Automated Install Script: Elastic Agent - Endpoint Security on MacOS

README.md

Elastic Agent Management Script

This script provides a convenient way to install or uninstall Elastic Agent on macOS systems. It automates the process of downloading, extracting, and setting up the Elastic Agent, as well as cleanly removing it when no longer needed.

Version

2.0.0

Author

Austin Songer

Features

• Automated Installation: Downloads and installs Elastic Agent version 8.9.2.
• Easy Uninstallation: Removes Elastic Agent and associated files.
• Error Handling: Includes basic error handling for a smoother user experience.
• User Choice: Allows the user to choose between installation and uninstallation.

Prerequisites

• macOS system
• Bash shell
• Internet connection for downloading the Elastic Agent
• Sufficient permissions to execute sudo commands

Usage

1. Download the Script: Clone or download the script to your local system.
2. Make the Script Executable: Run chmod +x elastic-install.sh to make the script executable.
3. Run the Script: Execute the script using ./elastic-install.sh.
4. Choose an Option:
   • Enter 1 to install the Elastic Agent.
   • Enter 2 to uninstall the Elastic Agent.
5. Follow the On-Screen Instructions: The script will guide you through the rest of the process.

Installation Details

The installation process involves the following steps:

• Downloading the Elastic Agent tarball from the specified URL.
• Extracting the downloaded tarball.
• Installing the Elastic Agent using the provided URL and enrollment token.

Uninstallation Details

The uninstallation process involves:

• Stopping the Elastic Agent service using launchctl.
• Removing the Elastic Agent's launch daemon file.
• Deleting the Elastic Agent installation directory.

Notes

• Ensure that you have the necessary permissions to run the script and perform installation or uninstallation tasks.
• Always verify the current Elastic Agent version and update the script if necessary.
• It is advisable to backup important data before running the uninstallation process.

Disclaimer

This script is provided as-is with no warranties. Users should use it at their own risk. Always test scripts in a controlled environment before deploying them in a production setting.

install-uninstall-elastic-agent.sh

#!/bin/bash
set -euo pipefail
# Script to Install/Uninstall Elastic Agent
# Author: Austin Songer
# Version: 2.0.0

# Constants
AGENT_VERSION="8.9.2"
FILE_TO_DOWNLOAD="https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-${AGENT_VERSION}-darwin-x86_64.tar.gz"
DOWNLOAD_LOCAL_PATH="/Users/$USER/Downloads/elastic-agent-${AGENT_VERSION}-darwin-x86_64.tar.gz"
FILE="elastic-agent-${AGENT_VERSION}-darwin-x86_64.tar.gz"
URL=""
ET=""


# Constants for Uninstallation
INSTALL_DIRECTORY="/usr/share/elastic-agent"


# Function to handle errors
error_exit() {
    echo "Error: $1" >&2
    exit 1
}

# Function to install Elastic Agent
install_agent() {
    echo "Downloading Elastic Agent version ${AGENT_VERSION}..."
    curl -L ${FILE_TO_DOWNLOAD} --output ${DOWNLOAD_LOCAL_PATH} || error_exit "Failed to download file"

    # Verify if the file exists and is not empty
    if [ ! -s "${DOWNLOAD_LOCAL_PATH}" ]; then
        error_exit "Downloaded file not found or empty at ${DOWNLOAD_LOCAL_PATH}"
    fi

    # Changing to the download directory
    cd "$(dirname "${DOWNLOAD_LOCAL_PATH}")" || error_exit "Failed to change to download directory"

    # Checking if the tar file exists and is readable
    if [ ! -r "${FILE}" ]; then
        error_exit "Tar file not found or not readable at ${DOWNLOAD_LOCAL_PATH}"
    fi

    # Extracting file
    echo "Extracting Elastic Agent..."
    tar xzvf "${FILE}" || error_exit "Failed to extract file"

    echo "Contents of the current directory:"
    ls -l

    EXTRACTED_DIR=$(find . -maxdepth 1 -type d -name 'elastic-agent*' -print -quit)
    [ -n "${EXTRACTED_DIR}" ] || error_exit "Failed to find the extracted directory."

    cd "${EXTRACTED_DIR}" || error_exit "Failed to change to extracted directory"

    echo "Installing Elastic Agent..."
    sudo ./elastic-agent install --url=${URL} --enrollment-token=${ET} --force || error_exit "Installation failed"
    echo "Elastic Agent version ${AGENT_VERSION} installation completed successfully."
}

# Function to uninstall Elastic Agent
uninstall_agent() {
    echo "Stopping Elastic Agent service..."
    sudo launchctl bootout system /Library/LaunchDaemons/co.elastic.elastic-agent.plist || error_exit "Failed to stop Elastic Agent service"
    sudo rm /Library/LaunchDaemons/co.elastic.elastic-agent.plist || error_exit "Failed to remove Elastic Agent service file"

    echo "Uninstalling Elastic Agent..."
    sudo rm -rf ${INSTALL_DIRECTORY} || error_exit "Failed to remove Elastic Agent files"

    echo "Elastic Agent uninstalled successfully."
}

# Main script execution
echo "Elastic Agent Management Script"
echo "1. Install"
echo "2. Uninstall"
read -p "Enter your choice (1 or 2): " choice

case $choice in
    1) install_agent ;;
    2) uninstall_agent ;;
    *) echo "Invalid choice. Exiting." ; exit 1 ;;
esac