2021-09-27 13:54:33 +02:00
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
|
|
|
<title>
|
|
|
|
|
File: README
|
|
|
|
|
|
2021-12-29 15:27:15 +01:00
|
|
|
— Documentation by YARD 0.9.26
|
2021-09-27 13:54:33 +02:00
|
|
|
|
|
|
|
|
</title>
|
|
|
|
|
|
2021-12-29 15:27:15 +01:00
|
|
|
<link rel="stylesheet" href="css/style.css" type="text/css" />
|
2021-09-27 13:54:33 +02:00
|
|
|
|
2021-12-29 15:27:15 +01:00
|
|
|
<link rel="stylesheet" href="css/common.css" type="text/css" />
|
2021-09-27 13:54:33 +02:00
|
|
|
|
2021-12-29 15:27:15 +01:00
|
|
|
<script type="text/javascript">
|
2021-09-27 13:54:33 +02:00
|
|
|
pathId = "";
|
|
|
|
|
relpath = '';
|
|
|
|
|
</script>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="js/jquery.js"></script>
|
|
|
|
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="js/app.js"></script>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
<div class="nav_wrap">
|
|
|
|
|
<iframe id="nav" src="file_list.html?1"></iframe>
|
|
|
|
|
<div id="resizer"></div>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div id="main" tabindex="-1">
|
|
|
|
|
<div id="header">
|
|
|
|
|
<div id="menu">
|
|
|
|
|
|
|
|
|
|
<a href="_index.html">Index</a> »
|
|
|
|
|
<span class="title">File: README</span>
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div id="search">
|
|
|
|
|
|
|
|
|
|
<a class="full_list_link" id="puppet_class_list_link"
|
|
|
|
|
href="puppet_class_list.html">
|
|
|
|
|
|
|
|
|
|
<svg width="24" height="24">
|
|
|
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
|
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
|
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
|
|
|
</svg>
|
|
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
<div class="clear"></div>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div id="content"><div id='filecontents'>
|
|
|
|
|
<h1 id="label-Readme">Readme</h1>
|
|
|
|
|
|
|
|
|
|
<p><a href="https://pipelines.confdroid.com/job/cd_nrpe/"><img
|
|
|
|
|
src="https://pipelines.confdroid.com/buildStatus/icon?job=cd_nrpe"></a></p>
|
|
|
|
|
|
|
|
|
|
<p>[[<em>TOC</em>]]</p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Synopsis">Synopsis</h2>
|
|
|
|
|
|
|
|
|
|
<p>NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients
|
|
|
|
|
for monitoring purposes.</p>
|
|
|
|
|
|
|
|
|
|
<p><code>cd_nrpe</code> is a fully parameterized Puppet module to automate
|
|
|
|
|
NRPE installation and configuration.</p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-WARNING">WARNING</h2>
|
|
|
|
|
|
|
|
|
|
<p><strong><em>Attention: Never use this puppet module on systems which have
|
|
|
|
|
been previously configured manually. It is impossible to predict how and
|
|
|
|
|
what would have been configured, hence previous configurations outside the
|
|
|
|
|
scope of this module may be overwritten! Automated configurations require a
|
|
|
|
|
test environment to verify that the module suits the purpose intended by
|
|
|
|
|
the user, as well as tune the parameters, before deploying into live
|
|
|
|
|
production</em></strong></p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Features">Features</h2>
|
|
|
|
|
|
|
|
|
|
<p>INSTALLATION</p>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>install nrpe binaries</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<p>CONFIGURATION</p>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>manage NRPE service user properties</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>manage directory structure (file system permissions, selinux context)
|
|
|
|
|
through parameters</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>manage configuration files through parameters:</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>nrpe.conf</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>nrpe.cfg</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>manage sudo role for nagios user on NRPE clients</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>manage dynamic NRPE check command definitions</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>manage iptables (optional)</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>manage selinux rule exceptions (optional)</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<p>SERVICE</p>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>manage NRPE service</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Repo+Documentation">Repo Documentation</h2>
|
|
|
|
|
|
|
|
|
|
<p>See the full Puppet documentation including parameters in
|
|
|
