NRPE Module for Puppet

Table of Contents

1. Module Description - What the module does and why it is useful
2. Setup - The basics of getting started with this module
3. Usage - Configuration options and additional functionality
4. Reference - Puppet Strings based reference documentation
5. Limitations - OS compatibility, etc.
6. Development - Guide for contributing to the module

Module Description

NRPE (Nagios Remote Plugin Executor) allows you to remotely execute Nagios plugins on other Linux/Unix machines. This allows you to monitor remote machine metrics (disk usage, CPU load, etc.). This puppet module manages the installation and configuration of NRPE. It can install NRPE plugins and setup NRPE commands. Secure communication to NRPE using SSL is also supported.

Setup

The nrpe class installs the packages and configures the daemon. By default, it will only configure the daemon to listen on localhost. To allow connections from your nagios server, specify the allowed_hosts parameter when declaring the class.

class { 'nrpe':
  allowed_hosts => ['127.0.0.1', 'nagios.example.org'],
}

Usage

nrpe

No NRPE commands are configured by default. To make the configuration useful, at a minimum, declare some nrpe::command resources. To purge unmanaged NRPE commands:

class { 'nrpe':
  allowed_hosts => ['127.0.0.1'],
  purge         => true,
  recurse       => true,
}

Full documentation for the nrpe class is available in the reference documentation.

nrpe::command

This define can be used to add NRPE commands to the include directory for NRPE.

nrpe::command { 'check_users':
  ensure  => present,
  command => 'check_users -w 5 -c 10',
}

It is also possible to use hiera data to create these resources by using the base class commands parameter.

nrpe::commands:
  check_users:
    ensure: present
    command: 'check_users -w 5 -c 10'

Full documentation for the nrpe::command type is available in the reference documentation.

nrpe::plugin

This define can be used to install NRPE plugins.

nrpe::plugin { 'check_mem':
  ensure => present,
  source => 'puppet:///files/check_mem',
}

It is also possible to use hiera data to create these resources by using the base class plugins parameter.

nrpe::plugins:
  check_users:
    ensure: present
    source: 'puppet:///files/check_mem'

Full documentation for the nrpe::plugin type is available in the reference documentation.

Reference

See REFERENCE.md. This module has been documented with puppet-strings.

Limitations

Redhat

• This module requires the EPEL repositories to be enabled
• This module currently does not manage the firewall rules

Solaris

• This module depends on OpenCSW packages

Development

Improvements and bug fixes are greatly appreciated.

To regenerate the REFERENCE.MD file, please run the rake task as follows.

 % bundle exec rake strings:generate\[',,,,false,true']

This module is a fork of pdxcat/nrpe

It is licensed under the Apache License, Version 2.0.

Reference

Table of Contents

Classes

Public Classes

• nrpe: Installs and configures NRPE

Private Classes

• nrpe::config: Configures NRPE
• nrpe::config::ssl: Configures SSL for NRPE
• nrpe::install: Installs required NRPE packages
• nrpe::params: Sets defaults based on OS
• nrpe::service: Manages the NRPE service

Defined types

• nrpe::command: Installs NRPE commands
• nrpe::plugin: Installs additional plugins for NRPE

Functions

Private Functions

• nrpe::ssl_logging: A function that outputs a string suitable for the nrpe.conf ssl_logging parameter. The nrpe.conf documentation has the following to say...

Data types

• Nrpe::Sslversion
• Nrpe::Syslogfacility

Classes

nrpe

Installs and configures NRPE

• See also
  • https://github.com/NagiosEnterprises/nrpe
  • https://github.com/NagiosEnterprises/nrpe/blob/master/README.SSL.md

Examples

Basic usage

class { 'nrpe':
  allowed_hosts => [
    '127.0.0.1',
    'nagios.example.org',
  ],
}

With SSL

class { 'nrpe':
  allowed_hosts               => 'nagios.example.org',
  ssl_cert_file_content       => file('profile/ssl/nagios.example.org.crt'),
  ssl_privatekey_file_content => file('profile/ssl/nagios.example.org.key'),
  ssl_cacert_file_content     => file('profile/ssl/GeoTrust_RSA_CA_2018.crt'),
  ssl_client_certs            => 'require',
}

Parameters

The following parameters are available in the nrpe class:

• allowed_hosts
• server_address
• commands
• plugins
• command_timeout
• package_name
• manage_package
• purge
• dont_blame_nrpe
• log_facility
• server_port
• command_prefix
• debug
• connection_timeout
• allow_weak_random_seed
• allow_bash_command_substitution
• nrpe_user
• nrpe_group
• nrpe_pid_file
• command_file_default_mode
• supplementary_groups
• nrpe_ssl_dir
• ssl_cert_file_content
• ssl_privatekey_file_content
• ssl_cacert_file_content
• ssl_version
• ssl_ciphers
• ssl_client_certs
• ssl_log_startup_params
• ssl_log_remote_ip
• ssl_log_protocol_version
• ssl_log_cipher
• ssl_log_client_cert
• ssl_log_client_cert_details
• manage_pid_dir
• config
• include_dir
• provider
• service_name
• listen_queue_size

allowed_hosts

Data type: Array[Variant[Stdlib::Fqdn,Stdlib::IP::Address]]

Specifies the hosts that NRPE will accept connections from.

