NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients for monitoring purposes.
+
+
confdroid_nrpe is a fully parameterized Puppet module to automate NRPE installation and configuration.
+
+
WARNING
+
+
+
Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production
+
+
+
Features
+
+
install nrpe binaries
+
+
manage NRPE service user properties
+
+
manage directory structure (file system permissions, selinux context) through parameters
+
+
manage configuration files through parameters:
+
+
nrpe.conf
+
+
nrpe.cfg
+
+
manage sudo role for nagios user on NRPE clients
+
+
manage dynamic NRPE check command definitions
+
+
manage iptables (optional). set ne_incl_fwto true
+
+
manage selinux rule exceptions (optional)
+
+
manage NRPE service
+
+
+
+
Note: The value for the nagios_server variable is derived from a global parameter set in Foreman (nagios_server), because the parameter is used across multiple modules. You need to set that manually in Foreman under “Global Parameters”. Same for nagios_source, the value for the firewall source, which should point to the source IP or source range for the nagios server querying NRPE.
+
+
+
Repo Documentation
+
+
See the full Puppet documentation including parameters in docs/index.html
+
+
Dependencies
+
+
All dependencies must be included in the catalogue.
+
+
confdroid_resources to manage YUM repositories and common resources like EPEL.
confdroid_nrpe does typically not need to be specifically declared. It will be auto-required by cd_nagios with default settings. Only if you want to override settings declare it specifically.
+
+
native Puppet deployment
+
+
+
via site.pp or nodes.pp
+
+
node 'example.example.net' {
+ include nrpe
+}
+
+
+
through Foreman:
+
+
+
In order to apply parameters through Foreman, confdroid_nrpe::params- must be added to the host or host group in question, unless the defaults are fully acceptable across the estate.
In order to connect a Nagios monitoring server to clients through NRPE, you must define commands and the desired argument strings on the clients. The default NRPE installation comes with a few examples of such commands, which are also included in this module. However, every environment is very different in their requirements and Nagios via Puppet is all about the ability to dynamically set command arguments based on default variables / overrides. For that reason no hard-coded commands are included, but instead all commands are set via argument strings, where possible.
+
+
The commands are created within /etc/nrpe.d/command.cfg , every set of instructions creates a new line.
Q: ne_check_name is the same as ne_check_cmd, why is that? A: Sometimes the name of the check is different, like this: command[check_fail2ban]=/usr/lib/nagios/plugins/check_procs -c 1:1 -a fail2ban-server
+
+
+
It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.
+
+
managing TLS serts
+
+
SELINUX
+
+
All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.
+
+
Known Problems
+
+
SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the ssl_cert_file line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the $ne_enable_ssl boolean parameter, which is set to false by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found. Setting this option to true will include all SSL / TLS settings.
+
+
+
Troubleshooting
+
+
CHECK_NRPE: Unable to read output: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through $ne_allow_sudo and $ne_include_selinux.
+
+
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected): This is down to the new illegal meta characters feature via nasty_metachars, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character.
+
+
+
Support
+
+
OS: Rocky 9
+
+
Puppet 8
+
+
+
Tests
+
+
Puppet Lint
+
+
excluded tests:
+
+
--no-variable_scope-check: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters.
+
+
--no-top_scope_facts: iptables does not recognize otherwise
ConfDroid as entity is entirely independent from Puppet. We provide custom configuration modules, written for specific purposes and specific environments. The modules are tested and supported only as documented, and require testing in designated environments (i.e. lab or development environments) for parameter tuning etc. before deploying into production environments.
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/doc/frames.html b/doc/frames.html
new file mode 100644
index 0000000..53734c2
--- /dev/null
+++ b/doc/frames.html
@@ -0,0 +1,22 @@
+
+
+
+
+ Documentation by YARD 0.9.36
+
+
+
+
diff --git a/doc/index.html b/doc/index.html
new file mode 100644
index 0000000..61f9ed0
--- /dev/null
+++ b/doc/index.html
@@ -0,0 +1,255 @@
+
+
+
+
+
+
+ File: README
+
+ — Documentation by YARD 0.9.36
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients for monitoring purposes.
+
+
confdroid_nrpe is a fully parameterized Puppet module to automate NRPE installation and configuration.
+
+
WARNING
+
+
+
Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production
+
+
+
Features
+
+
install nrpe binaries
+
+
manage NRPE service user properties
+
+
manage directory structure (file system permissions, selinux context) through parameters
+
+
manage configuration files through parameters:
+
+
nrpe.conf
+
+
nrpe.cfg
+
+
manage sudo role for nagios user on NRPE clients
+
+
manage dynamic NRPE check command definitions
+
+
manage iptables (optional). set ne_incl_fwto true
+
+
manage selinux rule exceptions (optional)
+
+
manage NRPE service
+
+
+
+
Note: The value for the nagios_server variable is derived from a global parameter set in Foreman (nagios_server), because the parameter is used across multiple modules. You need to set that manually in Foreman under “Global Parameters”. Same for nagios_source, the value for the firewall source, which should point to the source IP or source range for the nagios server querying NRPE.
+
+
+
Repo Documentation
+
+
See the full Puppet documentation including parameters in docs/index.html
+
+
Dependencies
+
+
All dependencies must be included in the catalogue.
+
+
confdroid_resources to manage YUM repositories and common resources like EPEL.
confdroid_nrpe does typically not need to be specifically declared. It will be auto-required by cd_nagios with default settings. Only if you want to override settings declare it specifically.
+
+
native Puppet deployment
+
+
+
via site.pp or nodes.pp
+
+
node 'example.example.net' {
+ include nrpe
+}
+
+
+
through Foreman:
+
+
+
In order to apply parameters through Foreman, confdroid_nrpe::params- must be added to the host or host group in question, unless the defaults are fully acceptable across the estate.
In order to connect a Nagios monitoring server to clients through NRPE, you must define commands and the desired argument strings on the clients. The default NRPE installation comes with a few examples of such commands, which are also included in this module. However, every environment is very different in their requirements and Nagios via Puppet is all about the ability to dynamically set command arguments based on default variables / overrides. For that reason no hard-coded commands are included, but instead all commands are set via argument strings, where possible.
+
+
The commands are created within /etc/nrpe.d/command.cfg , every set of instructions creates a new line.
Q: ne_check_name is the same as ne_check_cmd, why is that? A: Sometimes the name of the check is different, like this: command[check_fail2ban]=/usr/lib/nagios/plugins/check_procs -c 1:1 -a fail2ban-server
+
+
+
It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.
+
+
managing TLS serts
+
+
SELINUX
+
+
All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.
+
+
Known Problems
+
+
SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the ssl_cert_file line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the $ne_enable_ssl boolean parameter, which is set to false by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found. Setting this option to true will include all SSL / TLS settings.
+
+
+
Troubleshooting
+
+
CHECK_NRPE: Unable to read output: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through $ne_allow_sudo and $ne_include_selinux.
+
+
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected): This is down to the new illegal meta characters feature via nasty_metachars, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character.
+
+
+
Support
+
+
OS: Rocky 9
+
+
Puppet 8
+
+
+
Tests
+
+
Puppet Lint
+
+
excluded tests:
+
+
--no-variable_scope-check: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters.
+
+
--no-top_scope_facts: iptables does not recognize otherwise
ConfDroid as entity is entirely independent from Puppet. We provide custom configuration modules, written for specific purposes and specific environments. The modules are tested and supported only as documented, and require testing in designated environments (i.e. lab or development environments) for parameter tuning etc. before deploying into production environments.
