From 6e2a5993ce470341bed0e0c6ba8e44de3712d50e Mon Sep 17 00:00:00 2001 From: Cullum Smith Date: Sat, 26 Oct 2024 00:07:03 -0400 Subject: more icinga stuff --- files/etc/login.access.freebsd | 1 + .../etc/dovecot/conf.d/10-master.conf.imap_server | 1 - .../etc/icinga2/conf.d/commands.conf.icinga_server | 207 ++++++++++++-- .../icinga2/conf.d/downtimes.conf.icinga_server | 1 + .../etc/icinga2/conf.d/hosts.conf.icinga_server | 106 +++++++- .../conf.d/notifications.conf.icinga_server | 38 ++- .../etc/icinga2/conf.d/services.conf.icinga_server | 296 ++++++++++++++++----- .../icinga2/conf.d/templates.conf.icinga_server | 35 +-- .../etc/icinga2/conf.d/users.conf.icinga_server | 13 +- .../local/etc/icinga2/constants.conf.icinga_server | 8 +- .../local/etc/icingaweb2/roles.ini.icinga_server | 4 +- files/usr/local/etc/postfix/main.cf.smtp_server | 1 - .../local/etc/poudriere.d/make.conf.pkg_repository | 1 + .../local/etc/poudriere.d/pkglist.pkg_repository | 1 + .../usr/local/etc/raddb/clients.conf.radius_server | 16 ++ .../etc/raddb/mods-available/eap.radius_server | 8 + .../etc/raddb/mods-available/ldap.radius_server | 107 ++++++++ .../sites-available/inner-tunnel.radius_server | 90 +++++++ .../local/libexec/nagios/check_eapol.icinga_server | 56 ++++ files/var/spool/icinga2/.ssh/config.icinga_server | 16 ++ files/var/spool/icinga2/eap-tls.conf.icinga_server | 9 + .../spool/icinga2/eap-ttls-pap.conf.icinga_server | 9 + 22 files changed, 860 insertions(+), 164 deletions(-) create mode 100644 files/usr/local/etc/raddb/clients.conf.radius_server create mode 100644 files/usr/local/etc/raddb/mods-available/ldap.radius_server create mode 100644 files/usr/local/etc/raddb/sites-available/inner-tunnel.radius_server create mode 100644 files/usr/local/libexec/nagios/check_eapol.icinga_server create mode 100644 files/var/spool/icinga2/.ssh/config.icinga_server create mode 100644 files/var/spool/icinga2/eap-tls.conf.icinga_server create mode 100644 files/var/spool/icinga2/eap-ttls-pap.conf.icinga_server (limited to 'files') diff --git a/files/etc/login.access.freebsd b/files/etc/login.access.freebsd index e6667db..c2d6fc1 100644 --- a/files/etc/login.access.freebsd +++ b/files/etc/login.access.freebsd @@ -1,5 +1,6 @@ # Always allow root logins. +:root:ALL ++:${icinga_local_user}:ALL $(if [ -n "${login_access_groups:-}" ] || [ -n "${login_access_users:-}" ]; then printf -- '-:ALL EXCEPT ' diff --git a/files/usr/local/etc/dovecot/conf.d/10-master.conf.imap_server b/files/usr/local/etc/dovecot/conf.d/10-master.conf.imap_server index 1445cb6..4aeed76 100644 --- a/files/usr/local/etc/dovecot/conf.d/10-master.conf.imap_server +++ b/files/usr/local/etc/dovecot/conf.d/10-master.conf.imap_server @@ -13,7 +13,6 @@ service lmtp { user = ${dovecot_vmail_user} inet_listener lmtp { port = ${lmtp_port} - ssl = yes } } diff --git a/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server index dd78f14..f8017ec 100644 --- a/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server @@ -1,40 +1,189 @@ object NotificationCommand "mail-host-notification" { command = [ ConfigDir + "/scripts/mail-host-notification.sh" ] - env = { - NOTIFICATIONTYPE = "$notification.type$" - HOSTDISPLAYNAME = "$host.display_name$" - HOSTNAME = "$host.name$" - HOSTADDRESS = "$address$" - HOSTSTATE = "$host.state$" - LONGDATETIME = "$icinga.long_date_time$" - HOSTOUTPUT = "$host.output$" - NOTIFICATIONAUTHORNAME = "$notification.author$" - NOTIFICATIONCOMMENT = "$notification.comment$" - HOSTDISPLAYNAME = "$host.display_name$" - USEREMAIL = "$user.email$" - HOSTNOTES = "$host.notes$" + arguments += { + "-4" = "$notification_address$" + "-6" = "$notification_address6$" + "-b" = "$notification_author$" + "-c" = "$notification_comment$" + "-d" = { + required = true + value = "$notification_date$" + } + "-f" = { + value = "$notification_from$" + description = "Set from address. Requires GNU mailutils (Debian/Ubuntu) or mailx (RHEL/SUSE)" + } + "-i" = "$notification_icingaweb2url$" + "-l" = { + required = true + value = "$notification_hostname$" + } + "-n" = { + required = true + value = "$notification_hostdisplayname$" + } + "-o" = { + required = true + value = "$notification_hostoutput$" + } + "-r" = { + required = true + value = "$notification_useremail$" + } + "-s" = { + required = true + value = "$notification_hoststate$" + } + "-X" = "$notification_hostnotes$" + "-t" = { + required = true + value = "$notification_type$" + } + "-v" = "$notification_logtosyslog$" + } + + vars += { + notification_address = "$address$" + notification_address6 = "$address6$" + notification_author = "$notification.author$" + notification_comment = "$notification.comment$" + notification_type = "$notification.type$" + notification_date = "$icinga.long_date_time$" + notification_hostname = "$host.name$" + notification_hostdisplayname = "$host.display_name$" + notification_hostoutput = "$host.output$" + notification_hoststate = "$host.state$" + notification_useremail = "$user.email$" + notification_hostnotes = "$host.notes$" } } object NotificationCommand "mail-service-notification" { command = [ ConfigDir + "/scripts/mail-service-notification.sh" ] - env = { - NOTIFICATIONTYPE = "$notification.type$" - SERVICENAME = "$service.name$" - HOSTNAME = "$host.name$" - HOSTDISPLAYNAME = "$host.display_name$" - HOSTADDRESS = "$address$" - SERVICESTATE = "$service.state$" - LONGDATETIME = "$icinga.long_date_time$" - SERVICEOUTPUT = "$service.output$" - NOTIFICATIONAUTHORNAME = "$notification.author$" - NOTIFICATIONCOMMENT = "$notification.comment$" - HOSTDISPLAYNAME = "$host.display_name$" - SERVICEDISPLAYNAME = "$service.display_name$" - USEREMAIL = "$user.email$" - HOSTNOTES = "$host.notes$" - SERVICENOTES = "$service.notes$" + arguments += { + "-4" = "$notification_address$" + "-6" = "$notification_address6$" + "-b" = "$notification_author$" + "-c" = "$notification_comment$" + "-d" = { + required = true + value = "$notification_date$" + } + "-e" = { + required = true + value = "$notification_servicename$" + } + "-f" = { + value = "$notification_from$" + description = "Set from address. Requires GNU mailutils (Debian/Ubuntu) or mailx (RHEL/SUSE)" + } + "-i" = "$notification_icingaweb2url$" + "-l" = { + required = true + value = "$notification_hostname$" + } + "-n" = { + required = true + value = "$notification_hostdisplayname$" + } + "-o" = { + required = true + value = "$notification_serviceoutput$" + } + "-r" = { + required = true + value = "$notification_useremail$" + } + "-s" = { + required = true + value = "$notification_servicestate$" + } + "-t" = { + required = true + value = "$notification_type$" + } + "-X" = "$notification_hostnotes$" + "-x" = "$notification_servicenotes$" + "-u" = { + required = true + value = "$notification_servicedisplayname$" + } + "-v" = "$notification_logtosyslog$" + } + + vars += { + notification_address = "$address$" + notification_address6 = "$address6$" + notification_author = "$notification.author$" + notification_comment = "$notification.comment$" + notification_type = "$notification.type$" + notification_date = "$icinga.long_date_time$" + notification_hostname = "$host.name$" + notification_hostdisplayname = "$host.display_name$" + notification_servicename = "$service.name$" + notification_serviceoutput = "$service.output$" + notification_servicestate = "$service.state$" + notification_useremail = "$user.email$" + notification_servicedisplayname = "$service.display_name$" + notification_hostnotes = "$host.notes$" + notification_servicenotes = "$service.notes$" + } +} + +object CheckCommand "eapol" { + command = [ PluginDir + "/check_eapol" ] + arguments = { + "-c" = { + value = "$eapol_config_file$" + required = true + description = "Path to wpa_supplicant config file" + } + "-a" = { + value = "$eapol_address$" + required = true + description = "IP address of the RADIUS server" + } + "-p" = { + value = "$eapol_port$" + required = true + description = "Port of the RADIUS server" + } + "-s" = { + value = "$eapol_secret$" + required = true + description = "Shared secret with the RADIUS server" + } + "-t" = { + value = "$eapol_timeout$" + description = "Timeout in seconds" + } + "-d" = { + set_if = "$eapol_debug$" + description = "Enable debugging output" + } } + + vars.eapol_timeout = 5 + vars.eapol_port = 1812 + vars.eapol_address = "$host.address$" + vars.eapol_debug = false +} + +object CheckCommand "smtp2" { + import "smtp" + arguments += { + "-L" = { + set_if = "$smtp_lmtp$" + description = "Send LHLO instead of HELO/EHLO" + } + } +} + +object CheckCommand "mailq_by_ssh" { + import "mailq" + import "by_ssh" + vars.by_ssh_command = {{ get_check_command("mailq").command }} + vars.by_ssh_arguments = {{ get_check_command("mailq").arguments }} } diff --git a/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server index e69de29..49a9912 100644 --- a/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server @@ -0,0 +1 @@ +// No downtimes diff --git a/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server index dbc2a54..65a3d6d 100644 --- a/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server @@ -1,3 +1,103 @@ -/* - * Add custom hosts here. - */ +// TODO: we can generate this from LDAP. + +object Host "icinga1" { + address = "icinga1.${domain}" + check_command = "dummy" + vars.os = "FreeBSD" +} + +object Host "idm1" { + address = "idm1.${domain}" + vars.os = "FreeBSD" +} + +object Host "idm2" { + address = "idm2.${domain}" + vars.os = "FreeBSD" +} + +object Host "pkg1" { + address = "pkg1.${domain}" + vars.os = "FreeBSD" +} + +object Host "smtp1" { + address = "smtp1.${domain}" + vars.os = "FreeBSD" +} + +object Host "imap1" { + address = "imap1.${domain}" + vars.os = "FreeBSD" +} + +object Host "postgres1" { + address = "postgres1.${domain}" + vars.os = "FreeBSD" +} + +object Host "turn1" { + address = "turn1.${domain}" + vars.os = "FreeBSD" +} + +object Host "xmpp1" { + address = "xmpp1.${domain}" + vars.os = "FreeBSD" +} + +object Host "www1" { + address = "www1.${domain}" + vars.os = "FreeBSD" +} + +object Host "dav1" { + address = "dav1.${domain}" + vars.os = "FreeBSD" +} + +object Host "ttrss1" { + address = "ttrss1.${domain}" + vars.os = "FreeBSD" +} + +object Host "bitwarden1" { + address = "bitwarden1.${domain}" + vars.os = "FreeBSD" +} + +object Host "znc1" { + address = "znc1.${domain}" + vars.os = "FreeBSD" +} + +object Host "cups1" { + address = "cups1.${domain}" + vars.os = "FreeBSD" +} + +object Host "invidious1" { + address = "invidious1.${domain}" + vars.os = "FreeBSD" +} + +object Host "radius1" { + // We must use the raw IP address because eapol_test does not resolve hostnames. + address = "$(host "radius1.${domain}" | awk '{print $NF}')" + vars.os = "FreeBSD" +} + +object Host "unifi1" { + address = "unifi1.${domain}" + vars.os = "FreeBSD" +} + +object Host "nfs1" { + address = "nfs1.${domain}" + vars.os = "FreeBSD" +} + +object Host "desktop1" { + address = "desktop1.${domain}" + vars.os = "FreeBSD" +} diff --git a/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server index effff9e..4f581cc 100644 --- a/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server @@ -1,23 +1,33 @@ -apply Notification "mail-icingaadmin" to Host { - import "mail-host-notification" - user_groups = host.vars.notification.mail.groups - users = host.vars.notification.mail.users +apply Notification "email" to Host { + command = "mail-host-notification" - //interval = 2h + states = [ Up, Down ] + types = [ Problem, Acknowledgement, Recovery, Custom, + FlappingStart, FlappingEnd, + DowntimeStart, DowntimeEnd, DowntimeRemoved ] - //vars.notification_logtosyslog = true + users = [ "sysadmins" ] - assign where host.vars.notification.mail + vars += { + notification_icingaweb2url = "https://${icinga_fqdn}" + } + + assign where true } -apply Notification "mail-icingaadmin" to Service { - import "mail-service-notification" - user_groups = host.vars.notification.mail.groups - users = host.vars.notification.mail.users +apply Notification "email" to Service { + command = "mail-service-notification" + + states = [ OK, Warning, Critical, Unknown ] + types = [ Problem, Acknowledgement, Recovery, Custom, + FlappingStart, FlappingEnd, + DowntimeStart, DowntimeEnd, DowntimeRemoved ] - //interval = 2h + users = [ "sysadmins" ] - //vars.notification_logtosyslog = true + vars += { + notification_icingaweb2url = "https://${icinga_fqdn}" + } - assign where host.vars.notification.mail + assign where true } diff --git a/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server index 5b00864..8d0433f 100644 --- a/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server @@ -1,165 +1,331 @@ +apply Service "icinga" { + check_command = "icinga" + assign where host.name == NodeName +} + +apply Service "icingadb" { + check_command = "icingadb" + assign where host.name == NodeName +} + apply Service "ssh" { - import "generic-service" check_command = "ssh" - assign where host.vars.os in ["FreeBSD","Linux"] + assign where host.vars.os in ["FreeBSD"," Linux"] } -apply Service "icinga" { - import "generic-service" - check_command = "icinga" +apply Service "upstream-packet-loss" { + check_command = "ping" + display_name = "upstream packet loss" + vars.ping_address = "${icinga_upstream_ping_address}" + vars.ping_wpl = ${icinga_upstream_packet_loss_warn} + vars.ping_cpl = ${icinga_upstream_packet_loss_crit} + vars.ping_wrta = ${icinga_upstream_latency_warn} + vars.ping_crta = ${icinga_upstream_latency_crit} + vars.ping_packets = ${icinga_upstream_packet_count} assign where host.name == NodeName } apply Service "dns" { - import "generic-service" check_command = "dns" - vars.dns_lookup = "$address$" - vars.dns_server = "$address$" - vars.dns_wtime = ResponseTimeWarn - vars.dns_ctime = ResponseTimeCrit + vars.dns_lookup = "\$address\$" + vars.dns_server = "\$address\$" + vars.dns_wtime = ${icinga_response_time_warn} + vars.dns_ctime = ${icinga_response_time_crit} + assign where "idm-servers" in host.groups +} + +apply Service "resolver" { + check_command = "dns" + vars.dns_lookup = "www.google.com" + vars.dns_server = "\$address\$" + vars.dns_wtime = ${icinga_response_time_warn} + vars.dns_ctime = ${icinga_response_time_crit} assign where "idm-servers" in host.groups } apply Service "ldap" { - import "generic-service" check_command = "ldap" vars.ldap_port = 389 - vars.ldap_warning = ResponseTimeWarn - vars.ldap_critical = ResponseTimeCrit + vars.ldap_warning = ${icinga_response_time_warn} + vars.ldap_critical = ${icinga_response_time_crit} vars.ldap_v2 = false vars.ldap_v3 = true vars.ldap_starttls = true - vars.ldap_bind = IcingaDN + vars.ldap_bind = "${icinga_dn}" vars.ldap_pass = IcingaPassword - vars.ldap_base = HostsBaseDn + vars.ldap_base = "${hosts_basedn}" vars.ldap_attr = "(cn=" + NodeName + ")" assign where "idm-servers" in host.groups } apply Service "ldaps" { - import "generic-service" check_command = "ldap" vars.ldap_port = 636 - vars.ldap_warning = ResponseTimeWarn - vars.ldap_critical = ResponseTimeCrit + vars.ldap_warning = ${icinga_response_time_warn} + vars.ldap_critical = ${icinga_response_time_crit} vars.ldap_v2 = false vars.ldap_v3 = true vars.ldap_ssl = true - vars.ldap_bind = IcingaDN + vars.ldap_bind = "${icinga_dn}" vars.ldap_pass = IcingaPassword - vars.ldap_base = HostsBaseDn + vars.ldap_base = "${hosts_basedn}" vars.ldap_attr = "(cn=" + NodeName + ")" assign where "idm-servers" in host.groups } apply Service "imap" { - import "generic-service" check_command = "imap" vars.imap_port = 993 vars.imap_ssl = true - vars.imap_certificate_age = CertDaysWarn - vars.imap_warning = ResponseTimeWarn - vars.imap_critical = ResponseTimeCrit + vars.imap_certificate_age = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} + vars.imap_warning = ${icinga_response_time_warn} + vars.imap_critical = ${icinga_response_time_crit} + assign where "imap-servers" in host.groups +} + +apply Service "lmtp" { + check_command = "smtp2" + vars.smtp_port = 25 + vars.smtp_starttls = true + vars.smtp_lmtp = true + vars.smtp_mail_from = "${icinga_smtp_mail_from}" + vars.smtp_command = "RCPT TO:<" + "${icinga_lmtp_rcpt_to}" + ">" + vars.smtp_response = "250 2.1.5 OK" + assign where "imap-servers" in host.groups +} + +apply Service "lmtp-cert" { + display_name = "lmtp certificate" + check_command = "smtp2" + vars.smtp_lmtp = true + vars.smtp_port = 25 + vars.smtp_certificate_age = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} + vars.smtp_starttls = true assign where "imap-servers" in host.groups } apply Service "smtp" { - import "generic-service" check_command = "smtp" vars.smtp_port = 25 - vars.smtp_certificate_age = CertDaysWarn vars.smtp_starttls = true - vars.smtp_warning = ResponseTimeWarn - vars.smtp_critical = ResponseTimeCrit + vars.smtp_warning = ${icinga_response_time_warn} + vars.smtp_critical = ${icinga_response_time_crit} + vars.smtp_mail_from = "${icinga_smtp_mail_from}" + vars.smtp_command = "RCPT TO:<" + "${icinga_smtp_rcpt_to}" + ">" + vars.smtp_response = "250 2.1.5 Ok" + assign where "smtp-servers" in host.groups +} + +apply Service "smtp-cert" { + display_name = "smtp certificate" + check_command = "smtp" + vars.smtp_port = 25 + vars.smtp_certificate_age = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} + vars.smtp_starttls = true assign where "smtp-servers" in host.groups } + apply Service "submission" { - import "generic-service" check_command = "smtp" vars.smtp_port = 587 - vars.smtp_certificate_age = CertDaysWarn + vars.smtp_certificate_age = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} vars.smtp_starttls = true - vars.smtp_warning = ResponseTimeWarn - vars.smtp_critical = ResponseTimeCrit + vars.smtp_warning = ${icinga_response_time_warn} + vars.smtp_critical = ${icinga_response_time_crit} + assign where "smtp-servers" in host.groups +} + +apply Service "mailq" { + check_command = "mailq_by_ssh" + vars.mailq_servertype = "postfix" + vars.mailq_warning = ${icinga_mailq_warn} + vars.mailq_critical = ${icinga_mailq_crit} assign where "smtp-servers" in host.groups } apply Service "postgres" { - import "generic-service" check_command = "pgsql" - vars.pgsql_warning = ResponseTimeWarn - vars.pgsql_critical = ResponseTimeCrit - vars.pgsql_username = IcingaUsername + vars.pgsql_warning = ${icinga_response_time_warn} + vars.pgsql_critical = ${icinga_response_time_crit} + vars.pgsql_username = "${icinga_username}" vars.pgsql_password = IcingaPassword + vars.pgsql_options = ["sslmode=verify-full", "sslrootcert=system"] assign where "postgresql-servers" in host.groups } +apply Service "eap-cert" { + check_command = "eapol" + vars.eapol_secret = IcingaRadiusSecret + vars.eapol_config_file = "${icinga_home_dir}/eap-tls.conf" + assign where "radius-servers" in host.groups +} + +apply Service "eap-ttls-pap" { + check_command = "eapol" + vars.eapol_secret = IcingaRadiusSecret + vars.eapol_config_file = "${icinga_home_dir}/eap-ttls-pap.conf" + assign where "radius-servers" in host.groups +} + +apply Service "irc" { + check_command = "tcp" + vars.tcp_port = 6697 + vars.tcp_ssl = true + vars.tcp_certificate = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} + vars.tcp_wtime = ${icinga_response_time_warn} + vars.tcp_ctime = ${icinga_response_time_crit} + assign where "znc-servers" in host.groups +} + +apply Service "turn" { + check_command = "tcp" + vars.tcp_port = 3478 + vars.tcp_wtime = ${icinga_response_time_warn} + vars.tcp_ctime = ${icinga_response_time_crit} + assign where "turn-servers" in host.groups +} + +apply Service "cups" { + check_command = "http" + display_name = "cups status" + vars.http_vhost = "\$address\$" + vars.http_port = 631 + vars.http_expect = "HTTP/1.1 200 OK" + vars.http_ssl = true + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("cups-servers" in host.groups) +} + +apply Service "cups-cert" { + check_command = "http" + display_name = "cups certificate" + vars.http_vhost = "\$address\$" + vars.http_port = 631 + vars.http_ssl = true + vars.http_certificate = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} + assign where ("cups-servers" in host.groups) +} + // Expect HTTP 200 apply Service "http" { - import "generic-service" check_command = "http" - vars.http_vhost = "$address$" + display_name = "http status" + vars.http_vhost = "\$address\$" vars.http_expect = "HTTP/1.1 200 OK" vars.http_ssl = false - vars.http_warn_time = ResponseTimeWarn - vars.http_critical_time = ResponseTimeCrit - assign where ("cups-servers" in host.groups - || "pkg-repositories" in host.groups) + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("pkg-repositories" in host.groups) } // Expect HTTP 301 apply Service "http" { - import "generic-service" check_command = "http" - vars.http_vhost = "$address$" + display_name = "http status" + vars.http_vhost = "\$address\$" vars.http_expect = "HTTP/1.1 301 Moved Permanently" vars.http_ssl = false - vars.http_warn_time = ResponseTimeWarn - vars.http_critical_time = ResponseTimeCrit + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} assign where ("dav-servers" in host.groups || "smtp-servers" in host.groups || "ttrss-servers" in host.groups || "invidious-servers" in host.groups || "nfs-servers" in host.groups - || "pkg-servers" in host.groups - || "unifi-controllers" in host.groups || "web-servers" in host.groups || "xmpp-servers" in host.groups - || "znc-servers" in host.groups) + || "znc-servers" in host.groups + || "icinga-servers" in host.groups + || "bitwarden-servers" in host.groups) +} + +// Expect HTTP 302 +apply Service "http" { + check_command = "http" + display_name = "http status" + vars.http_vhost = "\$address\$" + vars.http_expect = "HTTP/1.1 302" + vars.http_ssl = false + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("unifi-controllers" in host.groups) } // Expect HTTPS 401 apply Service "https" { - import "generic-service" check_command = "http" - vars.http_vhost = "$address$" + display_name = "https status" + vars.http_vhost = "\$address\$" vars.http_expect = "HTTP/1.1 401 Unauthorized" vars.http_ssl = true - vars.http_certificate = CertDaysWarn + "," + CertDaysCrit - vars.http_warn_time = ResponseTimeWarn - vars.http_critical_time = ResponseTimeCrit - assign where ("dav-servers" in host.groups - || "cups-servers" in host.groups - || "smtp-servers" in host.groups - || "ttrss-servers" in host.groups) + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("dav-servers" in host.groups + || "smtp-servers" in host.groups + || "icinga-servers" in host.groups + || "ttrss-servers" in host.groups) } // Expect HTTPS 200 apply Service "https" { - import "generic-service" check_command = "http" - vars.http_vhost = "$address$" + display_name = "https status" + vars.http_vhost = "\$address\$" vars.http_expect = "HTTP/1.1 200 OK" vars.http_ssl = true - vars.http_certificate = CertDaysWarn + "," + CertDaysCrit - vars.http_warn_time = ResponseTimeWarn - vars.http_critical_time = ResponseTimeCrit + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("pkg-repositories" in host.groups + || "web-servers" in host.groups + || "xmpp-servers" in host.groups + || "znc-servers" in host.groups + || "bitwarden-servers" in host.groups) +} + +// Expect HTTPS 404 +apply Service "https" { + check_command = "http" + display_name = "https status" + vars.http_vhost = "\$address\$" + vars.http_expect = "HTTP/1.1 404 Not Found" + vars.http_ssl = true + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("nfs-servers" in host.groups) +} + +// Expect HTTPS 302 +apply Service "https" { + check_command = "http" + display_name = "https status" + vars.http_vhost = "\$address\$" + vars.http_expect = "HTTP/1.1 302" + vars.http_ssl = true + vars.http_warn_time = ${icinga_response_time_warn} + vars.http_critical_time = ${icinga_response_time_crit} + assign where ("unifi-controllers" in host.groups + || "invidious-servers" in host.groups) +} + +// Certificate validity +apply Service "https-cert" { + check_command = "http" + display_name = "https certificate" + vars.http_vhost = "\$address\$" + vars.http_ssl = true + vars.http_certificate = ${icinga_cert_days_warn} + "," + ${icinga_cert_days_crit} assign where ("invidious-servers" in host.groups || "nfs-servers" in host.groups - || "pkg-servers" in host.groups + || "pkg-repositories" in host.groups || "unifi-controllers" in