usage: $0 " echo " example: $0 10.11.12.13" echo " or" echo " example: $0 --server 10.11.12.13" echo echo echo "options (deprecated):" echo " IP of server hub" echo " optional. IP of registration service. Default: " echo " optional. Protocol tcp or udp" echo " optional. Port for remoted" echo " optional. Group to assign agent" echo echo "command line parameters:" echo " --server IP/Hostname of the server hub" echo " --auth IP/Hostname of the registration service. Default: " echo " --password Registration authentication password" echo " --port Port for remoted" echo " --protocol Protocol for remoted" echo echo " --agent-name Set agent name [Default: hostname]" echo " --enable-unattended-upgrades Enable unattended upgrade support (Debian/Ubuntu only)" echo " --exclude-clamav Exclude ClamAV packages" echo " --default-name Prepend the external IP of the agent to agent name" echo " --group Group to assign agent" echo " --https Use https for installation" echo " --install-only Only install the agent, do not register" echo " --proxy Proxy settings. Proxy URL, or disable proxy for this installation" echo " --use-aws Use the AWS instance ID for the agent name" echo " --version Show Version" echo " --https-enrollment Register agent over HTTPS" echo " --upgrade Upgrade existing installation (preserve config/registration)" echo echo "environment variables" echo " example: export SERVER_IP=10.11.12.13 $0" echo echo " AUTH_IP IP of server registration service. " echo " GROUP Group to assign agent" echo " PASSWORD Registration authentication password" echo " PROTOCOL Protocol tcp or udp" echo " PORT Port for remoted" echo " SERVER_IP IP of server hub" echo } # log and messaging facility # If type is set to log, and DEBUG is true, then the message will be echoed to the console # if type is log, only write to the log file # if type is debug, only write to the console show_msg() { msg=$1 if [[ $2 == "log" ]]; then if [[ $DEBUG ]]; then echo "$(date) DEBUG: $msg" fi echo "$(date) $msg" >> $LOG elif [[ $2 == "error" ]]; then echo $msg echo "$(date) $msg" >> $LOG elif [[ $2 == "debug" ]]; then echo "$(date) DEBUG: $msg" echo "$(date) DEBUG: $msg" >> $LOG else echo $msg fi } # Reject OpenCSW (/opt/csw) and Sun Freeware (/usr/sfw) — often broken (e.g. libssl). is_legacy_tool_path() { case "$1" in /opt/csw/*|/usr/sfw/*|/opt/csw|/usr/sfw) return 0 ;; *) return 1 ;; esac } # Smoke-test that a downloader binary runs. Legacy paths always fail. tool_is_healthy() { local bin="$1" local name [ -n "$bin" ] && [ -x "$bin" ] || return 1 if is_legacy_tool_path "$bin"; then return 1 fi name=${bin##*/} case "$name" in curl|curl.real) "$bin" --version >/dev/null 2>&1 ;; wget) "$bin" --version >/dev/null 2>&1 || "$bin" -V >/dev/null 2>&1 ;; *) return 0 ;; esac } # Resolve a healthy tool: prefer explicit candidates, then PATH — never CSW/SFW. # Usage: find_healthy_tool [absolute-path ...] find_healthy_tool() { local name="$1" local candidate shift for candidate in "$@"; do if tool_is_healthy "$candidate"; then printf '%s\n' "$candidate" return 0 fi done candidate=$(command -v "$name" 2>/dev/null) || candidate="" if [ -n "$candidate" ] && tool_is_healthy "$candidate"; then printf '%s\n' "$candidate" return 0 fi return 1 } function detect_downloader() { local curl_bin wget_bin # Prefer system/AWP curl; never broken /usr/sfw or /opt/csw wget curl_bin=$(find_healthy_tool curl \ /usr/bin/curl \ /bin/curl \ /usr/local/bin/curl \ /opt/freeware/bin/curl \ /opt/atomicorp/bin/curl.real \ /opt/atomicorp/bin/curl) || curl_bin="" wget_bin=$(find_healthy_tool wget \ /usr/bin/wget \ /bin/wget \ /opt/freeware/bin/wget \ /opt/atomicorp/bin/wget) || wget_bin="" if [ -n "$curl_bin" ]; then GET="$curl_bin -s -O" DOWNLOADER="$curl_bin" elif [ -n "$wget_bin" ]; then GET="$wget_bin -q" DOWNLOADER="$wget_bin" else show_msg "ERROR: downloader not detected (no healthy curl/wget; /usr/sfw and /opt/csw ignored). Exiting" error exit 1 fi show_msg "GET=$GET" log } # Download URL into the current directory (remote basename), using detect_downloader(). download_url() { local url="$1" if [[ "$DOWNLOADER" == *curl* ]]; then "$DOWNLOADER" -fsSL -O "$url" elif [[ "$DOWNLOADER" == *wget* ]]; then "$DOWNLOADER" -q "$url" else show_msg "ERROR: Unsupported downloader: $DOWNLOADER" error return 1 fi } # Backup/restore helpers for --upgrade (preserve registration and manager settings). backup_ossec_conf() { OSSEC_CONF_BACKUP="" if [ -f "$O_CONF" ]; then OSSEC_CONF_BACKUP="${O_CONF}.backup-$(date +%Y%m%d%H%M%S)" cp "$O_CONF" "$OSSEC_CONF_BACKUP" show_msg "Backed up existing configuration to ${OSSEC_CONF_BACKUP}" log fi } restore_ossec_conf() { if [ -n "$OSSEC_CONF_BACKUP" ] && [ -f "$OSSEC_CONF_BACKUP" ]; then cp "$OSSEC_CONF_BACKUP" "$O_CONF" show_msg "Restored configuration from backup" log fi } restart_ossec_agent() { show_msg "Restarting OSSEC Agent after upgrade" log if command -v systemctl >/dev/null 2>&1; then systemctl restart ossec-agent >/dev/null 2>&1 \ || systemctl restart ossec-hids >/dev/null 2>&1 \ || true fi if [ -f /var/ossec/bin/ossec-control ]; then /var/ossec/bin/ossec-control restart elif command -v rc-service >/dev/null 2>&1; then rc-service ossec restart 2>/dev/null || true elif command -v service >/dev/null 2>&1; then service ossec-agent restart 2>/dev/null || service ossec-hids restart 2>/dev/null || service ossec restart 2>/dev/null || true fi } function request_agent_key() { server_ip="$1" show_msg "Requesting agent key from $server_ip using request_agent_key" log if [ -n "$AGENT_NAME" ]; then local url="https://${server_ip}:${PORT}/agent_register/?key=none&hostname=${agent_name}" else local url="https://${server_ip}:${PORT}/agent_register/?key=none&hostname=$(hostname)" fi export PATH=/opt/csw/bin:/opt/freeware/bin:$PATH cmd="curl -k -o /var/ossec/etc/client.keys.tmp \"$url\"" eval "$cmd" local status=$? if [[ $status -eq 0 ]]; then echo "Request successful. Response saved to $output_file." awk -F\' '{print $2}' /var/ossec/etc/client.keys.tmp > /var/ossec/etc/client.keys return 0 else echo "ERROR: Request failed with status code $status." return 1 fi } # Smoketests function smoketest() { # Log and attempt to download diag.sh show_msg "Downloading diag.sh for smoketest..." log if [[ "$DOWNLOADER" == *curl* ]]; then $DOWNLOADER -f -o diag.sh ${HTTP}://${SERVER_IP}/tests/diag.sh 2>>$LOG elif [[ "$DOWNLOADER" == *wget* ]]; then $DOWNLOADER -O diag.sh ${HTTP}://${SERVER_IP}/tests/diag.sh 2>>$LOG else show_msg "ERROR: Unsupported downloader: $DOWNLOADER" error exit 1 fi # Check if the download command was successful if [[ $? -ne 0 ]]; then echo show_msg "ERROR: Failed to download diag.sh($DOWNLOADER ${HTTP}://${SERVER_IP}/tests/diag.sh)" error echo -n " " show_msg "NOTE: If this is a new installation of the hub server it may still be initializing its repositories" error