Puppet Class: cd_nrpe::params

Inherited by:

cd_nrpe::main::dirs
cd_nrpe::main::user
cd_nrpe::main::files
cd_nrpe::main::config
cd_nrpe::main::install
cd_nrpe::main::service
cd_nrpe::selinux::config
cd_nrpe::firewall::iptables
cd_nrpe::commands::definition_rules

Defined in:

manifests/params.pp

Summary

Class holds all parameters for the cd_nrpe module and is inherited by all classes except defines.

Overview

cd_nrpe::params.pp Module name: cd_nrpe Author: Arne Teuke (arne_teuke@ConfDroid.com) be passed to the NRPE daemon.

Parameters:

• pkg_ensure (String) (defaults to: 'latest') —

  which package type to choose, i.e. latest or present.

• ne_log_facility (String) (defaults to: 'daemon') —

  the log facility to use.

• ne_log_file (String) (defaults to: '') —

  If a log file is specified in this option, nrpe will write to that file instead of using syslog. i.e. /var/run/nrpe.log

• ne_debug (String) (defaults to: '0') —

  Whether debugging messages are logged to the syslog facility.

• ne_nrpe_port (String) (defaults to: '5666') —

  the NRPE port. used in firewall ( optional) and configuration file.

• ne_listen_queue_size (String) (defaults to: '5') —

  Listen queue size (backlog) for serving incoming connections.

• ne_nagios_server (String) (defaults to: $::nagios_server) —

  ipaddress of the nagios server to be allowed to connect to NRPE service. Default is to look up a global parameter from ENC.

• ne_dont_blame_nrpe (String) (defaults to: '1') —

  whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.

• ne_allow_bash_cmd_subst (String) (defaults to: '1') —

  whether or not the NRPE daemon will allow clients to specify arguments that contain bash command substitutions of the form $(…).

• ne_allow_sudo (Boolean) (defaults to: true) —

  Whether to allow sudo access. used in nrpe.cfg as well as for creating a sudo role.

• ne_command_prefix (String) (defaults to: '/usr/bin/sudo') —

  allows you to prefix all commands with a user-defined String.

• ne_incl_fw (Boolean) (defaults to: true) —

  Whether to include firewall rules

• ne_command_timeout (String) (defaults to: '60') —

  maximum number of seconds that the NRPE daemon will allow plugins to finish executing before killing them off.

• ne_connection_timeout (String) (defaults to: '300') —

  maximum number of seconds that the NRPE daemon will wait for a connection to be established before exiting.

• ne_ssl_version (String) (defaults to: 'TLSv2+') —

  These directives allow you to specify how to use SSL/TLS.

• ne_ssl_use_adh (String) (defaults to: '1') —

  This is for backward compatibility and is DEPRECATED. Set to 1 to enable ADH or 2 to require ADH. 1 is currently the default but will be changed in a later version.

• ne_ssl_cipher_list (String) (defaults to: 'ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH') —

  ciphers can be used. For backward compatibility, this defaults to ‘ssl_cipher_list=ALL:!MD5:@STRENGTH’ in this version but will be changed in a later version of NRPE.

• ne_ssl_cacert_file (String) (defaults to: '/etc/pki/tls/certs/ca-chain.crt.pem') —

  path and name of the ssl certificate authority (ca) file / chain. must be full path.

• ne_ssl_cert_file (String) (defaults to: "/etc/pki/tls/certs/${::fqdn}.crt.pem") —

  path and name of the server ssl certificate. must include full path.

• ne_ssl_privatekey_file (String) (defaults to: "/etc/pki/tls/private/${::fqdn}.key.pem") —

  path and name of the server ssl private key. Must include full path.

• ne_ssl_client_certs (String) (defaults to: '2') —

  determines client certificate usage. Values: 0 = Don’t ask for or require client certificates 1 = Ask for client certificates 2 = Require client certificates

• ne_ssl_logging (String) (defaults to: '0x00') —

  determines which SSL messages are send to syslog. OR values together to specify multiple options. Values: 0x00 (0) = No additional logging (default) 0x01 (1) = Log startup SSL/TLS parameters 0x02 (2) = Log remote IP address 0x04 (4) = Log SSL/TLS version of connections 0x08 (8) = Log which cipher is being used for the connection 0x10 (16) = Log if client has a certificate 0x20 (32) = Log details of client’s certificate if it has one -1 or 0xff or 0x2f = All of the above

• ne_nasty_metachars (Array) (defaults to: ["|`&><'\\[]{};\r\n"]) —

  list of characters that cannot

• ne_include_file (String) (defaults to: '') —

  include definitions from an external config file.

• ne_fw_order_no (String) (defaults to: '50') —

  ordering prefix for he firewall rules. Adjust to your environment if needed.

• ne_ssl_opts (String) (defaults to: '') —

  Specify additional SSL options.

• ne_user (String) (defaults to: 'nrpe') —

  the NRPE service user

• ne_user_comment (String) (defaults to: 'NRPE service user') —

  The comment for the service user /etc/passwd

• ne_user_uid (String) (defaults to: '1005') —

  the UID for the service user

• ne_user_home (String) (defaults to: '/var/run/nrpe') —

  the home for the service user

• ne_user_shell (String) (defaults to: '/sbin/nologin') —

  the shell for the service user.

