#!/bin/bash

# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC

#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.

source ./so-whiptail
source ./so-variables
source ./so-common-functions

SOVERSION=1.4.0

accept_salt_key_remote() {
	systemctl restart salt-minion
	
	echo "Accept the key remotely on the master" >> "$setup_log" 2>&1
	# Delete the key just in case.
	ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -d "$MINION_ID" -y
	salt-call state.apply ca
	ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -a "$MINION_ID" -y

}


add_admin_user() {
	# Add an admin user with full sudo rights if this is an ISO install. 
	{
		useradd "$ADMINUSER";
		echo "$ADMINUSER":"$ADMINPASS1" | chpasswd --crypt-method=SHA512;
		usermod -aG wheel "$ADMINUSER";
	} >> "$setup_log" 2>&1
	
}

add_master_hostfile() {

	[ -n "$TESTING" ] && return

	echo "Checking if I can resolve master. If not add to hosts file" >> "$setup_log" 2>&1
	# Pop up an input to get the IP address
	MSRVIP=$(whiptail --title "Security Onion Setup" --inputbox \
	"Enter your Master Server IP Address" 10 60 X.X.X.X 3>&1 1>&2 2>&3)

	local exitstatus=$?
	whiptail_check_exitstatus $exitstatus
}

addtotab_generate_templates() {

	local addtotab_path=$local_salt_dir/pillar/data

	for i in evaltab mastersearchtab mastertab nodestab sensorstab; do
		printf '%s\n'\
		"$i:"\
		"" > "$addtotab_path"/$i.sls
		echo "Added $i Template"
	done

}

# $5 => (optional) password variable
so_add_user() {
	local username=$1
	local uid=$2
	local gid=$3
	local home_dir=$4
	if [ "$5" ]; then local pass=$5; fi

	echo "Add $username user" >> "$setup_log" 2>&1
	groupadd --gid "$gid" "$username"
	useradd --uid "$uid" --gid "$gid" --home-dir "$home_dir" "$username"

	# If a password has been passed in, set the password
	if [ "$pass" ]; then
		echo "$username":"$pass" | chpasswd --crypt-method=SHA512
	fi
}

add_socore_user_master() {
	so_add_user "socore" "939" "939" "/opt/so" >> "$setup_log" 2>&1
}

add_soremote_user_master() {
	so_add_user "soremote" "947" "947" "/home/soremote" "$SOREMOTEPASS1" >> "$setup_log" 2>&1
}

wait_for_file() {
	local filename=$1
	local max_attempts=$2 # this is multiplied by the wait interval, so make sure it isn't too large
	local cur_attempts=0
	local wait_interval=$3
	local total_time=$(( max_attempts * wait_interval ))
	local date
	date=$(date)

	while [[ $cur_attempts -lt $max_attempts ]]; do
		if [ -f "$filename" ]; then
			echo "File $filename found at $date" >> "$setup_log" 2>&1
			return 0
		else
			((cur_attempts++))
			echo "File $filename does not exist; waiting ${wait_interval}s then checking again ($cur_attempts/$max_attempts)..." >> "$setup_log" 2>&1
			sleep "$wait_interval"
		fi
	done
	echo "Could not find $filename after waiting ${total_time}s" >> "$setup_log" 2>&1
	return 1
}

add_web_user() {
	wait_for_file /opt/so/conf/kratos/db/db.sqlite 30 5
	{
		echo "Attempting to add administrator user for web interface...";
		echo "$WEBPASSWD1" | /usr/sbin/so-user add "$WEBUSER";
		echo "Add user result: $?";
	} >> "$setup_log" 2>&1
}

# Create an secrets pillar so that passwords survive re-install
secrets_pillar(){
  if [ ! -f $local_salt_dir/pillar/secrets.sls ]; then
	echo "Creating Secrets Pillar" >> "$setup_log" 2>&1
	mkdir -p $local_salt_dir/pillar
	printf '%s\n'\
		"secrets:"\
		"  mysql: $MYSQLPASS"\
		"  playbook: $PLAYBOOKPASS"\
		"  fleet: $FLEETPASS"\
		"  fleet_jwt: $FLEETJWT"\
		"  fleet_enroll-secret: False" > $local_salt_dir/pillar/secrets.sls
  fi
}

# Enable Bro Logs
bro_logs_enabled() {
	echo "Enabling Bro Logs" >> "$setup_log" 2>&1

	local brologs_pillar=./pillar/brologs.sls

	printf '%s\n'\
		"brologs:"\
		"  enabled:" > "$brologs_pillar"

	if [ "$MASTERADV" = 'ADVANCED' ]; then
		for BLOG in "${BLOGS[@]}"; do
			echo "    - $BLOG" | tr -d '"' >> "$brologs_pillar"
		done
	else
		printf '%s\n'\
			"    - conn"\
			"    - dce_rpc"\
			"    - dhcp"\
			"    - dhcpv6"\
			"    - dnp3"\
			"    - dns"\
			"    - dpd"\
			"    - files"\
			"    - ftp"\
			"    - http"\
			"    - intel"\
			"    - irc"\
			"    - kerberos"\
			"    - modbus"\
			"    - mqtt"\
			"    - notice"\
			"    - ntlm"\
			"    - openvpn"\
			"    - pe"\
			"    - radius"\
			"    - rfb"\
			"    - rdp"\
			"    - signatures"\
			"    - sip"\
			"    - smb_files"\
			"    - smb_mapping"\
			"    - smtp"\
			"    - snmp"\
			"    - software"\
			"    - ssh"\
			"    - ssl"\
			"    - syslog"\
			"    - telnet"\
			"    - tunnel"\
			"    - weird"\
			"    - mysql"\
			"    - socks"\
			"    - x509" >> "$brologs_pillar"
	fi

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$brologs_pillar" >> "$setup_log" 2>&1
}

check_admin_pass() {
	check_pass_match "$ADMINPASS1" "$ADMINPASS2" "APMATCH"
}

check_hive_init() {

	wait_for_file /opt/so/state/thehive.txt 20 5
	local return_val=$?
	if [[ $return_val -ne 0 ]]; then
		return $return_val
	fi

	docker stop so-thehive
	docker rm so-thehive
}

check_network_manager_conf() {
	local gmdconf="/usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf"
	local nmconf="/etc/NetworkManager/NetworkManager.conf"
	local preupdir="/etc/NetworkManager/dispatcher.d/pre-up.d"

	if test -f "$gmdconf"; then
		if ! test -f "${gmdconf}.bak"; then
			{
				mv "$gmdconf" "${gmdconf}.bak"
				touch "$gmdconf"
				systemctl restart NetworkManager
			} >> "$setup_log" 2>&1
		fi
	fi
	
	if test -f "$nmconf"; then
		sed -i 's/managed=false/managed=true/g' "$nmconf" >> "$setup_log" 2>&1
	fi

	if [[ ! -d "$preupdir" ]]; then
		mkdir "$preupdir" >> "$setup_log" 2>&1
	fi
}

check_pass_match() {
	local pass=$1
	local confirm_pass=$2
	local var=$3

	if [ "$pass" = "$confirm_pass" ]; then
		export "$var=yes"
	else
		whiptail_passwords_dont_match
	fi
}

check_soremote_pass() {
	check_pass_match "$SOREMOTEPASS1" "$SOREMOTEPASS2" "SCMATCH"
}

check_web_pass() {
	check_pass_match "$WEBPASSWD1" "$WEBPASSWD2" "WPMATCH"
}

clear_master() {
	# Clear out the old master public key in case this is a re-install.
	# This only happens if you re-install the master.
	if [ -f /etc/salt/pki/minion/minion_master.pub ]; then
		{
			echo "Clearing old master key";
			rm -f /etc/salt/pki/minion/minion_master.pub;
			systemctl -q restart salt-minion;
		} >> "$setup_log" 2>&1
	fi