echo exit 1 fi # Ensure the file exists and is not empty if [[ ! -f diag.sh || ! -s diag.sh ]]; then echo show_msg "ERROR: The downloaded diag.sh file is missing or empty." error echo exit 1 fi # Move and set executable permissions mv diag.sh /var/ossec/bin/ if [[ $? -ne 0 ]]; then echo show_msg "ERROR: Failed to move diag.sh to /var/ossec/bin/" error echo exit 1 fi chmod +x /var/ossec/bin/diag.sh if [[ $? -ne 0 ]]; then echo show_msg "ERROR: Failed to set executable permissions for /var/ossec/bin/diag.sh" error echo exit 1 fi # Run the diagnostic script and log the output show_msg "Running diag.sh..." log /var/ossec/bin/diag.sh agent | tee -a $LOG # Check if diag.sh ran successfully if [[ $? -ne 0 ]]; then show_msg "ERROR: diag.sh execution failed." error exit 1 fi show_msg "Smoketest completed successfully." log } function password_auth() { if [ -n "$PASSWORD" ]; then echo "$PASSWORD" > /var/ossec/etc/authd.pass chmod 640 /var/ossec/etc/authd.pass chown root.ossec /var/ossec/etc/authd.pass show_msg "Password added to /var/ossec/etc/authd.pass" log fi } # Hub check function hub_check() { # List of packages to check packages=("awp-hub-utils" "ossec-hids-server") for pkg in "${packages[@]}"; do if rpm -q $pkg &> /dev/null; then show_msg "ERROR: Package $pkg is installed. Are you attempting agent installation on a hub? Exiting." exit 1 fi done } app_error() { RETVAL=$1 MSG=$2 if [ $RETVAL -ne 0 ];then echo show_msg " ERROR: $MSG ($RETVAL)" error echo exit 1 fi } app_error_authd() { RETVAL=$1 MSG=$2 if [ $RETVAL -ne 0 ];then echo show_msg " ERROR: $MSG ($RETVAL)" error echo show_msg "###############################################" error show_msg "Running Diagnostics: " error show_msg "###############################################" error show_msg show_msg " Testing agent-auth validity: " error /var/ossec/bin/agent-auth -h | tee -a $LOG if [ $? -eq 0 ]; then echo show_msg " Testing agent-auth connectivity: " error /var/ossec/bin/agent-auth -m ${AUTH_IP} | tee -a $LOG echo fi echo if [ -f /usr/sbin/getenforce ]; then echo -n " Getting SELinux state: " | tee -a $LOG getenforce | tee -a $LOG fi if [ -f /usr/bin/audit2allow ] ; then echo echo -n " Running audit2allow please be patient: " | tee -a $LOG audit2allow -a > /root/audit2allow-ossec.log echo "done"| tee -a $LOG echo cat /root/audit2allow-ossec.log| tee -a $LOG fi echo exit 1 fi } aws_register () { echo "" echo "inside aws_register function." echo #this is held over from the previous version. IF this command works then it finishes method one. OTherwise, attempt method 2. echo "Attempting to determine instance id using IMDSv1 method..." curl -fs ${HTTP}://$AWS_IP/latest/meta-data/instance-id ret=$? if [ "$ret" -ne 0 ]; then echo #method 2 needs a token to my knowledge, so it gets one and does this curl. show_msg " ERROR: Could not determine instance-id using IMDSv1 method. Attempting IMDSv2 method..." error TOKEN=curl -fs http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" instance_id=$(curl -fs http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN") ret=$? #if method 2 fails, just exit. if [ "$ret" -ne 0 ]; then echo show_msg " ERROR: Could not determine instance-id using IMDSv2 method. Exiting..." error exit 1 else #method 2 success block, similar to method 1. echo echo "Success, authenticating..." echo #register agent if [ "$HTTP_ENROLL" = true ]; then /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${instance_id} -G ${GROUP} -H | tee -a $LOG app_error_authd ${PIPESTATUS[0]} " aws_register: agent authorization failed" else # Commands if HTTP_ENROLL is not true /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${instance_id} -G ${GROUP} | tee -a $LOG app_error_authd ${PIPESTATUS[0]} " aws_register: agent authorization failed" fi show_msg "AGENT_NAME=$instance_id" log fi else #method 1 success block echo echo "Success, authenticating..." echo #Obtain Agent Name AGENT_NAME=$(curl -fs ${HTTP}://$AWS_IP/latest/meta-data/instance-id) #Register the Agent if [ "$HTTP_ENROLL" = true ]; then # Commands to execute if HTTP_ENROLL is true /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${AGENT_NAME} -G ${GROUP} -H | tee -a $LOG app_error_authd ${PIPESTATUS[0]} " aws_register: agent authorization failed" else # Commands if HTTP_ENROLL is not true /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${AGENT_NAME} -G ${GROUP} | tee -a $LOG app_error_authd ${PIPESTATUS[0]} " aws_register: agent authorization failed" fi show_msg "AGENT_NAME=$AGENT_NAME" log fi } ossec_conf_update(){ MSG="configuration failed for Hub server destination" # Test for ossec.conf server-ip if ! grep ${SERVER_IP} $O_CONF >/dev/null; then if grep address $O_CONF >/dev/null; then $SED -i "s/
.*/
${SERVER_IP}<\/address>\n ${PORT}<\/port>/g" $O_CONF app_error ${PIPESTATUS[0]} $MSG $SED -i "s/.*/${PROTOCOL}<\/protocol>/g" $O_CONF app_error ${PIPESTATUS[0]} $MSG $SED -i "s/.*/${AUTH_IP}<\/manager_address>/g" $O_CONF app_error ${PIPESTATUS[0]} $MSG # Legacy elif grep server-ip $O_CONF >/dev/null; then $SED -i "s/.*/
${SERVER_IP}<\/address>${PORT}<\/port>${PROTOCOL}<\/protocol><\/server>/g" $O_CONF app_error ${PIPESTATUS[0]} $MSG fi fi # if the AGENT_NAME is set, then update the agent_name value in the config or add it if it doesn't exist if [ -n "$AGENT_NAME" ]; then if grep "" $O_CONF >/dev/null; then $SED -i "s/.*/${AGENT_NAME}<\/agent_name>/g" $O_CONF app_error ${PIPESTATUS[0]} " ossec_conf_update: agent_name update failed" else # Look for the line and add after it $SED -i "//a ${AGENT_NAME}<\/agent_name>" $O_CONF $SED -i "//s/^/ /" $O_CONF app_error ${PIPESTATUS[0]} " ossec_conf_update: agent_name add failed" fi else $SED -i "//d" "$O_CONF" app_error ${PIPESTATUS[0]} " ossec_conf_update: groups remove failed" fi if [ -n "$GROUP" ]; then if grep "" $O_CONF >/dev/null; then $SED -i "s/.*/${GROUP}<\/groups>/g" $O_CONF app_error ${PIPESTATUS[0]} " ossec_conf_update: groups update failed" else $SED -i "//a ${GROUP}<\/groups>" "$O_CONF" $SED -i "//s/^/ /" "$O_CONF" app_error ${PIPESTATUS[0]} " ossec_conf_update: groups add failed" fi else $SED -i "//d" "$O_CONF" app_error ${PIPESTATUS[0]} " ossec_conf_update: groups remove failed" fi } # Solaris 10 support ossec_conf_update_legacy() { MSG="configuration failed for Hub server destination" # Write the ed commands to update
and within printf "//,/<\/server>/s|
.*
|
%s