• ne_user_groups (Optional[String]) (defaults to: undef) —

  additional groups for the service user.

• ne_server_address (String) (defaults to: '0.0.0.0') —

  the network interfaces to listen on

• ne_allow_weak_rnd_seed (String) (defaults to: '1') —

  Whether to allow weak random seeds

• ne_include_selinux (Boolean) (defaults to: true) —

  Whether to manage selinux

• ne_enable_ssl (Boolean) (defaults to: false) —

  Whether to enable SSL certificates.

• reqpackages (Array) (defaults to: ['nrpe','nrpe-selinux']) —

  which packages to install

• ne_manage_cmds (Boolean) (defaults to: true) —

  Whether to manage command rules for NRPE checks, to allow dynamic check & command rules.

See Also:

• https://www.nagios.org/documentation/

# File 'manifests/params.pp', line 85

class cd_nrpe::params (

  String $pkg_ensure                 = 'latest',
  Array $reqpackages                = ['nrpe','nrpe-selinux'],

  Boolean $ne_manage_cmds             = true,

# NRPE user settings
  String $ne_user                    = 'nrpe',
  String $ne_user_comment            = 'NRPE service user',
  String $ne_user_uid                = '1005',
  String $ne_user_home               = '/var/run/nrpe',
  Optional[String] $ne_user_groups   = undef,
  String $ne_user_shell              = '/sbin/nologin',

# nrpe.cfg
  String $ne_log_facility            = 'daemon',
  String $ne_log_file                = '',
  String $ne_debug                   = '0',
  String $ne_nrpe_port               = '5666',
  String $ne_server_address          = '0.0.0.0',
  String $ne_listen_queue_size       = '5',
  String $ne_nagios_server           = $::nagios_server,
  String $ne_dont_blame_nrpe         = '1',
  String $ne_allow_bash_cmd_subst    = '1',
  Boolean $ne_allow_sudo             = true,
  String $ne_command_prefix          = '/usr/bin/sudo',
  String $ne_command_timeout         = '60',
  String $ne_connection_timeout      = '300',
  String $ne_allow_weak_rnd_seed     = '1',
  Boolean $ne_enable_ssl             = false,
  String $ne_ssl_version             = 'TLSv2+',
  String $ne_ssl_use_adh             = '1',
  String $ne_ssl_cipher_list         = 'ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH',
  String $ne_ssl_cacert_file         = '/etc/pki/tls/certs/ca-chain.crt.pem',
  String $ne_ssl_cert_file           = "/etc/pki/tls/certs/${::fqdn}.crt.pem",
  String $ne_ssl_privatekey_file     = "/etc/pki/tls/private/${::fqdn}.key.pem",
  String $ne_ssl_client_certs        = '2',
  String $ne_ssl_logging             = '0x00',
  Array $ne_nasty_metachars          = ["|`&><'\\[]{};\r\n"],
  String $ne_include_file            = '',

# nrpe.conf
  String $ne_ssl_opts                = '',

# firewall
  Boolean $ne_incl_fw                = true,
  String $ne_fw_order_no             = '50',

# selinux
  Boolean $ne_include_selinux        = true,

) {
# service
  $ne_service                 = 'nrpe'

# directories
  $ne_main_conf_d_dir         = '/etc/nrpe.d'
  $ne_run_dir                 = '/var/run/nrpe'

# files
  $ne_main_conf_file          = '/etc/nagios/nrpe.cfg'
  $ne_main_conf_erb           = 'cd_nrpe/nrpe_cfg.erb'
  $ne_nrpe_pid_file           = "${ne_run_dir}/nrpe.pid"
  $ne_nrpe_conf_file          = '/etc/sysconfig/nrpe'
  $ne_nrpe_conf_erb           = 'cd_nrpe/nrpe_conf.erb'
  $ne_cmd_file                = "${ne_main_conf_d_dir}/commands.cfg"
  $ne_cmd_head_erb            = 'cd_nrpe/cmd_head.erb'
  $ne_cmd_rule_erb            = 'cd_nrpe/cmd_rule.erb'
  $ne_sudo_file               = '/etc/sudoers.d/nagios_sudo'
  $ne_sudo_rule_erb           = 'cd_nrpe/sudo_rule.erb'
  $ne_nrpe_te_file            = "${ne_main_conf_d_dir}/nrpe.te"
  $ne_nrpe_te_erb             = 'cd_nrpe/nrpe.te.erb'
  $ne_nrpe_mod_file           = "${ne_main_conf_d_dir}/nrpe.mod"
  $ne_checkmodule_nrpe_erb    = 'cd_nrpe/checkmodule_nrpe.erb'
  $ne_nrpe_pp_file            = "${ne_main_conf_d_dir}/nrpe.pp"
  $ne_semodule_erb            =  'cd_nrpe/semodule_nrpe.erb'

# includes must be last
  include cd_nrpe::main::config
}