host.groups || "web-servers" in host.groups || "xmpp-servers" in host.groups - || "znc-servers" in host.groups) + || "znc-servers" in host.groups + || "bitwarden-servers" in host.groups + || "dav-servers" in host.groups + || "smtp-servers" in host.groups + || "icinga-servers" in host.groups + || "ttrss-servers" in host.groups) } diff --git a/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server index 1aae5ac..0ebe46e 100644 --- a/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server @@ -12,39 +12,10 @@ template Service "generic-service" default { } template User "generic-user" default { - -} - -template Notification "mail-host-notification" { - command = "mail-host-notification" - - states = [ Up, Down ] - types = [ Problem, Acknowledgement, Recovery, Custom, - FlappingStart, FlappingEnd, - DowntimeStart, DowntimeEnd, DowntimeRemoved ] - - vars += { - // notification_icingaweb2url = "https://www.example.com/icingaweb2" - // notification_from = "Icinga 2 Host Monitoring " - notification_logtosyslog = false - } - - period = "24x7" } -template Notification "mail-service-notification" { - command = "mail-service-notification" - - states = [ OK, Warning, Critical, Unknown ] - types = [ Problem, Acknowledgement, Recovery, Custom, - FlappingStart, FlappingEnd, - DowntimeStart, DowntimeEnd, DowntimeRemoved ] - - vars += { - // notification_icingaweb2url = "https://www.example.com/icingaweb2" - // notification_from = "Icinga 2 Service Monitoring " - notification_logtosyslog = false - } - +template Notification "generic-notification" default { + // Don't repeat notifications. + interval = 0 period = "24x7" } diff --git a/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server index 1ddaf55..5d3f19d 100644 --- a/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server +++ b/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server @@ -1,12 +1,5 @@ -object User "icingaadmin" { +object User "sysadmins" { import "generic-user" - - display_name = "Icinga 2 Admin" - groups = [ "icingaadmins" ] - - email = "icinga@localhost" -} - -object UserGroup "icingaadmins" { - display_name = "Icinga 2 Admin Group" + display_name = "System Administrators" + email = "${icinga_notification_mail_to}" } diff --git a/files/usr/local/etc/icinga2/constants.conf.icinga_server b/files/usr/local/etc/icinga2/constants.conf.icinga_server index 592da99..dea4160 100644 --- a/files/usr/local/etc/icinga2/constants.conf.icinga_server +++ b/files/usr/local/etc/icinga2/constants.conf.icinga_server @@ -4,11 +4,5 @@ const PluginContribDir = "/usr/local/libexec/nagios" const NodeName = "${BOXCONF_HOSTNAME}" const ZoneName = NodeName const TicketSalt = "${icinga_ticket_salt}" -const CertDaysWarn = 30 -const CertDaysCrit = 20 -const ResponseTimeWarn = 0.5 -const ResponseTimeCrit = 1 -const HostsBaseDn = "${hosts_basedn}" -const IcingaUsername = "${icinga_username}" const IcingaPassword = "${icinga_password}" -const IcingaDN = "${icinga_dn}" +const IcingaRadiusSecret = "${icinga_radius_secret}" diff --git a/files/usr/local/etc/icingaweb2/roles.ini.icinga_server b/files/usr/local/etc/icingaweb2/roles.ini.icinga_server index 2511267..d67a664 100644 --- a/files/usr/local/etc/icingaweb2/roles.ini.icinga_server +++ b/files/usr/local/etc/icingaweb2/roles.ini.icinga_server @@ -5,9 +5,9 @@ groups = "$(join ',' $icingaweb_admin_groups)" EOF fi) permissions = "*" -icingadb/denylist/variables = "*priv*,*auth*,*key*,*pass*,*token*" +icingadb/denylist/variables = "*priv*,*auth*,*key*,*pass*,*token*,*secret*" [Users] groups = "${icingaweb_access_role}" permissions = "module/icingadb" -icingadb/denylist/variables = "*priv*,*auth*,*key*,*pass*,*token*" +icingadb/denylist/variables = "*priv*,*auth*,*key*,*pass*,*token*,*secret*" diff --git a/files/usr/local/etc/postfix/main.cf.smtp_server b/files/usr/local/etc/postfix/main.cf.smtp_server index 802568f..1f42202 100644 --- a/files/usr/local/etc/postfix/main.cf.smtp_server +++ b/files/usr/local/etc/postfix/main.cf.smtp_server @@ -74,7 +74,6 @@ smtp_tls_loglevel = 1 