}

collect_soremote_inputs() {
	whiptail_create_soremote_user
	SCMATCH=no
	while [[ $SCMATCH != yes ]]; do
		whiptail_create_soremote_user_password1
		whiptail_create_soremote_user_password2
		check_soremote_pass
	done
}

collect_adminuser_inputs() {
	whiptail_create_admin_user
	APMATCH=no
	while [[ $APMATCH != yes ]]; do
		whiptail_create_admin_user_password1
		whiptail_create_admin_user_password2
		check_admin_pass
	done
}


collect_webuser_inputs() {
	# Get a password for the web admin user
	local valid_user=no
	while [[ $valid_user != yes ]]; do
		whiptail_create_web_user		
		if so-user valemail "$WEBUSER" >> "$setup_log" 2>&1; then
			valid_user=yes
		else
			whiptail_invalid_user_warning
		fi
	done

	WPMATCH=no
	while [[ $WPMATCH != yes ]]; do
		whiptail_create_web_user_password1
		if echo "$WEBPASSWD1" | so-user valpass >> "$setup_log" 2>&1; then
			whiptail_create_web_user_password2
			check_web_pass
		else
			whiptail_invalid_pass_warning
		fi
	done
}

configure_minion() {
	local minion_type=$1
	echo "Configuring minion type as $minion_type" >> "$setup_log" 2>&1
	echo "role: so-$minion_type" > /etc/salt/grains

	local minion_config=/etc/salt/minion

	echo "id: $MINION_ID" > "$minion_config"

	case "$minion_type" in
		'helix')
			echo "master: $HOSTNAME" >> "$minion_config"
			;;
		'master' | 'eval' | 'mastersearch' | 'standalone')
			printf '%s\n'\
				"master: $HOSTNAME"\
				"mysql.host: '$MAINIP'"\
				"mysql.port: 3306"\
				"mysql.user: 'root'" >> "$minion_config"
			if [ ! -f $local_salt_dir/pillar/secrets.sls ]; then
				echo "mysql.pass: '$MYSQLPASS'" >> "$minion_config"
			else
				OLDPASS=$(grep "mysql" $local_salt_dir/pillar/secrets.sls | awk '{print $2}')
				echo "mysql.pass: '$OLDPASS'" >> "$minion_config"
			fi
			;;
		*)
			echo "master: $MSRV" >> "$minion_config"
			;;
	esac

	printf '%s\n'\
		"use_superseded:"\
		"  - module.run"\
		"log_file: /opt/so/log/salt/minion" >> "$minion_config"

	{
		systemctl restart salt-minion;
		printf '%s\n'  '----';
		cat "$minion_config";
	} >> "$setup_log" 2>&1
	
	
}

checkin_at_boot() {
	local minion_config=/etc/salt/minion

	echo "Enabling checkin at boot" >> "$setup_log" 2>&1
	echo "startup_states: highstate" >> "$minion_config"
}


check_requirements() {
	local eval_or_dist=$1
	local node_type=$2 # optional
	local req_mem
	local req_cores
	local nic_list
	readarray -t nic_list <<< "$(ip link| awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "bond0"  | sed 's/ //g')"
	local num_nics=${#nic_list[@]}

	if [[ "$eval_or_dist" == 'eval' ]]; then
		req_mem=12
		req_cores=4
		req_nics=2
	elif [[ "$eval_or_dist" == 'dist' ]]; then
		req_mem=8
		req_cores=4
		if [[ "$node_type" == 'sensor' ]]; then req_nics=2; else req_nics=1; fi
	fi

	if [[ $num_nics -lt $req_nics ]]; then
		whiptail_requirements_error "NICs" "$num_nics" "$req_nics"
	fi

	if [[ $num_cpu_cores -lt $req_cores ]]; then
		whiptail_requirements_error "cores" "$num_cpu_cores" "$req_cores"
	fi
	
	if [[ $total_mem_hr -lt $req_mem ]]; then
		whiptail_requirements_error "memory" "${total_mem_hr}GB" "${req_mem}GB"
	fi
}

copy_master_config() {

	# Copy the master config template to the proper directory
	if [ "$setup_type" = 'iso' ]; then
		cp /root/SecurityOnion/files/master /etc/salt/master >> "$setup_log" 2>&1
	else
		cp ../files/master /etc/salt/master >> "$setup_log" 2>&1
	fi

	# Restart the service so it picks up the changes
	systemctl restart salt-master >> "$setup_log" 2>&1
}

copy_minion_tmp_files() {
	case "$install_type" in
		'MASTER' | 'EVAL' | 'HELIXSENSOR' | 'MASTERSEARCH' | 'STANDALONE')
			echo "Copying pillar and salt files in $temp_install_dir to $local_salt_dir"
			cp -Rv "$temp_install_dir"/pillar/ $local_salt_dir/ >> "$setup_log" 2>&1
			if [ -d "$temp_install_dir"/salt ] ; then
				cp -Rv "$temp_install_dir"/salt/ $local_salt_dir/ >> "$setup_log" 2>&1
			fi
			;;
		*)
			{
				echo "scp pillar and salt files in $temp_install_dir to master $local_salt_dir";
				ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar;
				ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules;
				scp -prv -i /root/.ssh/so.key "$temp_install_dir"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/;
				scp -prv -i /root/.ssh/so.key "$temp_install_dir"/salt/patch/os/schedules/* soremote@"$MSRV":/tmp/"$MINION_ID"/schedules;
				ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/master/files/add_minion.sh "$MINION_ID";
			} >> "$setup_log" 2>&1
			;;
	esac
}

copy_ssh_key() {

	echo "Generating SSH key"
	# Generate SSH key
	mkdir -p /root/.ssh
	ssh-keygen -f /root/.ssh/so.key -t rsa -q -N "" < /dev/zero
	chown -R "$SUDO_USER":"$SUDO_USER" /root/.ssh
	echo "Copying the SSH key to the master"
	#Copy the key over to the master
	ssh-copy-id -f -i /root/.ssh/so.key soremote@"$MSRV"
}

create_local_directories() {
        echo "Creating local pillar and salt directories"
        PILLARSALTDIR=${SCRIPTDIR::-5}
        for i in "pillar" "salt"; do
                for d in `find $PILLARSALTDIR/$i -type d`; do
						suffixdir=${d//$PILLARSALTDIR/}
                        if [ ! -d "$local_salt_dir/$suffixdir" ]; then
	                        mkdir -v "$local_salt_dir$suffixdir" >> "$setup_log" 2>&1
                        fi
                done
                chown -R socore:socore "$local_salt_dir/$i"
        done

