263 lines
11 KiB
HTML
263 lines
11 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>
|
|
File: README
|
|
|
|
— Documentation by YARD 0.9.36
|
|
|
|
</title>
|
|
|
|
<link rel="stylesheet" href="css/style.css" type="text/css" />
|
|
|
|
<link rel="stylesheet" href="css/common.css" type="text/css" />
|
|
|
|
<script type="text/javascript">
|
|
pathId = "";
|
|
relpath = '';
|
|
</script>
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="js/jquery.js"></script>
|
|
|
|
<script type="text/javascript" charset="utf-8" src="js/app.js"></script>
|
|
|
|
|
|
</head>
|
|
<body>
|
|
<div class="nav_wrap">
|
|
<iframe id="nav" src="file_list.html?1"></iframe>
|
|
<div id="resizer"></div>
|
|
</div>
|
|
|
|
<div id="main" tabindex="-1">
|
|
<div id="header">
|
|
<div id="menu">
|
|
|
|
<a href="_index.html">Index</a> »
|
|
<span class="title">File: README</span>
|
|
|
|
</div>
|
|
|
|
<div id="search">
|
|
|
|
<a class="full_list_link" id="puppet_class_list_link"
|
|
href="puppet_class_list.html">
|
|
|
|
<svg width="24" height="24">
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
</svg>
|
|
</a>
|
|
|
|
</div>
|
|
<div class="clear"></div>
|
|
</div>
|
|
|
|
<div id="content"><div id='filecontents'>
|
|
<h1 id="label-Readme">Readme</h1>
|
|
|
|
<p><a href="https://jenkins.confdroid.com/job/confdroid_nrpe/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_nrpe&style=plastic"></a> <a href="https://sonarqube.confdroid.com/dashboard?id=confdroid_nrpe"><img src="https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_nrpe&metric=security_hotspots&token=sqb_f9684afc518e68fed283f4f0f51be7aa91c28a77"></a> <a href="https://deepwiki.com/grizzlycoda/puppet_collection"><img src="https://deepwiki.com/badge.svg"></a></p>
|
|
<ul><li>
|
|
<p><a href="#readme">Readme</a></p>
|
|
</li><li>
|
|
<p><a href="#synopsis">Synopsis</a></p>
|
|
</li><li>
|
|
<p><a href="#warning">WARNING</a></p>
|
|
</li><li>
|
|
<p><a href="#features">Features</a></p>
|
|
</li><li>
|
|
<p><a href="#repo-documentation">Repo Documentation</a></p>
|
|
</li><li>
|
|
<p><a href="#dependencies">Dependencies</a></p>
|
|
</li><li>
|
|
<p><a href="#deployment">Deployment</a></p>
|
|
</li><li>
|
|
<p><a href="#managing-check-commands">Managing Check Commands</a></p>
|
|
</li><li>
|
|
<p><a href="#managing-tls-certificates">managing TLS certificates</a></p>
|
|
</li><li>
|
|
<p><a href="#selinux">SELINUX</a></p>
|
|
</li><li>
|
|
<p><a href="#known-problems">Known Problems</a></p>
|
|
</li><li>
|
|
<p><a href="#troubleshooting">Troubleshooting</a></p>
|
|
</li><li>
|
|
<p><a href="#support">Support</a></p>
|
|
</li><li>
|
|
<p><a href="#tests">Tests</a></p>
|
|
</li><li>
|
|
<p><a href="#contact-us">Contact Us</a></p>
|
|
</li><li>
|
|
<p><a href="#disclaimer">Disclaimer</a></p>
|
|
</li></ul>
|
|
|
|
<h2 id="label-Synopsis">Synopsis</h2>
|
|
|
|
<p>NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients for monitoring purposes.</p>
|
|
|
|
<p><code>confdroid_nrpe</code> is a fully parameterized Puppet module to automate NRPE installation and configuration.</p>
|
|
|
|
<h2 id="label-WARNING">WARNING</h2>
|
|
|
|
<blockquote>
|
|
<p><strong>Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production</strong></p>
|
|
</blockquote>
|
|
|
|
<h2 id="label-Features">Features</h2>
|
|
<ul><li>
|
|
<p>install nrpe binaries</p>
|
|
</li><li>
|
|
<p>manage NRPE service user properties</p>