Default value: ['127.0.0.1']

server_address

Data type: Stdlib::IP::Address

Specifies the IP address of the inteface that NRPE should bind to. Useful when the system has more than one interface.

Default value: '0.0.0.0'

commands

Data type: Hash

A Hash of nrpe::command resources you want to create. Recommended when you want to define nrpe::commands in hiera data.

Default value: {}

plugins

Data type: Hash

A Hash of nrpe::plugin resources you want to create. Recommended when you want to define nrpe::plugins in hiera data.

Default value: {}

command_timeout

Data type: Integer[0]

Specifies the maximum number of seconds that the NRPE daemon will allow plugins to finish executing before killing them off.

Default value: 60

package_name

Data type: Variant[String[1], Array[String[1]]]

The package name or array of package names that will be installed. The default is often fine, but you may wish to set this to install extra packages like nrpe-selinux.

Default value: $nrpe::params::nrpe_packages

manage_package

Data type: Boolean

By default, set to true and the nrpe class will manage the OS package(s).

Default value: true

purge

Data type: Boolean

When set to true, the module will purge any unmanaged commands from the NRPE includedir.

Default value: false

dont_blame_nrpe

Data type: Boolean

Determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed. ENABLING THIS OPTION IS A SECURITY RISK!

Default value: $nrpe::params::dont_blame_nrpe

log_facility

Data type: Nrpe::Syslogfacility

The syslog facility that should be used for logging purposes.

Default value: $nrpe::params::log_facility

server_port

Data type: Stdlib::Port::Unprivileged

The port that NRPE should listen for connections on.

Default value: $nrpe::params::server_port

command_prefix

Data type: Optional[Stdlib::Absolutepath]

This option allows you to prefix all commands with a user-defined string. Although often used to run all commands with sudo, nrpe::command has dedicated sudo parameters for this.

Default value: $nrpe::params::command_prefix

debug

Data type: Boolean

This option determines whether or not debugging messages are logged to the syslog facility.

Default value: $nrpe::params::debug

connection_timeout

Data type: Integer[0]

Specifies the maximum number of seconds that the NRPE daemon will wait for a connection to be established before exiting.

Default value: $nrpe::params::connection_timeout

allow_weak_random_seed

Data type: Boolean

Determines whether or not the NRPE daemon will use weak sources of randomness

Default value: $nrpe::params::allow_weak_random_seed

allow_bash_command_substitution

Data type: Optional[Boolean]

Determines whether or not the NRPE daemon will allow clients to specify arguments that contain bash command substitutions of the form $(...). ENABLING THIS OPTION IS A HIGH SECURITY RISK!

Default value: $nrpe::params::allow_bash_command_substitution

nrpe_user

Data type: String[1]

Determines the effective user that the NRPE daemon should run as.

Default value: $nrpe::params::nrpe_user

nrpe_group

Data type: String[1]

Determines the effective group that the NRPE daemon should run as.

Default value: $nrpe::params::nrpe_group

nrpe_pid_file

Data type: Stdlib::Absolutepath

The name of the file in which the NRPE daemon should write it's process ID number.

Default value: $nrpe::params::nrpe_pid_file

command_file_default_mode

Data type: Stdlib::Filemode

The default file mode to use when creating NRPE command files in the includedir.

Default value: '0644'

supplementary_groups

Data type: Array[String[1]]

If set, the nrpe_user will be added to these supplementary groups.

Default value: []

nrpe_ssl_dir

Data type: Stdlib::Absolutepath

The directory that SSL certificates and keys will be created in.

Default value: $nrpe::params::nrpe_ssl_dir

ssl_cert_file_content

Data type: Optional[String[1]]

A string containing the SSL Certificate.

Default value: undef

ssl_privatekey_file_content

Data type: Optional[String[1]]

A string containing the SSL private KEY. It is recommended to source this parameter from hiera and use EYAML or similar to encrypt the data.

Default value: undef

ssl_cacert_file_content

Data type: Optional[String[1]]

A string containing the SSL CA Cert file contents.

Default value: undef

ssl_version

Data type: Nrpe::Sslversion

The SSL Version to use. The default of TLSv1.2+ is the most secure option available at time of writing. Avoid having to set it to a lower value if possible.

Default value: $nrpe::params::ssl_version

ssl_ciphers

Data type: Array[String[1]]

An array of ciphers that should be allowed by NRPE. The defaults are for RSA keys and were taken from https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices.