|\n" "$SERVER_IP" > /tmp/ed_commands printf "//,/<\/server>/s|.*|%s|\n" "$PORT" >> /tmp/ed_commands printf "//,/<\/server>/s|.*|%s|\n" "$PROTOCOL" >> /tmp/ed_commands printf "w\nq\n" >> /tmp/ed_commands # Run ed with the generated commands ed -s "$O_CONF" < /tmp/ed_commands # Capture error status if [ $? -ne 0 ]; then echo "ERROR: $MSG" return 2 fi # Cleanup rm -f /tmp/ed_commands } key_generate() { if [[ $NO_REGISTER -eq 1 ]]; then show_msg "Agent registration skipped" log else password_auth # Add agent key if [ ! -s /var/ossec/etc/client.keys ]; then if [ "$USE_AWS" -eq 1 ]; then aws_register else if [ -z "$AGENT_NAME" ]; then if [ "$HTTP_ENROLL" = true ]; then #if [[ $PKG == "aix" || $PKG == "pkg" ]]; then request_agent_key ${AUTH_IP} #else # /var/ossec/bin/agent-auth -m ${AUTH_IP} -G ${GROUP} -I any -H |tee -a $LOG #fi app_error_authd ${PIPESTATUS[0]} " key_generate: agent authorization failed" else /var/ossec/bin/agent-auth -m ${AUTH_IP} -G ${GROUP} -I any |tee -a $LOG app_error_authd ${PIPESTATUS[0]} " key_generate: agent authorization failed" fi else if [ "$HTTP_ENROLL" = true ]; then #if [[ $PKG == "aix" || $PKG == "pkg" ]]; then request_agent_key ${AUTH_IP} #else # /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${AGENT_NAME} -G ${GROUP} -I any -H |tee -a $LOG #fi app_error_authd ${PIPESTATUS[0]} " key_generate[named agent]: agent authorization failed" else /var/ossec/bin/agent-auth -m ${AUTH_IP} -A ${AGENT_NAME} -G ${GROUP} -I any |tee -a $LOG app_error_authd ${PIPESTATUS[0]} " key_generate[named agent]: agent authorization failed" fi fi fi show_msg "Agent registered successfully" log else show_msg "Skipping, agent is already registered" log fi chown ossec:ossec /var/ossec/etc/client.keys chmod 640 /var/ossec/etc/client.keys chown root:ossec /var/ossec/etc chmod 770 /var/ossec/etc fi } yum_install () { # Download and import GPG key before creating repo if [ ! -d /etc/pki/rpm-gpg ]; then mkdir -p /etc/pki/rpm-gpg/ fi if [ ! -f /etc/pki/rpm-gpg/${GPG_KEY_FILE} ]; then show_msg "Downloading GPG key: ${GPG_KEY_FILE}" log pushd /etc/pki/rpm-gpg/ >/dev/null $GET ${HTTP}://${SERVER_IP}/${GPG_KEY_FILE} >> $LOG 2>&1 popd >/dev/null if [ -f /etc/pki/rpm-gpg/${GPG_KEY_FILE} ]; then rpm --import /etc/pki/rpm-gpg/${GPG_KEY_FILE} show_msg "Imported GPG key: ${GPG_KEY_FILE}" log fi fi # check for repo cat << EOF > /etc/yum.repos.d/atomicorp-ossec.repo [atomicorp-ossec] baseurl = ${HTTP}://${SERVER_IP}/channels/awp-hub-repo/${DIR}/\$basearch gpgcheck = 1 gpgkey = ${HTTP}://${SERVER_IP}/${GPG_KEY_FILE} name = Atomicorp Workload Protection sslverify = 0 EOF if [[ $UPGRADE -eq 1 ]]; then show_msg "Performing upgrade of existing installation..." log if ! rpm -q ossec-hids-agent >/dev/null; then show_msg "ERROR: No existing OSSEC installation found to upgrade" error exit 1 fi backup_ossec_conf local upgrade_pkgs="ossec-hids-agent" rpm -q awp-agent >/dev/null 2>&1 && upgrade_pkgs="${upgrade_pkgs} awp-agent" if [[ $EXCLUDE_CLAMAV -ne 1 ]]; then rpm -q AWPclamav >/dev/null 2>&1 && upgrade_pkgs="${upgrade_pkgs} AWPclamav" # Upgrade stock ClamAV packages only when already installed from the hub/repo. for p in clamav clamav-server clamav-update clamav-filesystem; do rpm -q "$p" >/dev/null 2>&1 && upgrade_pkgs="${upgrade_pkgs} $p" done fi show_msg "Upgrading packages: ${upgrade_pkgs}" log yum -y upgrade ${upgrade_pkgs} | tee -a $LOG app_error ${PIPESTATUS[0]} "yum failed during upgrade" restore_ossec_conf restart_ossec_agent show_msg "Upgrade completed successfully" log return 0 fi # Test for selinux policy # Remove the SELinux policy, this handles the condition if /var/ossec was rm -rf'd if [ ! -d /var/ossec ]; then if command -v getenforce > /dev/null 2>&1 && command -v semodule > /dev/null 2>&1; then if [ $(getenforce) != "Disabled" ]; then if (semodule -l | grep ossec_agent > /dev/null); then semodule -X 200 -r