}

create_sensor_bond() {
	echo "Setting up sensor bond" >> "$setup_log" 2>&1

	local nic_error=0

	check_network_manager_conf >> "$setup_log" 2>&1
	
	# Set the MTU
	if [[ $NSMSETUP != 'ADVANCED' ]]; then
		MTU=1500
	fi

	# Create the bond interface only if it doesn't already exist
	if ! [[ $(nmcli -f name,uuid -p con | sed -n 's/bond0 //p' | tr -d ' ') ]]; then
		nmcli con add ifname bond0 con-name "bond0" type bond mode 0 -- \
			ipv4.method disabled \
			ipv6.method ignore \
			ethernet.mtu $MTU \
			connection.autoconnect "yes" >> "$setup_log" 2>&1
	fi


	for BNIC in "${BNICS[@]}"; do
		# Check if specific offload features are able to be disabled
		for string in "generic-segmentation-offload" "generic-receive-offload" "tcp-segmentation-offload"; do
			if ethtool -k "$BNIC" | grep $string | grep -q "on [fixed]"; then
				echo "The hardware or driver for interface ${BNIC} is not supported, packet capture may not work as expected." >> "$setup_log" 2>&1
				nic_error=1
				break
			fi
		done

		# Turn off various offloading settings for the interface
		for i in rx tx sg tso ufo gso gro lro; do
			ethtool -K "$BNIC" $i off >> "$setup_log" 2>&1
		done
		
		# Check if the bond slave connection has already been created
		if ! [[ $(nmcli -f name,uuid -p con | sed -n "s/bond0-slave-$BNIC //p" | tr -d ' ') ]]; then
			# Create the slave interface and assign it to the bond
			nmcli con add type ethernet ifname "$BNIC" con-name "bond0-slave-$BNIC" master bond0 -- \
				ethernet.mtu $MTU \
				connection.autoconnect "yes" >> "$setup_log" 2>&1
		fi

		nmcli con up "bond0-slave-$BNIC" >> "$setup_log" 2>&1 # Bring the slave interface up
	done

	if [ $nic_error != 0 ]; then
		return 1
	fi
}

detect_os() {

	# Detect Base OS
	echo "Detecting Base OS" >> "$setup_log" 2>&1
	if [ -f /etc/redhat-release ]; then
		OS=centos
		if grep -q "CentOS Linux release 7" /etc/redhat-release; then
			OSVER=7
		elif grep -q "CentOS Linux release 8" /etc/redhat-release; then
			OSVER=8
			echo "We currently do not support CentOS $OSVER but we are working on it!"
			exit 1
		else
			echo "We do not support the version of CentOS you are trying to use."
			exit 1
		fi

		# Install bind-utils so the host command exists
		if ! command -v host > /dev/null 2>&1; then
			echo "Installing required packages to run installer"
			yum -y install bind-utils yum-plugin-versionlock >> "$setup_log" 2>&1
		fi


	elif [ -f /etc/os-release ]; then
		OS=ubuntu
		if grep -q "UBUNTU_CODENAME=bionic" /etc/os-release; then
			OSVER=bionic
		elif grep -q "UBUNTU_CODENAME=xenial" /etc/os-release; then
			OSVER=xenial
		else
			echo "We do not support your current version of Ubuntu."
			exit 1
		fi
		# Install network manager so we can do interface stuff
		if ! command -v nmcli > /dev/null 2>&1; then
			echo "Installing required packages to run installer"
			{
				apt-get install -y network-manager;
				systemctl enable NetworkManager;
				systemctl start NetworkManager;
			} >> "$setup_log" 2<&1
		fi

	else
		echo "We were unable to determine if you are using a supported OS."
		exit 1
	fi

	echo "Found OS: $OS $OSVER" >> "$setup_log" 2>&1

}

disable_onion_user() {
	# Disable the default account cause security.
	usermod -L onion

	# Remove the automated setup script from crontab, if it exists
	crontab -u onion -r
}

disable_misc_network_features() {
	filter_unused_nics
	if [ ${#filtered_nics[@]} -ne 0 ]; then
		for unused_nic in "${filtered_nics[@]}"; do
			if [ -n "$unused_nic" ]; then
				echo "Disabling unused NIC: $unused_nic" >> "$setup_log" 2>&1

				# Disable DHCPv4/v6 and autoconnect
				nmcli con mod "$unused_nic" \
					ipv4.method disabled \
					ipv6.method ignore \
					connection.autoconnect "no" >> "$setup_log" 2>&1

				# Flush any existing IPs
				ip addr flush "$unused_nic" >> "$setup_log" 2>&1
			fi
		done
	fi
	# Disable IPv6
	{ 
		echo "net.ipv6.conf.all.disable_ipv6 = 1"
		echo "net.ipv6.conf.default.disable_ipv6 = 1"
		echo "net.ipv6.conf.lo.disable_ipv6 = 1" 
	} >> /etc/sysctl.conf
}

docker_install() {

	if [ $OS = 'centos' ]; then
		{
			yum clean expire-cache;
			yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo;
			yum -y install docker-ce-19.03.11-3.el7 containerd.io-1.2.13-3.2.el7;
			yum versionlock docker-ce-19.03.11-3.el7;
			yum versionlock containerd.io-1.2.13-3.2.el7
		} >> "$setup_log" 2>&1
		
	else
		case "$install_type" in
			'MASTER' | 'EVAL')
				apt-get update >> "$setup_log" 2>&1
				;;
			*)
				{
					apt-key add "$temp_install_dir"/gpg/docker.pub;
					add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable";
					apt-get update;
				} >> "$setup_log" 2>&1
				;;
		esac 
		
		if [ $OSVER != "xenial" ]; then
			apt-get -y install docker-ce python3-docker >> "$setup_log" 2>&1
		else
			apt-get -y install docker-ce python-docker >> "$setup_log" 2>&1
		fi
	fi
	docker_registry
	{
		echo "Restarting Docker";
		systemctl restart docker;
		systemctl enable docker;
	} >> "$setup_log" 2>&1
}

docker_registry() {

	echo "Setting up Docker Registry" >> "$setup_log" 2>&1
	mkdir -p /etc/docker >> "$setup_log" 2>&1
	# Make the host use the master docker registry
	if [ -n "$TURBO" ]; then local proxy="$TURBO"; else local proxy="https://$MSRV"; fi
	printf '%s\n'\
		"{"\
		"  \"registry-mirrors\": [ \"$proxy:5000\" ]"\
		"}" > /etc/docker/daemon.json
	echo "Docker Registry Setup - Complete" >> "$setup_log" 2>&1

