Puppet Class: confdroid_nrpe::params

Inherited by:
confdroid_nrpe::main::dirs
confdroid_nrpe::main::user
confdroid_nrpe::main::files
confdroid_nrpe::main::config
confdroid_nrpe::main::install
confdroid_nrpe::main::service
confdroid_nrpe::selinux::config
confdroid_nrpe::firewall::iptables
confdroid_nrpe::commands::definition_rules
Defined in:
manifests/params.pp

Summary

Class holds all parameters for the confdroid_nrpe module and is inherited by all classes except defines.

Overview

confdroid_nrpe::params.pp Module name: confdroid_nrpe Author: 12ww1160 (12ww1160@ConfDroid.com) be passed to the NRPE daemon.

Parameters:

  • pkg_ensure (String) (defaults to: 'present') —

    which package type to choose, i.e. latest or present.

  • ne_log_facility (String) (defaults to: 'daemon') —

    the log facility to use.

  • ne_log_file (String) (defaults to: '') —

    If a log file is specified in this option, nrpe will write to that file instead of using syslog. i.e. /var/run/nrpe.log

  • ne_debug (String) (defaults to: '0') —

    Whether debugging messages are logged to the syslog facility.

  • ne_nrpe_port (String) (defaults to: '5666') —

    the NRPE port. used in firewall ( optional) and configuration file.

  • ne_listen_queue_size (String) (defaults to: '5') —

    Listen queue size (backlog) for serving incoming connections.

  • ne_dont_blame_nrpe (String) (defaults to: '1') —

    whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.

  • ne_allow_bash_cmd_subst (String) (defaults to: '1') —

    whether or not the NRPE daemon will allow clients to specify arguments that contain bash command substitutions of the form $(…).

  • ne_allow_sudo (Boolean) (defaults to: true) —

    Whether to allow sudo access. used in nrpe.cfg as well as for creating a sudo role.

  • ne_command_prefix (String) (defaults to: '/usr/bin/sudo') —

    allows you to prefix all commands with a user-defined String.

  • ne_incl_fw (Boolean) (defaults to: true) —

    Whether to include firewall rules

  • ne_command_timeout (String) (defaults to: '60') —

    maximum number of seconds that the NRPE daemon will allow plugins to finish executing before killing them off.

  • ne_connection_timeout (String) (defaults to: '300') —

    maximum number of seconds that the NRPE daemon will wait for a connection to be established before exiting.

  • ne_ssl_version (String) (defaults to: 'TLSv2+') —

    These directives allow you to specify how to use SSL/TLS.

  • ne_ssl_use_adh (String) (defaults to: '1') —

    This is for backward compatibility and is DEPRECATED. Set to 1 to enable ADH or 2 to require ADH. 1 is currently the default but will be changed in a later version.

  • ne_ssl_cipher_list (String) (defaults to: 'ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH') —

    ciphers can be used. For backward compatibility, this defaults to ‘ssl_cipher_list=ALL:!MD5:@STRENGTH’ in this version but will be changed in a later version of NRPE.

  • ne_ssl_cacert_file (String) (defaults to: '/etc/pki/tls/certs/ca-chain.crt.pem') —

    path and name of the ssl certificate authority (ca) file / chain. must be full path.

  • ne_ssl_client_certs (String) (defaults to: '2') —

    determines client certificate usage. Values: 0 = Don’t ask for or require client certificates 1 = Ask for client certificates 2 = Require client certificates

  • ne_ssl_logging (String) (defaults to: '0x00') —

    determines which SSL messages are send to syslog. OR values together to specify multiple options. Values: 0x00 (0) = No additional logging (default) 0x01 (1) = Log startup SSL/TLS parameters 0x02 (2) = Log remote IP address 0x04 (4) = Log SSL/TLS version of connections 0x08 (8) = Log which cipher is being used for the connection 0x10 (16) = Log if client has a certificate 0x20 (32) = Log details of client’s certificate if it has one -1 or 0xff or 0x2f = All of the above

  • ne_nasty_metachars (Array) (defaults to: ["|`&><'\\[]{};\r\n"]) —

    list of characters that cannot

  • ne_include_file (String) (defaults to: '') —

    include definitions from an external config file.

  • ne_fw_order_no (String) (defaults to: '50') —

    ordering prefix for he firewall rules. Adjust to your environment if needed.

  • ne_ssl_opts (String) (defaults to: '') —

    Specify additional SSL options.

  • ne_user (String) (defaults to: 'nrpe') —

    the NRPE service user

  • ne_user_comment (String) (defaults to: 'NRPE service user') —

    The comment for the service user /etc/passwd

  • ne_user_uid (String) (defaults to: '1005') —

    the UID for the service user

  • ne_user_home (String) (defaults to: '/var/run/nrpe') —

    the home for the service user

  • ne_user_shell (String) (defaults to: '/sbin/nologin') —

    the shell for the service user.

  • ne_user_groups (Optional[String]) (defaults to: undef) —

    additional groups for the service user.

  • ne_server_address (String) (defaults to: '0.0.0.0') —

    the network interfaces to listen on

  • ne_allow_weak_rnd_seed (String) (defaults to: '1') —

    Whether to allow weak random seeds

  • ne_include_selinux (Boolean) (defaults to: true) —

    Whether to manage selinux

  • ne_enable_ssl (Boolean) (defaults to: false) —

    Whether to enable SSL certificates.