|
|
<code>docs/index.html</code></p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Dependencies">Dependencies</h2>
|
|
|
|
|
|
|
|
|
|
<p>All dependencies must be included in the catalogue.</p>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p><a
|
|
|
|
|
href="https://sourcecode.confdroid.com/12WW1160/cd_resources">cd_resources</a>
|
|
|
|
|
to manage YUM repositories.</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><a
|
|
|
|
|
href="https://sourcecode.confdroid.com/12WW1160/cd_firewall">cd_firewall</a>
|
|
|
|
|
or <a href="https://github.com/puppetlabs/puppetlabs-firewall">puppetlabs
|
|
|
|
|
firewall</a> to manage iptables</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><a href="https://sourcecode.confdroid.com/12WW1160/cd_stdlib">cd_stdlib</a>
|
|
|
|
|
or <a href="https://github.com/puppetlabs/puppetlabs-stdlib">puppetlabs
|
|
|
|
|
stdlib</a> to facilitate concat</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><a href="https://sourcecode.confdroid.com/12WW1160/cd_stdlib">cd_concat</a>
|
|
|
|
|
or <a href="https://github.com/puppetlabs/puppetlabs-concat">puppetlabs
|
|
|
|
|
concat</a> for concatenating files</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Deployment">Deployment</h2>
|
|
|
|
|
|
|
|
|
|
<p><code>cd_nrpe</code> does typically not need to be specifically declared.
|
|
|
|
|
It will be auto-required by <code>cd_nagios</code> with default settings.
|
|
|
|
|
Only if you want to override settings declare it specifically.</p>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>native Puppet deployment</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<p>via site.pp or nodes.pp</p>
|
|
|
|
|
|
|
|
|
|
<pre class="code ruby"><code class="ruby">node 'example.example.net' {
|
|
|
|
|
include nrpe
|
|
|
|
|
}
|
|
|
|
|
</code></pre>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>through Foreman:</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<p>In order to apply parameters through Foreman,
|
|
|
|
|
<strong>cd_nrpe::params</strong> must be added to the host or host group in
|
|
|
|
|
question, unless the defaults are fully acceptable across the estate.</p>
|
|
|
|
|
|
|
|
|
|
<p>See <a
|
|
|
|
|
href="https://confdroid.com/2017/05/deploying-our-puppet-modules/">more
|
|
|
|
|
details about class deployment on Confdroid.com</a>.</p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Managing+Check+Commands">Managing Check Commands</h2>
|
|
|
|
|
|
|
|
|
|
<p>In order to connect a Nagios monitoring server to clients through NRPE, you
|
|
|
|
|
must define commands and the desired argument strings on the clients. The
|
|
|
|
|
default NRPE installation comes with a few examples of such commands, which
|
|
|
|
|
are also included in this module. However, every environment is very
|
|
|
|
|
different in their requirements and Nagios via Puppet is all about the
|
|
|
|
|
ability to dynamically set command arguments based on default variables /
|
|
|
|
|
overrides. For that reason no hard-coded commands are included, but instead
|
|
|
|
|
all commands are set via argument strings, where possible.</p>
|
|
|
|
|
|
|
|
|
|
<p>The commands are created within <code>/etc/nrpe.d/command.cfg</code> ,
|
|
|
|
|
every set of instructions creates a new line.</p>
|
|
|
|
|
|
|
|
|
|
<p>Defining commands is as simple as that:</p>
|
|
|
|
|
|
|
|
|
|
<pre class="code ruby"><code class="ruby">cd_nrpe::commands::definitions { 'check_users':
|
|
|
|
|
ne_check_cmd => 'check_users',
|
|
|
|
|
ne_cmd_argstring => '-w $ARG1$ -c $ARG2$',
|
|
|
|
|
}
|
|
|
|
|
</code></pre>
|
|
|
|
|
|
|
|
|
|
<p>It is very recommendable to define such commands directly within Puppet
|
|
|
|
|
modules or profiles, so any node running the particular service controlled
|
|
|
|
|
by the module will automatically get the required check commands defined as
|
|
|
|
|
well, while nodes not running the service also do not contain the command
|
|
|
|
|
check. The same then is true for Nagios checks, so you would have both the
|
|
|
|
|
NRPE command definition and the Nagios check contained in Puppet modules or
|
|
|
|
|
profiles to have it in one location.</p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-SELINUX">SELINUX</h2>
|
|
|
|
|
|
|
|
|
|
<p>All files and directories are configured with correct selinux context. If
|
|
|
|
|
selinux is disabled, these contexts are ignored.</p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Known+Problems">Known Problems</h2>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs.