}

docker_seed_registry() {
	local VERSION="HH$SOVERSION"

	if ! [ -f /nsm/docker-registry/docker/registry.tar ]; then
		local TRUSTED_CONTAINERS=(\
			"so-nginx:$VERSION" \
			"so-filebeat:$VERSION" \
			"so-logstash:$VERSION" \
			"so-idstools:$VERSION" \
			"so-redis:$VERSION" \
			"so-steno:$VERSION" \
			"so-suricata:$VERSION" \
			"so-telegraf:$VERSION" \
			"so-zeek:$VERSION"
		)
		if [ "$install_type" != 'HELIXSENSOR' ]; then
			TRUSTED_CONTAINERS=("${TRUSTED_CONTAINERS[@]}" \
				"so-acng:$VERSION" \
				"so-thehive-cortex:$VERSION" \
				"so-curator:$VERSION" \
				"so-domainstats:$VERSION" \
				"so-elastalert:$VERSION" \
				"so-elasticsearch:$VERSION" \
				"so-fleet:$VERSION" \
				"so-fleet-launcher:$VERSION" \
				"so-freqserver:$VERSION" \
				"so-grafana:$VERSION" \
				"so-influxdb:$VERSION" \
				"so-kibana:$VERSION" \
				"so-mysql:$VERSION" \
				"so-navigator:$VERSION" \
				"so-playbook:$VERSION" \
				"so-soc:$VERSION" \
				"so-kratos:$VERSION" \
				"so-soctopus:$VERSION" \
				"so-steno:$VERSION" \
				"so-strelka-frontend:$VERSION" \
				"so-strelka-manager:$VERSION" \
				"so-strelka-backend:$VERSION" \
				"so-strelka-filestream:$VERSION" \
				"so-thehive:$VERSION" \
				"so-thehive-es:$VERSION" \
				"so-wazuh:$VERSION"
			)
		fi
		local percent=25
		for i in "${TRUSTED_CONTAINERS[@]}"; do
			if [ "$install_type" != 'HELIXSENSOR' ]; then ((percent=percent+1)); else ((percent=percent+6)); fi
			# Pull down the trusted docker image
			set_progress_str "$percent" "Downloading $i"
			{
				
				if ! docker pull --disable-content-trust=false docker.io/soshybridhunter/"$i"; then
					sleep 5
					docker pull --disable-content-trust=false docker.io/soshybridhunter/"$i"
				fi
				# Tag it with the new registry destination
				docker tag soshybridhunter/"$i" "$HOSTNAME":5000/soshybridhunter/"$i"
				docker push "$HOSTNAME":5000/soshybridhunter/"$i"
				#docker rmi soshybridhunter/"$i"
			} >> "$setup_log" 2>&1
		done
	else
		tar xvf /nsm/docker-registry/docker/registry.tar -C /nsm/docker-registry/docker >> "$setup_log" 2>&1
		rm /nsm/docker-registry/docker/registry.tar >> "$setup_log" 2>&1
	fi

}

fireeye_pillar() {

	local fireeye_pillar_path=$local_salt_dir/pillar/fireeye
	mkdir -p "$fireeye_pillar_path"

	printf '%s\n'\
		"fireeye:"\
		"  helix:"\
		"    api_key: $HELIXAPIKEY" 
		"" > "$fireeye_pillar_path"/init.sls

}

# Generate Firewall Templates
firewall_generate_templates() {

	local firewall_pillar_path=$local_salt_dir/pillar/firewall
	mkdir -p "$firewall_pillar_path"

	for i in analyst beats_endpoint forward_nodes masterfw minions osquery_endpoint search_nodes wazuh_endpoint
	do
	  printf '%s\n'\
	  "$i:"\
	  "  - 127.0.0.1"\
	  "" > "$firewall_pillar_path"/$i.sls
	  echo "Added $i Template"
	done
}

fleet_pillar() {

	local pillar_file="$temp_install_dir"/pillar/minions/"$MINION_ID".sls

	# Create the fleet pillar
	printf '%s\n'\
		"fleet:"\
		"  mainip: $MAINIP"\
		"  master: $MSRV"\
		"" > "$pillar_file"
}

generate_passwords(){
  # Generate Random Passwords for Things
  MYSQLPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1)
  PLAYBOOKPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1)
  FLEETPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
  FLEETJWT=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
  HIVEKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
  CORTEXKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
  CORTEXORGUSERKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
  SENSORONIKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
  KRATOSKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom  | fold -w 20 | head -n 1)
}

get_redirect() {
	whiptail_set_redirect_info
	whiptail_set_redirect
	if [ "$REDIRECTINFO" = "OTHER" ]; then
		whiptail_set_redirect_host
	fi
}

got_root() {
	# Make sure you are root
	uid="$(id -u)"
	if [ "$uid" -ne 0 ]; then
		echo "This script must be run using sudo!"
		exit 1
	fi
}

get_minion_type() {
	local minion_type
	case "$install_type" in
		'EVAL' | 'MASTERSEARCH' | 'MASTER' | 'SENSOR' | 'HEAVYNODE' | 'FLEET' | 'STANDALONE')
			minion_type=$(echo "$install_type" | tr '[:upper:]' '[:lower:]')
			;;
		'HELIXSENSOR')
			minion_type='helix'
			;;
		*'NODE')
			minion_type='node'
			;;
	esac
	echo "$minion_type"
}

install_cleanup() {
	echo "Installer removing the following files:"
	ls -lR "$temp_install_dir"

