confdroid/confdroid_nrpe
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

OP#421 fixed it

Browse Source
This commit is contained in:
Arne Teuke
2026-02-13 17:21:01 +01:00
parent 23c0df59ad
commit 9da45bba7a
3 changed files with 33 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.puppet-lint.rc
View File

@@ -1 +1,2 @@
--no-variable_scope-check --no-variable_scope-check
--no-top_scope_facts

59
README.md
View File

@@ -32,17 +32,17 @@ NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients for mon
## Features ## Features
* install nrpe binaries - install nrpe binaries
* manage NRPE service user properties - manage NRPE service user properties
* manage directory structure (file system permissions, selinux context) through parameters - manage directory structure (file system permissions, selinux context) through parameters
* manage configuration files through parameters: - manage configuration files through parameters:
* nrpe.conf - nrpe.conf
* nrpe.cfg - nrpe.cfg
* manage sudo role for nagios user on NRPE clients - manage sudo role for nagios user on NRPE clients
* manage dynamic NRPE check command definitions - manage dynamic NRPE check command definitions
* manage iptables (optional). set `ne_incl_fw`to `true`. - manage iptables (optional). set `ne_incl_fw`to `true`.
* manage selinux rule exceptions (optional) - manage selinux rule exceptions (optional)
* manage NRPE service - manage NRPE service
> Note: The value for the `nagios_server` variable is derived from a global paraneter set in Foreman (`nagios_server`), because the paremeter is used across multiple modules. You need to set that manually in Foreman under "Global Parameters". Same for `nagios_source`, the value for the firewall source. > Note: The value for the `nagios_server` variable is derived from a global paraneter set in Foreman (`nagios_server`), because the paremeter is used across multiple modules. You need to set that manually in Foreman under "Global Parameters". Same for `nagios_source`, the value for the firewall source.
@@ -54,14 +54,14 @@ See the full Puppet documentation including parameters in `docs/index.html`
All dependencies must be included in the catalogue. All dependencies must be included in the catalogue.
* [confdroid_resources](https://gitlab.confdroid.com/puppet/cd_resources) to manage YUM repositories. - [confdroid_resources](https://gitlab.confdroid.com/puppet/cd_resources) to manage YUM repositories.
* [puppetlabs firewall](https://github.com/puppetlabs/puppetlabs-firewall) to manage iptables - [puppetlabs firewall](https://github.com/puppetlabs/puppetlabs-firewall) to manage iptables
## Deployment ## Deployment
`confdroid_nrpe` does typically not need to be specifically declared. It will be auto-required by `cd_nagios` with default settings. Only if you want to override settings declare it specifically. `confdroid_nrpe` does typically not need to be specifically declared. It will be auto-required by `cd_nagios` with default settings. Only if you want to override settings declare it specifically.
* native Puppet deployment - native Puppet deployment
via site.pp or nodes.pp via site.pp or nodes.pp
@@ -71,9 +71,9 @@ node 'example.example.net' {
} }
``` ```
* through Foreman: - through Foreman:
In order to apply parameters through Foreman, **__confdroid_nrpe::params__** must be added to the host or host group in question, unless the defaults are fully acceptable across the estate. In order to apply parameters through Foreman, **__confdroid_nrpe::params__*- must be added to the host or host group in question, unless the defaults are fully acceptable across the estate.
See [more details about class deployment on Confdroid.com](https://confdroid.com/2017/05/deploying-our-puppet-modules/). See [more details about class deployment on Confdroid.com](https://confdroid.com/2017/05/deploying-our-puppet-modules/).
@@ -100,31 +100,32 @@ All files and directories are configured with correct selinux context. If selinu
## Known Problems ## Known Problems
* SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the `ssl_cert_file` line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the `$ne_enable_ssl` boolean parameter, which is set to `false` by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found. Setting this option to `true` will include all SSL / TLS settings. - SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the `ssl_cert_file` line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the `$ne_enable_ssl` boolean parameter, which is set to `false` by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found. Setting this option to `true` will include all SSL / TLS settings.
## Troubleshooting ## Troubleshooting
* `CHECK_NRPE: Unable to read output`: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through `$ne_allow_sudo` and `$ne_include_selinux`. - `CHECK_NRPE: Unable to read output`: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through `$ne_allow_sudo` and `$ne_include_selinux`.
* `CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected)`: This is down to the new illegal meta characters feature via `nasty_metachars`, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character. - `CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected)`: This is down to the new illegal meta characters feature via `nasty_metachars`, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character.
## Support ## Support
* OS: Rocky 9 - OS: Rocky 9
* Puppet 8 - Puppet 8
## Tests ## Tests
* Puppet Lint - Puppet Lint
* excluded tests: - excluded tests:
* `--no-variable_scope-check`: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters. - `--no-variable_scope-check`: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters.
* Puppet Parser - `--no-top_scope_facts`: iptables does not recognise otherwise
* ERB Template Parser - Puppet Parser
* Sonar Quality Gate - ERB Template Parser
- Sonar Quality Gate
## Contact Us ## Contact Us
* [contact Us](https://confdroid.com/contact/) - [contact Us](https://confdroid.com/contact/)
* [Feedback Portal](https://feedback.confdroid.com) - [Feedback Portal](https://feedback.confdroid.com)
## Disclaimer ## Disclaimer

3
manifests/firewall/iptables.pp
View File

@@ -7,10 +7,9 @@
class confdroid_nrpe::firewall::iptables ( class confdroid_nrpe::firewall::iptables (
) inherits confdroid_nrpe::params { ) inherits confdroid_nrpe::params {
if $ne_incl_fw == true { if $ne_incl_fw == true {
firewall { "${ne_fw_order_no}${ne_nrpe_port} port ${ne_nrpe_port}": firewall { "${ne_fw_order_no}${ne_nrpe_port} port ${ne_nrpe_port}":
source => $nagios_server, source => $nagios_source,
proto => 'tcp', proto => 'tcp',
dport => $ne_nrpe_port, dport => $ne_nrpe_port,
jump => 'accept', jump => 'accept',