|
|
</li><li>
|
|
<p>manage directory structure (file system permissions, selinux context) through parameters</p>
|
|
</li><li>
|
|
<p>manage configuration files through parameters:</p>
|
|
</li><li>
|
|
<p>nrpe.conf</p>
|
|
</li><li>
|
|
<p>nrpe.cfg</p>
|
|
</li><li>
|
|
<p>manage sudo role for nagios user on NRPE clients</p>
|
|
</li><li>
|
|
<p>manage dynamic NRPE check command definitions</p>
|
|
</li><li>
|
|
<p>manage iptables (optional). set <code>ne_incl_fw</code>to <code>true</code></p>
|
|
</li><li>
|
|
<p>manage selinux rule exceptions (optional)</p>
|
|
</li><li>
|
|
<p>manage NRPE service</p>
|
|
</li></ul>
|
|
|
|
<blockquote>
|
|
<p>Note: The value for the <code>nagios_server</code> variable is derived from a global parameter set in Foreman (<code>nagios_server</code>), because the parameter is used across multiple modules. You need to set that manually in Foreman under “Global Parameters”. Same for <code>nagios_source</code>, the value for the firewall source, which should point to the source IP or source range for the nagios server querying NRPE.</p>
|
|
</blockquote>
|
|
|
|
<h2 id="label-Repo+Documentation">Repo Documentation</h2>
|
|
|
|
<p>See the full Puppet documentation including parameters in <code>docs/index.html</code></p>
|
|
|
|
<h2 id="label-Dependencies">Dependencies</h2>
|
|
|
|
<p>All dependencies must be included in the catalogue.</p>
|
|
<ul><li>
|
|
<p><a href="https://sourcecode.confdroid.com/confdroid/confdroid_resources">confdroid_resources</a> to manage YUM repositories and common resources like EPEL.</p>
|
|
</li><li>
|
|
<p><a href="https://github.com/puppetlabs/puppetlabs-firewall">puppetlabs firewall</a> to manage iptables</p>
|
|
</li></ul>
|
|
|
|
<h2 id="label-Deployment">Deployment</h2>
|
|
|
|
<p><code>confdroid_nrpe</code> does typically not need to be specifically declared. It will be auto-required by <code>cd_nagios</code> with default settings. Only if you want to override settings declare it specifically.</p>
|
|
<ul><li>
|
|
<p>native Puppet deployment</p>
|
|
</li></ul>
|
|
|
|
<p>via site.pp or nodes.pp</p>
|
|
|
|
<pre class="code ruby"><code class="ruby">node 'example.example.net' {
|
|
include nrpe
|
|
}
|
|
</code></pre>
|
|
<ul><li>
|
|
<p>through Foreman:</p>
|
|
</li></ul>
|
|
|
|
<p>In order to apply parameters through Foreman, <strong>confdroid_nrpe::params</strong>- must be added to the host or host group in question, unless the defaults are fully acceptable across the estate.</p>
|
|
|
|
<p>See <a href="https://confdroid.com/2017/05/deploying-our-puppet-modules/">more details about class deployment on Confdroid.com</a>.</p>
|
|
|
|
<h2 id="label-Managing+Check+Commands">Managing Check Commands</h2>
|
|
|
|
<p>In order to connect a Nagios monitoring server to clients through NRPE, you must define commands and the desired argument strings on the clients. The default NRPE installation comes with a few examples of such commands, which are also included in this module. However, every environment is very different in their requirements and Nagios via Puppet is all about the ability to dynamically set command arguments based on default variables / overrides. For that reason no hard-coded commands are included, but instead all commands are set via argument strings, where possible.</p>
|
|
|
|
<p>The commands are created within <code>/etc/nrpe.d/command.cfg</code> , every set of instructions creates a new line.</p>