	# Clean up after ourselves
	rm -rf "$temp_install_dir"

}

master_pillar() {

	local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls

	# Create the master pillar
	printf '%s\n'\
		"master:"\
		"  mainip: $MAINIP"\
		"  mainint: $MNIC"\
		"  esheap: $ES_HEAP_SIZE"\
		"  esclustername: {{ grains.host }}"\
		"  freq: 0"\
		"  domainstats: 0" >> "$pillar_file"

	if [ "$install_type" = 'EVAL' ] || [ "$install_type" = 'HELIXSENSOR' ] || [ "$install_type" = 'MASTERSEARCH' ] || [ "$install_type" = 'STANDALONE' ]; then
		printf '%s\n'\
			"  ls_pipeline_batch_size: 125"\
			"  ls_input_threads: 1"\
			"  ls_batch_count: 125"\
			"  mtu: $MTU" >> "$pillar_file"
	fi

	case $REDIRECTINFO in
		'IP')
			REDIRECTIT="$MAINIP"
			;;
		'HOSTNAME')
			REDIRECTIT=$HOSTNAME
			;;
		*)
			REDIRECTIT="$REDIRECTHOST"
			;;
	esac

	printf '%s\n'\
		"  lsheap: $LS_HEAP_SIZE"\
		"  lsaccessip: 127.0.0.1"\
		"  elastalert: 1"\
		"  ls_pipeline_workers: $num_cpu_cores"\
		"  nids_rules: $RULESETUP"\
		"  oinkcode: $OINKCODE"\
		"  es_port: $node_es_port"\
		"  log_size_limit: $log_size_limit"\
		"  cur_close_days: $CURCLOSEDAYS"\
		"  grafana: $GRAFANA"\
		"  osquery: $OSQUERY"\
		"  thehive: $THEHIVE"\
		"  playbook: $PLAYBOOK"\
		"  navigator: $NAVIGATOR"\
		"  url_base: $REDIRECTIT"\
		""\
		"kratos:" >> "$pillar_file"

	printf '%s\n'\
		"  kratoskey: $KRATOSKEY"\
		"" >> "$pillar_file"

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$pillar_file" >> "$setup_log" 2>&1
  }

master_static() {
	local static_pillar="$local_salt_dir/pillar/static.sls"

	# Create a static file for global values
	printf '%s\n'\
		"static:"\
		"  soversion: HH$SOVERSION"\
		"  hnmaster: $HNMASTER"\
		"  ntpserver: $NTPSERVER"\
		"  proxy: $PROXY"\
		"  broversion: $BROVERSION"\
		"  ids: $NIDS"\
		"  masterip: $MAINIP"\
		"  hiveuser: hiveadmin"\
		"  hivepassword: hivechangeme"\
		"  hivekey: $HIVEKEY"\
		"  cortexuser: cortexadmin"\
		"  cortexpassword: cortexchangeme"\
		"  cortexkey: $CORTEXKEY"\
		"  cortexorgname: SecurityOnion"\
		"  cortexorguser: soadmin"\
		"  cortexorguserkey: $CORTEXORGUSERKEY"\
		"  fleet_master: False"\
		"  fleet_node: False"\
		"  fleet_packages-timestamp: N/A"\
		"  fleet_packages-version: 1"\
		"  fleet_hostname: N/A"\
		"  fleet_ip: N/A"\
		"  sensoronikey: $SENSORONIKEY"\
		"  strelka: $STRELKA"\
        "  wazuh: $WAZUH"\
		"  masterupdate: $MASTERUPDATES"\
		"elastic:"\
		"  features: False" > "$static_pillar"

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$static_pillar" >> "$setup_log" 2>&1
}

minio_generate_keys() {

	local charSet="[:graph:]"

	ACCESS_KEY=$(tr -cd "$charSet" < /dev/urandom | tr -d \' | tr -d \" | head -c 20)
	ACCESS_SECRET=$(tr -cd "$charSet" < /dev/urandom | tr -d \' | tr -d \" | head -c 40)

}

network_setup() {
	{
		echo "Finishing up network setup";

		echo "... Verifying all network devices are managed by Network Manager";
		check_network_manager_conf;

		echo "... Disabling unused NICs";
		disable_misc_network_features;

		echo "... Setting ONBOOT for management interface";
		if ! netplan > /dev/null 2>&1; then
			nmcli con mod "$MNIC" connection.autoconnect "yes";
		fi

        echo "... Copying 99-so-checksum-offload-disable";
        cp ./install_scripts/99-so-checksum-offload-disable /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable ;

		echo "... Modifying 99-so-checksum-offload-disable";
		sed -i "s/\$MNIC/${MNIC}/g" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable;
	} >> "$setup_log" 2>&1
}

node_pillar() {

	local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls

	# Create the node pillar
	printf '%s\n'\
		"node:"\
		"  mainip: $MAINIP"\
		"  mainint: $MNIC"\
		"  esheap: $NODE_ES_HEAP_SIZE"\
		"  esclustername: {{ grains.host }}"\
		"  lsheap: $NODE_LS_HEAP_SIZE"\
		"  ls_pipeline_workers: $LSPIPELINEWORKERS"\
		"  ls_pipeline_batch_size: $LSPIPELINEBATCH"\
		"  ls_input_threads: $LSINPUTTHREADS"\
		"  ls_batch_count: $LSINPUTBATCHCOUNT"\
		"  es_shard_count: $SHARDCOUNT"\
		"  node_type: $NODETYPE"\
		"  es_port: $node_es_port"\
		"  log_size_limit: $log_size_limit"\
		"  cur_close_days: $CURCLOSEDAYS"\
		"" >> "$pillar_file"

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$pillar_file" >> "$setup_log" 2>&1
}

patch_pillar() {

	local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls

	printf '%s\n'\
		"patch:"\
		"  os:"\
		"    schedule_name: $PATCHSCHEDULENAME"\
		"    enabled: True"\
		"    splay: 300"\
		"" >> "$pillar_file"

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$pillar_file" >> "$setup_log" 2>&1

}

patch_schedule_os_new() {
	local OSPATCHSCHEDULEDIR="$temp_install_dir/salt/patch/os/schedules"
	local OSPATCHSCHEDULE="$OSPATCHSCHEDULEDIR/$PATCHSCHEDULENAME.yml"

	mkdir -p $OSPATCHSCHEDULEDIR

	printf '%s\n'\
		"patch:"\
		"  os:"\
		"    schedule:"> "$OSPATCHSCHEDULE"
	for psd in "${PATCHSCHEDULEDAYS[@]}";do
		psd="${psd//\"/}"
		echo "      - $psd:" >> "$OSPATCHSCHEDULE"
		for psh in "${PATCHSCHEDULEHOURS[@]}"
		do
			psh="${psh//\"/}"
			echo "        - '$psh'" >> "$OSPATCHSCHEDULE"
		done
	done

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$OSPATCHSCHEDULE" >> "$setup_log" 2>&1
}

print_salt_state_apply() {
	local state=$1

	echo "Applying $state Salt state"
}

reserve_group_ids() {
	# This is a hack to fix CentOS from taking group IDs that we need
	groupadd -g 928 kratos
	groupadd -g 930 elasticsearch
	groupadd -g 931 logstash
	groupadd -g 932 kibana
	groupadd -g 933 elastalert
	groupadd -g 934 curator
	groupadd -g 937 zeek
	groupadd -g 940 suricata
	groupadd -g 941 stenographer
	groupadd -g 945 ossec
	groupadd -g 946 cyberchef
}