lmtp_tls_CApath = ${system_cacert_path} lmtp_tls_security_level = encrypt -lmtp_tls_wrappermode = yes lmtp_tls_session_cache_database = btree:\$data_directory/lmtp_scache smtp_tls_loglevel = 1 diff --git a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository index 1d3a308..3a80736 100644 --- a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository +++ b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository @@ -81,6 +81,7 @@ security_pinentry-qt5_SET=LIBSECRET security_sudo_SET=LDAP security_sudo_UNSET=GSSAPI_MIT security_vaultwarden_SET=PGSQL +security_wpa_supplicant_SET=EAPOL_TEST shells_bash_UNSET=PORTS_READLINE sysutils_htop_SET=LSOF sysutils_k3b_UNSET=EMOVIX VCDIMAGER diff --git a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository index 1f11a33..8542c20 100644 --- a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository +++ b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository @@ -114,6 +114,7 @@ security/py-omemo-dr security/sshpass security/sudo security/vaultwarden +security/wpa_supplicant sysutils/cpu-microcode sysutils/htop sysutils/k3b diff --git a/files/usr/local/etc/raddb/clients.conf.radius_server b/files/usr/local/etc/raddb/clients.conf.radius_server new file mode 100644 index 0000000..033b059 --- /dev/null +++ b/files/usr/local/etc/raddb/clients.conf.radius_server @@ -0,0 +1,16 @@ +client icinga { + ipaddr = ${icinga_radius_cidr} + secret = ${icinga_radius_secret} +} + +$(for client_name in $radius_clients; do + eval "client_address=\$radius_${client_name}_address" + eval "client_secret=\$radius_${client_name}_secret" + cat <&2 + exit "$UNKNOWN" +} + +port=1812 +timeout=5 +debug=false + +while getopts :a:c:dp:s:t: opt; do + case $opt in + a) address=$OPTARG ;; + c) config=$OPTARG ;; + d) debug=true ;; + p) port=$OPTARG ;; + s) secret=$OPTARG ;; + t) timeout=$OPTARG ;; + :|?) usage ;; + esac +done +shift $((OPTIND - 1 )) + +[ $# -eq 0 ] || usage +[ -r "$config" ] || die "config file not readable: ${config}" +if [ -z "$address" ] || [ -z "$config" ] || [ -z "$secret" ]; then + usage +fi + +if [ "$debug" = true ]; then + eapol_test -c "$config" -a "$address" -p "$port" -s "$secret" -t "$timeout" +else + eapol_test -c "$config" -a "$address" -p "$port" -s "$secret" -t "$timeout" > /dev/null +fi + +if [ $? -eq 0 ]; then + echo "authentication to ${address}:${port} using ${config} succeeded" + exit "$OK" +else + echo "authentication to ${address}:${port} using ${config} failed" + exit "$CRIT" +fi diff --git a/files/var/spool/icinga2/.ssh/config.icinga_server b/files/var/spool/icinga2/.ssh/config.icinga_server new file mode 100644 index 0000000..8d02483 --- /dev/null +++ b/files/var/spool/icinga2/.ssh/config.icinga_server @@ -0,0 +1,16 @@ +PubkeyAuthentication yes +PasswordAuthentication no +GSSAPIAuthentication no +GSSAPIDelegateCredentials no +KbdInteractiveAuthentication no +PreferredAuthentications publickey +CanonicalizeHostname no +IdentitiesOnly yes +IdentityFile ~/.ssh/id_ed25519 +StrictHostKeyChecking no +UserKnownHostsFile /dev/null +KnownHostsCommand none +LogLevel ERROR +ControlMaster auto +ControlPersist 10m +ControlPath ~/.ssh/sockets/%r@%h:%p diff --git a/files/var/spool/icinga2/eap-tls.conf.icinga_server b/files/var/spool/icinga2/eap-tls.conf.icinga_server new file mode 100644 index 0000000..f90ef96 --- /dev/null +++ b/files/var/spool/icinga2/eap-tls.conf.icinga_server @@ -0,0 +1,9 @@ +network={ + ssid="_" + key_mgmt=WPA-EAP + eap=TLS + identity="${icinga_username}" + ca_cert="${site_cacert_path}" + client_cert="${icinga_tls_client_cert}" + private_key="${icinga_tls_client_key}" +} diff --git a/files/var/spool/icinga2/eap-ttls-pap.conf.icinga_server b/files/var/spool/icinga2/eap-ttls-pap.conf.icinga_server new file mode 100644 index 0000000..2579284 --- /dev/null +++ b/files/var/spool/icinga2/eap-ttls-pap.conf.icinga_server @@ -0,0 +1,9 @@ +network={ + ssid="_" + key_mgmt=WPA-EAP + eap=TTLS + identity="${icinga_username}" + password="${icinga_password}" + phase2="auth=PAP" + ca_cert="${site_cacert_path}" +} -- cgit v1.2.3