|
|
|
|
<p>Defining commands is as simple as that:</p>
|
|
|
|
<pre class="code ruby"><code class="ruby">confdroid_nrpe::commands::definitions { 'check_users':
|
|
ne_check_name => 'check_users',
|
|
ne_check_cmd => 'check_users',
|
|
ne_cmd_argstring => '-w $ARG1$ -c $ARG2$',
|
|
}
|
|
</code></pre>
|
|
|
|
<blockquote>
|
|
<p>Q: <code>ne_check_name</code> is the same as <code>ne_check_cmd</code>, why is that? A: Sometimes the name of the check is different, like this: <code>command[check_fail2ban]=/usr/lib/nagios/plugins/check_procs -c 1:1 -a fail2ban-server</code></p>
|
|
</blockquote>
|
|
|
|
<p>It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.</p>
|
|
|
|
<h2 id="label-managing+TLS+certificates">managing TLS certificates</h2>
|
|
|
|
<p>When <code>ne_enable_ssl</code> is enabled, the certificates for the ca (root if standalone or intermediate), the nagios server and the key for the nagios server have to be provided through the following values:</p>
|
|
<ul><li>
|
|
<p><code>ne_ssl_ca_cert_pem</code></p>
|
|
</li><li>
|
|
<p><code>ne_ssl_cert_pem</code></p>
|
|
</li><li>
|
|
<p><code>ne_ssl_privatekey_pem</code></p>
|
|
</li></ul>
|
|
|
|
<p>via Hiera (if you use it) or ENC. At the ENC need to add confdroid_nrpe::params and set those values.</p>
|
|
|
|
<h2 id="label-SELINUX">SELINUX</h2>
|
|
|
|
<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.</p>
|
|
|
|
<h2 id="label-Known+Problems">Known Problems</h2>
|
|
|
|
<h2 id="label-Troubleshooting">Troubleshooting</h2>
|
|
<ul><li>
|
|
<p><code>CHECK_NRPE: Unable to read output</code>: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through <code>$ne_allow_sudo</code> and <code>$ne_include_selinux</code>.</p>
|
|
</li><li>
|
|
<p><code>CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected)</code>: This is down to the new illegal meta characters feature via <code>nasty_metachars</code>, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character.</p>
|
|
</li></ul>
|
|
|
|
<h2 id="label-Support">Support</h2>
|
|
<ul><li>
|
|
<p>OS: Rocky 9</p>
|
|
</li><li>
|
|
<p>Puppet 8</p>
|
|
</li></ul>
|
|
|
|
<h2 id="label-Tests">Tests</h2>
|
|
<ul><li>
|
|
<p>Puppet Lint</p>
|
|
</li><li>
|
|
<p>excluded tests:</p>
|
|
<ul><li>
|
|
<p><code>--no-variable_scope-check</code>: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters.</p>
|
|
</li><li>
|
|
<p><code>--no-top_scope_facts</code>: iptables does not recognize otherwise</p>
|
|
</li></ul>
|
|
</li><li>
|
|
<p>Puppet Parser</p>
|
|
</li><li>
|
|
<p>ERB Template Parser</p>
|
|
</li><li>
|
|
<p>Sonar Quality Gate</p>
|
|
</li></ul>
|
|
|
|
<h2 id="label-Contact+Us">Contact Us</h2>
|
|
<ul><li>
|
|
<p><a href="https://confdroid.com/contact/">contact Us</a></p>
|
|
</li><li>
|
|
<p><a href="https://feedback.confdroid.com">Feedback Portal</a></p>
|
|
</li></ul>
|
|
|
|
<h2 id="label-Disclaimer">Disclaimer</h2>
|
|
|
|
<p>ConfDroid as entity is entirely independent from Puppet. We provide custom configuration modules, written for specific purposes and specific environments. The modules are tested and supported only as documented, and require testing in designated environments (i.e. lab or development environments) for parameter tuning etc. before deploying into production environments.</p>
|
|
</div></div>
|
|
|
|
<div id="footer">
|
|
Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html> |