saltify() {

	# Install updates and Salt
	if [ $OS = 'centos' ]; then
		set_progress_str 5 'Installing Salt repo'
		{
			sudo rpm --import https://repo.saltstack.com/py3/redhat/7/x86_64/archive/2019.2.5/SALTSTACK-GPG-KEY.pub;
			cp ./yum_repos/salt-2019-2-5.repo /etc/yum.repos.d/salt-2019-2-5.repo;
		} >> "$setup_log" 2>&1
		set_progress_str 6 'Installing various dependencies'
		yum -y install wget nmap-ncat >> "$setup_log" 2>&1
		case "$install_type" in
			'MASTER' | 'EVAL' | 'MASTERSEARCH' | 'FLEET' | 'HELIXSENSOR' | 'STANDALONE')
				reserve_group_ids >> "$setup_log" 2>&1
				yum -y install epel-release >> "$setup_log" 2>&1
				yum -y install sqlite argon2 curl mariadb-devel >> "$setup_log" 2>&1
				# Download Ubuntu Keys in case master updates = 1
				mkdir -p /opt/so/gpg >> "$setup_log" 2>&1
				wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/apt/ubuntu/16.04/amd64/latest/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
				wget -q --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg >> "$setup_log" 2>&1
				wget -q --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH >> "$setup_log" 2>&1
				cp ./yum_repos/wazuh.repo /etc/yum.repos.d/wazuh.repo >> "$setup_log" 2>&1
				set_progress_str 7 'Installing salt-master'
				yum -y install salt-master-2019.2.5 >> "$setup_log" 2>&1
				systemctl enable salt-master >> "$setup_log" 2>&1
				;;
			*)
				if [ "$MASTERUPDATES" = '1' ]; then
					{
						# Create the GPG Public Key for the Salt Repo
						cp ./public_keys/salt.pem /etc/pki/rpm-gpg/saltstack-signing-key;

						# Copy repo files over
						cp ./yum_repos/salt-latest.repo /etc/yum.repos.d/salt-latest.repo;
						cp ./yum_repos/salt-2019-2-5.repo /etc/yum.repos.d/salt-2019-2-5.repo;
					} >> "$setup_log" 2>&1
				fi
				;;
		esac
		cp ./yum_repos/wazuh.repo /etc/yum.repos.d/wazuh.repo >> "$setup_log" 2>&1
		yum clean expire-cache >> "$setup_log" 2>&1
		set_progress_str 8 'Installing salt-minion & python modules'
		{
			yum -y install epel-release
			yum -y install salt-minion-2019.2.5\
				python3\
				python36-docker\
				python36-dateutil\
				python36-m2crypto\
				python36-mysql\
				yum-utils\
				device-mapper-persistent-data\
				lvm2\
				openssl\
				jq;
			yum -y update exclude=salt*;
			systemctl enable salt-minion;
		} >> "$setup_log" 2>&1
		yum versionlock salt*
	else
		DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade >> "$setup_log" 2>&1

		if [ $OSVER != "xenial" ]; then
			# Switch to Python 3 as default if this is not xenial
			update-alternatives --install /usr/bin/python python /usr/bin/python3.6 10 >> "$setup_log" 2>&1
		fi
		# Add the pre-requisites for installing docker-ce
		apt-get -y install ca-certificates\
			curl\
			software-properties-common\
			apt-transport-https\
			openssl\
			netcat\
			jq >> "$setup_log" 2>&1

		# Grab the version from the os-release file
		local ubuntu_version
		ubuntu_version=$(grep VERSION_ID /etc/os-release | awk -F '[ "]' '{print $2}')

		case "$install_type" in
			'FLEET')
				if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-mysqldb >> "$setup_log" 2>&1; else apt-get -y install python-mysqldb >> "$setup_log" 2>&1; fi
				;;
			'MASTER' | 'EVAL' | 'MASTERSEARCH' | 'STANDALONE') # TODO: should this also be HELIXSENSOR?
				if [ "$OSVER" != "xenial" ]; then local py_ver_url_path="/py3"; else local py_ver_url_path="/apt"; fi

				# Add saltstack repo(s)
				wget -q --inet4-only -O - https://repo.saltstack.com"$py_ver_url_path"/ubuntu/"$ubuntu_version"/amd64/archive/2019.2.5/SALTSTACK-GPG-KEY.pub | apt-key add - >> "$setup_log" 2>&1
				echo "deb http://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/2019.2.5 $OSVER main" > /etc/apt/sources.list.d/saltstack2019.list

				# Add Docker repo
				curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - >> "$setup_log" 2>&1
				add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" >> "$setup_log" 2>&1

				# Get gpg keys
				mkdir -p /opt/so/gpg >> "$setup_log" 2>&1
				wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/apt/ubuntu/"$ubuntu_version"/amd64/latest/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
				wget -q --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg >> "$setup_log" 2>&1
				wget -q --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH >> "$setup_log" 2>&1

				# Get key and install wazuh
				curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add - >> "$setup_log" 2>&1
				# Add repo
				echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list >> "$setup_log" 2>&1
				# Initialize the new repos
				apt-get update >> "$setup_log" 2>&1
				set_progress_str 6 'Installing various dependencies'
				apt-get -y install sqlite3 argon2 libssl-dev >> "$setup_log" 2>&1
				set_progress_str 7 'Installing salt-master'
				apt-get -y install salt-master=2019.2.5+ds-1 >> "$setup_log" 2>&1
				apt-mark hold salt-master >> "$setup_log" 2>&1
				;;
			*)
				# Copy down the gpg keys and install them from the master
				mkdir "$temp_install_dir"/gpg >> "$setup_log" 2>&1
				echo "scp the gpg keys and install them from the master" >> "$setup_log" 2>&1
				scp -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$temp_install_dir"/gpg >> "$setup_log" 2>&1
				echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH" >> "$setup_log" 2>&1
				apt-key add "$temp_install_dir"/gpg/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
				apt-key add "$temp_install_dir"/gpg/GPG-KEY-WAZUH >> "$setup_log" 2>&1
				echo "deb http://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/2019.2.5/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list >> "$setup_log" 2>&1
				echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list >> "$setup_log" 2>&1
                ;;
		esac
		apt-get update >> "$setup_log" 2>&1
		set_progress_str 8 'Installing salt-minion & python modules'
		apt-get -y install salt-minion=2019.2.5+ds-1\
					salt-common=2019.2.5+ds-1 >> "$setup_log" 2>&1
		apt-mark hold salt-minion salt-common >> "$setup_log" 2>&1
		if [ "$OSVER" != 'xenial' ]; then 
			apt-get -y install python3-dateutil python3-m2crypto python3-mysqldb >> "$setup_log" 2>&1
		else 
			apt-get -y install python-dateutil python-m2crypto python-mysqldb  >> "$setup_log" 2>&1
		fi
	fi