ossec_agent > /dev/null || : fi fi fi fi # Test for agent install if ! rpm -q ossec-hids-agent >/dev/null; then # If CLAMAV_EXCLUDE is set, exclude clamav packages if [[ $EXCLUDE_CLAMAV -eq 1 ]]; then yum --exclude=clamav* -y install ossec-hids-agent /usr/bin/curl| tee -a $LOG else yum -y install ossec-hids-agent /usr/bin/curl| tee -a $LOG fi app_error ${PIPESTATUS[0]} "yum failed during installation" else show_msg "OSSEC Agent install detected" fi if [ ! -d /var/ossec/ ]; then echo show_msg " ERROR: /var/ossec not detected. Client installation failure?" echo " exiting..." echo exit 1 fi ossec_conf_update key_generate if [[ $NO_REGISTER -eq 1 ]]; then show_msg "Installation only: skipping start" else show_msg "Restarting OSSEC Agent" echo /var/ossec/bin/ossec-control restart fi } zypper_install () { # Add keys (openSUSE repo uses legacy RPM repomd signing on hub) if [ ! -f "/etc/pki/rpm-gpg/${ATOMICORP_GPG_LEGACY_BASENAME}" ]; then if [ ! -d /etc/pki/rpm-gpg ]; then mkdir -p /etc/pki/rpm-gpg/ fi pushd /etc/pki/rpm-gpg/ >/dev/null $GET "${HTTP}://${SERVER_IP}/${ATOMICORP_GPG_LEGACY_BASENAME}" >> $LOG 2>&1 popd >/dev/null rpm --import "/etc/pki/rpm-gpg/${ATOMICORP_GPG_LEGACY_BASENAME}" fi # Add repo (ignore if already present) zypper ar ${HTTP}://${SERVER_IP}/channels/awp-hub-repo/opensuse/15.6/x86_64/ atomic-ossec 2>/dev/null || true if [[ $UPGRADE -eq 1 ]]; then show_msg "Performing upgrade of existing installation..." log if ! rpm -q ossec-hids-agent >/dev/null; then show_msg "ERROR: No existing OSSEC installation found to upgrade" error exit 1 fi backup_ossec_conf local upgrade_pkgs="ossec-hids-agent" rpm -q awp-agent >/dev/null 2>&1 && upgrade_pkgs="${upgrade_pkgs} awp-agent" if [[ $EXCLUDE_CLAMAV -ne 1 ]] && rpm -q clamav >/dev/null 2>&1; then upgrade_pkgs="${upgrade_pkgs} clamav" fi show_msg "Upgrading packages: ${upgrade_pkgs}" log /usr/bin/zypper --gpg-auto-import-keys -n update ${upgrade_pkgs} if [ $? -ne 0 ]; then app_error $? "ERROR: zypper upgrade failed" fi restore_ossec_conf restart_ossec_agent show_msg "Upgrade completed successfully" log return 0 fi # Install the customer agent stack. openSUSE provides clamd, clamonacc, # freshclam, and clamscan together in the clamav package. local install_pkgs=(curl ossec-hids-agent awp-agent) if [[ $EXCLUDE_CLAMAV -ne 1 ]]; then install_pkgs+=(clamav) fi show_msg "Installing packages: ${install_pkgs[*]}" log /usr/bin/zypper --gpg-auto-import-keys -n install "${install_pkgs[@]}" if [ $? -ne 0 ]; then app_error ${PIPESTATUS[0]} "ERROR: openSUSE agent installation failed" fi ossec_conf_update key_generate if [[ $NO_REGISTER -eq 1 ]]; then show_msg "Installation only: skipping start" else # Start service (systemd unit is ossec-agent; fall back to ossec-control) if command -v systemctl >/dev/null 2>&1; then systemctl enable ossec-agent >/dev/null 2>&1 || : systemctl restart ossec-agent >/dev/null 2>&1 || /var/ossec/bin/ossec-control restart else /var/ossec/bin/ossec-control restart fi fi } # This function will enable unattended upgrades on an apt based system # ex: enable_unattended_upgrades_for_repo "Atomicorp Agent Repository" "stable" enable_unattended_upgrades_for_repo() { local origin="$1" local label="$2" local config_file="/etc/apt/apt.conf.d/99atomicorp-unattended-upgrades" # Ensure both origin and label are provided if [[ -z "$origin" || -z "$label" ]]; then echo "Usage: enable_unattended_upgrades_for_repo