summaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
authormh <mh@immerda.ch>2015-10-12 23:23:44 +0200
committermh <mh@immerda.ch>2015-10-12 23:23:44 +0200
commit5e92209e5b284e0f0d99c30e555cc498a39c396e (patch)
treead06f8c91e5fdb28adc6362c0041b23b181459f9 /manifests
parent4d4119d3c7b47ed34b7e014b3a9f9ff0bddda76c (diff)
introduce gpg checks
Diffstat (limited to 'manifests')
-rw-r--r--manifests/init.pp8
-rw-r--r--manifests/plugins/gpg.pp43
-rw-r--r--manifests/service/gpgkey.pp43
3 files changed, 91 insertions, 3 deletions
diff --git a/manifests/init.pp b/manifests/init.pp
index 7b747d9..e80525e 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -22,6 +22,7 @@ class nagios(
$manage_munin = false,
$service_atboot = true,
$purge_resources = true,
+ $gpgkey_checks = {},
) {
case $nagios::httpd {
'absent': { }
@@ -32,15 +33,16 @@ class nagios(
case $::operatingsystem {
'centos': {
$cfgdir = '/etc/nagios'
- include nagios::centos
+ include ::nagios::centos
}
'debian': {
$cfgdir = '/etc/nagios3'
- include nagios::debian
+ include ::nagios::debian
}
default: { fail("No such operatingsystem: ${::operatingsystem} yet defined") }
}
if $manage_munin {
- include nagios::munin
+ include ::nagios::munin
}
+ create_resources('nagios::service::gpgkey',$gpgkey_checks)
}
diff --git a/manifests/plugins/gpg.pp b/manifests/plugins/gpg.pp
new file mode 100644
index 0000000..d8c1d40
--- /dev/null
+++ b/manifests/plugins/gpg.pp
@@ -0,0 +1,43 @@
+# check_gpg from
+# https://github.com/lelutin/nagios-plugins/blob/master/check_gpg
+class nagios::plugins::gpg {
+ require ::gnupg
+ nagios::plugin{'check_gpg':
+ source => 'nagios/plugins/check_gpg',
+ }
+
+ $gpg_home = '/var/local/nagios_gpg_homedir'
+ file{
+ $gpg_home:
+ ensure => 'directory',
+ owner => nagios,
+ group => nagios,
+ mode => '0600',
+ require => Nagios::Plugin['check_gpg'];
+ '/etc/cron.daily/update_nagios_gpgkeys':
+ content => "!#/bin/bash
+function exec() {
+ cmd=\$1
+ outout=\$(su - nagios -s /bin/bash -c 'gpg --homedir ${gpg_home} --logger-fd 1 \${cmd}')
+ if [ \$? -gt 0 ]; then
+ echo \$output
+ exit 1
+ fi
+}
+
+gpg('--with-fingerprint --list-keys --with-colons') | grep \"^pub\" -A 1 | tail -n 1 | cut -f10 -d\":\" | sort --random-sort | while read key; do
+ gpg(\"--recv-keys \${key}\")
+done
+",
+ owner => root,
+ group => 0,
+ mode => '0700',
+ require => File[$gpg_home];
+ }
+ nagios_command {
+ 'check_gnupg':
+ command_line => "\$USER1\$/check_gpg --gnupg-homedir ${gpg_home} -w \$ARG1\$ \$ARG2\$",
+ require => Nagios::Plugin['check_gpg'],
+ }
+}
+
diff --git a/manifests/service/gpgkey.pp b/manifests/service/gpgkey.pp
new file mode 100644
index 0000000..0c271f4
--- /dev/null
+++ b/manifests/service/gpgkey.pp
@@ -0,0 +1,43 @@
+# define a gpgkey to be watched
+define nagios::service::gpgkey(
+ $ensure = 'present',
+ $warning = '14',
+ $key_info = undef,
+){
+ validate_slength($name,40,40)
+ require ::nagios::plugins::gpg
+ $gpg_home = $nagios::plugins::gpg::gpg_home
+
+ exec{"manage_key_${name}": }
+ nagios::service{
+ "check_gpg_${name}":
+ ensure => $ensure;
+ }
+
+ if $ensure == 'present' {
+ Exec["manage_key_${name}"]{
+ command => "gpg --homedir ${gpg_home} --recv-keys ${name}",
+ unless => "gpg --homedir ${gpg_home} --list-keys ${name}",
+ before => Nagios::Service["check_gpg_${name}"],
+ }
+
+ Nagios::Service["check_gpg_${name}"]{
+ check_command => "check_gpg!${warning}!${name}",
+ }
+ if $key_info {
+ Nagios::Service["check_gpg_${name}"]{
+ service_description => "Keyfingerprint: ${name} - Info: ${key_info}",
+ }
+ } else {
+ Nagios::Service["check_gpg_${name}"]{
+ service_description => "Keyfingerprint: ${name}",
+ }
+ }
+ } else {
+ Exec["manage_key_${name}"]{
+ command => "gpg --batch --homedir ${gpg_home} --delete-key ${name}",
+ onlyif => "gpg --homedir ${gpg_home} --list-keys ${name}",
+ require => Nagios::Service["check_gpg_${name}"],
+ }
+ }
+}