|
|
|
|
|
However, at the time of writing this module, this seems to be buggy, as I
|
|
|
|
|
was unable to start the NRPE service as soon as the
|
|
|
|
|
<code>ssl_cert_file</code> line was uncommented in the configuration file,
|
|
|
|
|
despite having valid certs in the right position on the node. This happened
|
|
|
|
|
when installing manually, not through this Puppet module. For that reason I
|
|
|
|
|
included the <code>$ne_enable_ssl</code> boolean parameter, which is set to
|
|
|
|
|
<code>false</code> by default, hence disabling SSL/TLS options until this
|
|
|
|
|
has been fixed upstream, or a valid workaround has been found. Setting this
|
|
|
|
|
option to <code>true</code> will include all SSL / TLS settings.</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Troubleshooting">Troubleshooting</h2>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p><code>CHECK_NRPE: Unable to read output</code>: Nagios sudo access also
|
|
|
|
|
needs Selinux to allow this. Default settings in this module take care for
|
|
|
|
|
both through <code>$ne_allow_sudo</code> and
|
|
|
|
|
<code>$ne_include_selinux</code>.</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><code>CHECK_NRPE: Receive header underflow - only 0 bytes received (4
|
|
|
|
|
expected)</code>: This is down to the new illegal meta characters feature
|
|
|
|
|
via <code>nasty_metachars</code>, i.e. if you included an additional
|
|
|
|
|
character which actually be part of a check, or if a custom check contains
|
|
|
|
|
a default illegal character.</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Support">Support</h2>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>OS: CentOS 7</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>Puppet 5</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Tests">Tests</h2>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p>Puppet Lint</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>excluded tests:</p>
|
|
|
|
|
<ul><li>
|
|
|
|
|
<p><code>--no-class_inherits_from_params_class-check</code>:relevant only to
|
|
|
|
|
non-supported outdated puppet versions</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><code>--no-variable_scope-check</code>: not applicable as we are inheriting
|
|
|
|
|
parameters from params class. the lint check does not distinguish between
|
|
|
|
|
facts and inherited parameters.</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><code>--no-80chars-check</code>: it is not always possible to stay within
|
|
|
|
|
80 characters, although typically only occurring on the parameter vault
|
|
|
|
|
<code>params.pp</code>.</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p><code>--no-arrow_alignment-check</code>: this check leads to actually not
|
|
|
|
|
having am easily readable arrow alignment, as this checks <code>per
|
|
|
|
|
block</code>, not per class.</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>Puppet Parser</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>ERB Template Parser</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>Test for unwanted UTF8 files in the Puppet code (see tests/UTF_Files)</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>Markdown-lint</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>Spellcheck</p>
|
|
|
|
|
</li><li>
|
|
|
|
|
<p>Sonar Quality Gate</p>
|
|
|
|
|
</li></ul>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Contact+Us">Contact Us</h2>
|
|
|
|
|
|
|
|
|
|
<p><a href="https://confdroid.com/contact/">contact Us</a></p>
|
|
|
|
|
|
|
|
|
|
<h2 id="label-Disclaimer">Disclaimer</h2>
|
|
|
|
|
|
|
|
|
|
<p>ConfDroid as entity is entirely independent from Puppet. We provide custom
|
|
|
|
|
configuration modules, written for specific purposes and specific
|
|
|
|
|
environments. The modules are tested and supported only as documented, and
|
|
|
|
|
require testing in designated environments (i.e. lab or development
|
|
|
|
|
environments) for parameter tuning etc. before deploying into production
|
|
|
|
|
environments.</p>
|
|
|
|
|
</div></div>
|
|
|
|
|
|
|
|
|
|
<div id="footer">
|
|
|
|
|
Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