}

salt_checkin() {

	case "$install_type" in
		'MASTER' | 'EVAL' | 'HELIXSENSOR' | 'MASTERSEARCH' | 'STANDALONE') # Fix Mine usage
			{
				echo "Building Certificate Authority";
				salt-call state.apply ca;
				echo " *** Restarting Salt to fix any SSL errors. ***";
				systemctl restart salt-master;
				sleep 5;
				systemctl restart salt-minion;
				sleep 15;
				echo " Applyng a mine hack";
				salt '*' mine.send x509.get_pem_entries glob_path=/etc/pki/ca.crt;
				echo " Applying SSL state";
				salt-call state.apply ssl;
			} >> "$setup_log" 2>&1
			;;
		*)
			{
				salt-call state.apply ca;
				salt-call state.apply ssl;
			} >> "$setup_log" 2>&1
			;;
	esac
	{
		salt-call state.apply ca;
		salt-call state.apply ssl;
	} >> "$setup_log" 2>&1
}

# Run a salt command to generate the minion key
salt_firstcheckin() {
	salt-call state.show_top >> /dev/null # send output to /dev/null because we don't actually care about the ouput
}

set_base_heapsizes() {
	es_heapsize
	ls_heapsize
}

set_main_ip() {
	MAINIP=$(ip route get 1 | awk '{print $7;exit}')
}

setup_salt_master_dirs() {
	# Create salt paster directories
	mkdir -p $default_salt_dir/pillar
	mkdir -p $default_salt_dir/salt
	mkdir -p $local_salt_dir/pillar
	mkdir -p $local_salt_dir/salt

	# Copy over the salt code and templates
	if [ "$setup_type" = 'iso' ]; then
		rsync -avh --exclude 'TRANS.TBL' /home/onion/SecurityOnion/pillar/* $default_salt_dir/pillar/ >> "$setup_log" 2>&1
		rsync -avh --exclude 'TRANS.TBL' /home/onion/SecurityOnion/salt/* $default_salt_dir/salt/ >> "$setup_log" 2>&1
	else
		cp -R ../pillar/* $default_salt_dir/pillar/ >> "$setup_log" 2>&1
		cp -R ../salt/* $default_salt_dir/salt/ >> "$setup_log" 2>&1
	fi

	echo "Chown the salt dirs on the master for socore" >> "$setup_log" 2>&1
	chown -R socore:socore /opt/so
}

set_progress_str() {
	local percentage_input=$1
	local progress_bar_text=$2

	if (( "$percentage_input" >= "$percentage" )); then
		percentage="$percentage_input"
	fi

	percentage_str="XXX\n${percentage}\n${progress_bar_text}\nXXX"

	echo -e "$percentage_str"

	printf '%s\n' \
	'----'\
	"$percentage% - ${progress_bar_text^^}"\
	"----" >> "$setup_log" 2>&1
}

sensor_pillar() {

	local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls

	# Create the sensor pillar
	printf '%s\n'\
		"sensor:"\
		"  interface: bond0"\
		"  mainip: $MAINIP"\
		"  mainint: $MNIC" >> "$pillar_file"
	
	if [ "$NSMSETUP" = 'ADVANCED' ]; then
		echo "  bro_pins:" >> "$pillar_file"
		for PIN in "${BROPINS[@]}"; do
			PIN=$(echo "$PIN" |  cut -d\" -f2)
		echo "    - $PIN" >> "$pillar_file"
		done
		echo "  suripins:" >> "$pillar_file"
		for SPIN in "${SURIPINS[@]}"; do
			SPIN=$(echo "$SPIN" |  cut -d\" -f2)
		echo "    - $SPIN" >> "$pillar_file"
		done
	elif [ "$install_type" = 'HELIXSENSOR' ]; then
		echo "  bro_lbprocs: $lb_procs" >> "$pillar_file"
		echo "  suriprocs: $lb_procs" >> "$pillar_file"
	else
		echo "  bro_lbprocs: $BASICBRO" >> "$pillar_file"
		echo "  suriprocs: $BASICSURI" >> "$pillar_file"
	fi
	printf '%s\n'\
		"  brobpf:"\
		"  pcapbpf:"\
		"  nidsbpf:"\
		"  master: $MSRV"\
		"  mtu: $MTU"\
		"  uniqueid: $(date '+%s')" >> "$pillar_file"
	if [ "$HNSENSOR" != 'inherit' ]; then
		echo "  hnsensor: $HNSENSOR" >> "$pillar_file"
	fi
	printf '%s\n'\
		"  access_key: $ACCESS_KEY"\
		"  access_secret: $ACCESS_SECRET"\
		"" >> "$pillar_file"

	printf '%s\n'  '----' >> "$setup_log" 2>&1
	cat "$pillar_file" >> "$setup_log" 2>&1
}

set_default_log_size() {
    local percentage

	case $INSTALLTYPE in
		EVAL | HEAVYNODE)
			percentage=50
			;;
		*)
            percentage=80
			;;
		esac

	local disk_dir="/"
	if [ -d /nsm ]; then
		disk_dir="/nsm"
	fi
	local disk_size_1k
	disk_size_1k=$(df $disk_dir | grep -v "^Filesystem" | awk '{print $2}')

    local ratio="1048576"

    local disk_size_gb
    disk_size_gb=$( echo "$disk_size_1k" "$ratio" | awk '{print($1/$2)}' )

	log_size_limit=$( echo "$disk_size_gb" "$percentage" | awk '{printf("%.0f", $1 * ($2/100))}')
}

set_hostname() {

	set_hostname_iso

	if [[ ! $install_type =~ ^(MASTER|EVAL|HELIXSENSOR|MASTERSEARCH|STANDALONE)$ ]]; then
		if ! getent hosts "$MSRV"; then
			echo "$MSRVIP   $MSRV" >> /etc/hosts
		fi
	fi

}

set_hostname_iso() {

	hostnamectl set-hostname --static "$HOSTNAME"
	echo "127.0.0.1   $HOSTNAME $HOSTNAME.localdomain localhost localhost.localdomain localhost4 localhost4.localdomain" > /etc/hosts
	echo "::1   $HOSTNAME $HOSTNAME.localdomain localhost localhost.localdomain localhost6 localhost6.localdomain6" >> /etc/hosts
	echo "$HOSTNAME" > /etc/hostname

	hostname -F /etc/hostname

}

set_initial_firewall_policy() {

  set_main_ip

  if [ -f $default_salt_dir/pillar/data/addtotab.sh ]; then chmod +x $default_salt_dir/pillar/data/addtotab.sh; fi
  if [ -f $default_salt_dir/pillar/firewall/addfirewall.sh ]; then chmod +x $default_salt_dir/pillar/firewall/addfirewall.sh; fi