  • reqpackages (Array) (defaults to: ['nrpe','nrpe-selinux','selinux-policy-devel']) —

    which packages to install

  • ne_manage_cmds (Boolean) (defaults to: true) —

    Whether to manage command rules for NRPE checks, to allow dynamic check & command rules.

  • ne_ssl_cert_pem (Optional[String]) (defaults to: undef) —

    Optional parameter to specify the content of the nagios server ssl certificate. This is used for the nagios server certificate and has to be provided via Hiera or ENC. Must be specified if SSL is enabled.

  • ne_ssl_privatekey_pem (Optional[String]) (defaults to: undef) —

    Optional parameter to specify the content of the nagios server ssl private key. This is used for the nagios server private key and has to be provided via Hiera or ENC. Must be specified if SSL is enabled.

See Also:



86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
 
# File 'manifests/params.pp', line 86

class confdroid_nrpe::params (

  String $pkg_ensure                      = 'present',
  Array $reqpackages                      = ['nrpe','nrpe-selinux','selinux-policy-devel'],

  Boolean $ne_manage_cmds                 = true,

# NRPE user settings
  String $ne_user                         = 'nrpe',
  String $ne_user_comment                 = 'NRPE service user',
  String $ne_user_uid                     = '1005',
  String $ne_user_home                    = '/var/run/nrpe',
  Optional[String] $ne_user_groups        = undef,
  String $ne_user_shell                   = '/sbin/nologin',

# nrpe.cfg
  String $ne_log_facility                 = 'daemon',
  String $ne_log_file                     = '',
  String $ne_debug                        = '0',
  String $ne_nrpe_port                    = '5666',
  String $ne_server_address               = '0.0.0.0',
  String $ne_listen_queue_size            = '5',
  String $ne_dont_blame_nrpe              = '1',
  String $ne_allow_bash_cmd_subst         = '1',
  Boolean $ne_allow_sudo                  = true,
  String $ne_command_prefix               = '/usr/bin/sudo',
  String $ne_command_timeout              = '60',
  String $ne_connection_timeout           = '300',
  String $ne_allow_weak_rnd_seed          = '1',
  Boolean $ne_enable_ssl                  = false,
  String $ne_ssl_version                  = 'TLSv2+',
  String $ne_ssl_use_adh                  = '1',
  String $ne_ssl_cipher_list              = 'ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH',
  String $ne_ssl_cacert_file              = '/etc/pki/tls/certs/ca-chain.crt.pem',
  String $ne_ssl_client_certs             = '2',
  String $ne_ssl_logging                  = '0x00',
  Array $ne_nasty_metachars               = ["|`&><'\\[]{};\r\n"],
  String $ne_include_file                 = '',
  Optional[String] $ne_ssl_cert_pem       = undef,
  Optional[String] $ne_ssl_privatekey_pem = undef,

# nrpe.conf
  String $ne_ssl_opts                     = '',

# firewall
  Boolean $ne_incl_fw                     = true,
  String $ne_fw_order_no                  = '50',

# selinux
  Boolean $ne_include_selinux             = true,

) {
# Default facts
  $fqdn                     = $facts['networking']['fqdn']
  $domain                   = $facts['networking']['domain']
  $os_name                  = $facts['os']['name']
  $os_release               = $facts['os']['release']['major']
  $nagios_server            = $::nagios_server
  $nagios_source            = $::nagios_source

# service
  $ne_service                 = 'nrpe'

# directories
  $ne_main_conf_d_dir         = '/etc/nrpe.d'
  $ne_run_dir                 = '/var/run/nrpe'

# files
  $ne_main_conf_file          = '/etc/nagios/nrpe.cfg'
  $ne_main_conf_erb           = 'confdroid_nrpe/nrpe_cfg.erb'
  $ne_nrpe_pid_file           = "${ne_run_dir}/nrpe.pid"
  $ne_nrpe_conf_file          = '/etc/sysconfig/nrpe'
  $ne_nrpe_conf_erb           = 'confdroid_nrpe/nrpe_conf.erb'
  $ne_cmd_file                = "${ne_main_conf_d_dir}/commands.cfg"
  $ne_cmd_head_erb            = 'confdroid_nrpe/cmd_head.erb'
  $ne_cmd_rule_erb            = 'confdroid_nrpe/cmd_rule.erb'
  $ne_sudo_file               = '/etc/sudoers.d/nagios_sudo'
  $ne_sudo_rule_erb           = 'confdroid_nrpe/sudo_rule.erb'
  $ne_nrpe_te_file            = "${ne_main_conf_d_dir}/nrpe.te"
  $ne_nrpe_te_erb             = 'confdroid_nrpe/nrpe.te.erb'
  $ne_nrpe_mod_file           = "${ne_main_conf_d_dir}/nrpe.mod"
  $ne_checkmodule_nrpe_erb    = 'confdroid_nrpe/checkmodule_nrpe.erb'
  $ne_nrpe_pp_file            = "${ne_main_conf_d_dir}/nrpe.pp"
  $ne_semodule_erb            =  'confdroid_nrpe/semodule_nrpe.erb'
  $ne_ssl_cert_file           = "/etc/pki/tls/certs/${fqdn}.crt.pem"
  $ne_ssl_cert_erb            = 'confdroid_nrpe/ssl_cert.erb'
  $ne_ssl_privatekey_file     = "/etc/pki/tls/private/${fqdn}.key.pem"
  $ne_ssl_privatekey_erb      = 'confdroid_nrpe/ssl_privatekey.erb'

# includes must be last
  include confdroid_nrpe::main::config
}