	case "$install_type" in
		'MASTER')
			printf "  - %s\n" "$MAINIP" | tee -a $local_salt_dir/pillar/firewall/minions.sls $local_salt_dir/pillar/firewall/masterfw.sls
			$default_salt_dir/pillar/data/addtotab.sh mastertab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm"
			;;
		'EVAL' | 'MASTERSEARCH')
			printf "  - %s\n" "$MAINIP" | tee -a $local_salt_dir/pillar/firewall/minions.sls\
				$local_salt_dir/pillar/firewall/masterfw.sls\
				$local_salt_dir/pillar/firewall/forward_nodes.sls\
				$local_salt_dir/pillar/firewall/search_nodes.sls
			case "$install_type" in 
				'EVAL')
					$default_salt_dir/pillar/data/addtotab.sh evaltab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" bond0 True
					;;
				'MASTERSEARCH')
					$default_salt_dir/pillar/data/addtotab.sh mastersearchtab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm"
					;;
			esac
			;;
		'HELIXSENSOR')
			printf "  - %s\n" "$MAINIP" | tee -a $local_salt_dir/pillar/firewall/minions.sls\
				$local_salt_dir/pillar/firewall/masterfw.sls\
				$local_salt_dir/pillar/firewall/forward_nodes.sls
			;;
		'SENSOR' | 'SEARCHNODE' | 'HEAVYNODE' | 'FLEET')
			ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/firewall/addfirewall.sh minions "$MAINIP"
			case "$install_type" in
				'SENSOR')
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/firewall/addfirewall.sh forward_nodes "$MAINIP"
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" bond0
					;;
				'SEARCHNODE')
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/firewall/addfirewall.sh search_nodes "$MAINIP"
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm"
					;;
				'HEAVYNODE')
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/firewall/addfirewall.sh forward_nodes "$MAINIP"
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/firewall/addfirewall.sh search_nodes "$MAINIP"
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" bond0
					ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm"
					;;
			esac
			;;
		'PARSINGNODE')
			# TODO: implement
			;;
		'HOTNODE')
			# TODO: implement
			;;
		'WARMNODE')
			# TODO: implement
			;;
	esac
}

# Set up the management interface on the ISO
set_management_interface() {

	if [ "$address_type" = 'DHCP' ]; then
		nmcli con mod "$MNIC" connection.autoconnect yes
		nmcli con up "$MNIC"
	else
		# Set Static IP
		nmcli con mod "$MNIC" ipv4.addresses "$MIP"/"$MMASK"\
			ipv4.gateway "$MGATEWAY" \
			ipv4.dns "$MDNS"\
			ipv4.dns-search "$MSEARCH"\
			connection.autoconnect yes\
			ipv4.method manual
		nmcli con up "$MNIC"
	fi
}

set_node_type() {

	case "$install_type" in
		'SEARCHNODE' | 'EVAL' | 'MASTERSEARCH' | 'HEAVYNODE' | 'STANDALONE')
			NODETYPE='search'
			;;
		'PARSINGNODE')
			NODETYPE='parser'
			;;
		'HOTNODE')
			NODETYPE='hot'
			;;
		'WARMNODE')
			NODETYPE='warm'
			;;
	esac
}

set_updates() {
	if [ "$MASTERUPDATES" = '1' ]; then
		if [ "$OS" = 'centos' ]; then
			if ! grep -q "$MSRV" /etc/yum.conf; then
				echo "proxy=http://$MSRV:3142" >> /etc/yum.conf
			fi
		else
			# Set it up so the updates roll through the master
			printf '%s\n'\
				"Acquire::http::Proxy \"http://$MSRV:3142\";"\
				"Acquire::https::Proxy \"http://$MSRV:3142\";" > /etc/apt/apt.conf.d/00Proxy
		fi
	fi
}

# FIXME: should this be a function?
set_version() {
	# Drop a file with the current version
	echo "$SOVERSION" > /etc/soversion
}

update_sudoers() {

	if ! grep -qE '^soremote\ ALL=\(ALL\)\ NOPASSWD:(\/usr\/bin\/salt\-key|\/opt\/so\/saltstack)' /etc/sudoers; then
		# Update Sudoers so that soremote can accept keys without a password
		echo "soremote ALL=(ALL) NOPASSWD:/usr/bin/salt-key" | tee -a /etc/sudoers
		echo "soremote ALL=(ALL) NOPASSWD:$default_salt_dir/pillar/firewall/addfirewall.sh" | tee -a /etc/sudoers
		echo "soremote ALL=(ALL) NOPASSWD:$default_salt_dir/pillar/data/addtotab.sh" | tee -a /etc/sudoers
		echo "soremote ALL=(ALL) NOPASSWD:$default_salt_dir/salt/master/files/add_minion.sh" | tee -a /etc/sudoers
	else
		echo "User soremote already granted sudo privileges" >> "$setup_log" 2>&1
	fi
}

update_packages() {
	if [ "$OS" = 'centos' ]; then
		yum -y update >> "$setup_log"
	else
		apt-get -y update >> "$setup_log"
		apt-get -y upgrade >> "$setup_log"
	fi
}

use_turbo_proxy() {
	if [[ ! $install_type =~ ^(MASTER|EVAL|HELIXSENSOR|MASTERSEARCH|STANDALONE)$ ]]; then
		echo "turbo is not supported on this install type" >> $setup_log 2>&1
		return
	fi

	if [[ $OS == 'centos' ]]; then
		printf '%s\n' "proxy=${TURBO}:3142" >> /etc/yum.conf
	else
		printf '%s\n'\
			"Acquire {"\
			"  HTTP::proxy \"${TURBO}:3142\";"\
			"  HTTPS::proxy \"${TURBO}:3142\";"\
			"}" > /etc/apt/apt.conf.d/proxy.conf
	fi
}

ls_heapsize() {

	if [ "$total_mem" -ge 32000 ]; then
		LS_HEAP_SIZE='1000m'
		return
	fi

	case "$install_type" in
		'MASTERSEARCH' | 'HEAVYNODE' | 'HELIXSENSOR' | 'STANDALONE')
			LS_HEAP_SIZE='1000m'
			;;
		'EVAL')
			LS_HEAP_SIZE='700m'
			;;
		*)
			LS_HEAP_SIZE='500m'
			;;
	esac
	export LS_HEAP_SIZE

	if [[ "$install_type" =~ ^(EVAL|MASTERSEARCH|STANDALONE)$ ]]; then
		NODE_LS_HEAP_SIZE=LS_HEAP_SIZE
		export NODE_LS_HEAP_SIZE
	fi
}


es_heapsize() {

	# Determine ES Heap Size
	if [ "$total_mem" -lt 8000 ] ; then
		ES_HEAP_SIZE="600m"
	elif [ "$total_mem" -ge 100000 ]; then
		# Set a max of 25GB for heap size
		# https://www.elastic.co/guide/en/elasticsearch/guide/current/heap-sizing.html
		ES_HEAP_SIZE="25000m"
	else
		# Set heap size to 25% of available memory
		ES_HEAP_SIZE=$(( total_mem / 4 ))"m"
	fi
	export ES_HEAP_SIZE

	if [[ "$install_type" =~ ^(EVAL|MASTERSEARCH|STANDALONE)$ ]]; then
		NODE_ES_HEAP_SIZE=ES_HEAP_SIZE
		export NODE_ES_HEAP_SIZE
	fi
}