Default value: $nrpe::params::ssl_ciphers

ssl_client_certs

Data type: Enum['no','ask','require']

This options determines client certificate usage.

Default value: $nrpe::params::ssl_client_certs

ssl_log_startup_params

Data type: Boolean

Whether to log startup SSL/TLS parameters.

Default value: false

ssl_log_remote_ip

Data type: Boolean

Whether to log remote IP address of SSL client.

Default value: false

ssl_log_protocol_version

Data type: Boolean

Whether to log SSL/TLS version of connections.

Default value: false

ssl_log_cipher

Data type: Boolean

Whether to log which encryption cipher is being used for SSL connections.

Default value: false

ssl_log_client_cert

Data type: Boolean

Whether to log if an SSL client has presented a certificate.

Default value: false

ssl_log_client_cert_details

Data type: Boolean

Whether to log details of client SSL certificates.

Default value: false

manage_pid_dir

Data type: Boolean

Whether to manage the directory where the PID file should exist.

Default value: false

config

Data type: Stdlib::Absolutepath

Private You should not need to override this parameter.

Default value: $nrpe::params::nrpe_config

include_dir

Data type: Stdlib::Absolutepath

Private You should not need to override this parameter.

Default value: $nrpe::params::nrpe_include_dir

provider

Data type: Optional[String[1]]

Private You should not need to override this parameter.

Default value: $nrpe::params::nrpe_provider

service_name

Data type: String[1]

Private You should not need to override this parameter.

Default value: $nrpe::params::nrpe_service

listen_queue_size

Data type: Integer[0]

Listen queue size (backlog) for serving incoming connections. You may want to increase this value under high load.

Default value: $nrpe::params::listen_queue_size

Defined types

nrpe::command

Installs NRPE commands

Examples

Install a command called check_users

nrpe::command { 'check_users':
  ensure  => present,
  command => 'check_users -w 5 -c 10',
}

Parameters

The following parameters are available in the nrpe::command defined type:

• name
• command
• ensure
• file_mode
• sudo
• sudo_user

name

The name of the command.

command

Data type: String[1]

The command plugin to run and its arguments.

ensure

Data type: Enum['present', 'absent']

Whether to install or remove the command.

Default value: present

file_mode

Data type: Optional[Stdlib::Filemode]

The mode to use for the command file. By default, this parameter is undef, and the command file will use $nrpe::command_file_default_mode.

Default value: undef

sudo

Data type: Boolean

Whether the command should use sudo.

Default value: false

sudo_user

Data type: String[1]

The user to run the command as when using sudo.

Default value: 'root'

nrpe::plugin

Installs additional plugins for NRPE

Examples

Install a check_mem plugin from a file hosted in your site module

nrpe::plugin { 'check_mem':
  ensure => present,
  source => 'puppet:///modules/site/nrpe/check_mem',
}

Parameters

The following parameters are available in the nrpe::plugin defined type:

• name
• ensure
• content
• source

name

The name of the plugin.

ensure

Data type: Enum['present', 'absent']

Whether to install or remove the plugin.

Default value: present

content

Data type: Optional[String[1]]

Defines the actual content of the plugin file. Should not be used in conjunction with source.

Default value: undef

source

Data type: Optional[Stdlib::Filesource]

Defines the source of the plugin file. Should not be used in conjunction with content.

Default value: undef

Data types

Nrpe::Sslversion

The Nrpe::Sslversion data type.

Alias of Enum['SSLv2', 'SSLv2+', 'SSLv3', 'SSLv3+', 'TLSv1', 'TLSv1+', 'TLSv1.1', 'TLSv1.1+', 'TLSv1.2', 'TLSv1.2+']

Nrpe::Syslogfacility

The Nrpe::Syslogfacility data type.

Alias of Enum['user', 'mail', 'daemon', 'auth', 'syslog', 'lpr', 'news', 'uucp', 'cron', 'authpriv', 'ftp', 'ntp', 'security', 'console', 'solaris-cron', 'local0', 'local1', 'local2', 'local3', 'local4', 'local5', 'local6', 'local7']

Changelog

All notable changes to this project will be documented in this file. Each new release typically also includes the latest modulesync defaults. These should not affect the functionality of the module.

v6.0.0 (2023-03-10)

Full Changelog

Breaking changes:

• Drop EOL Debian 8, Ubuntu 16.04 #55 (smortex)

Implemented enhancements:

• NRPEv3 Support for FreeBSD - Add param listen_queue_size #64 (Toutzn)
• Add support for Debian 10, 11 and Ubuntu 18.04, 20.04 #56 (smortex)

Closed issues:

• nrpe Package on 20.04 is Persistently Reinstalling as a Corrective Action #65

Merged pull requests:

• docs: fix typo #62 (MindTooth)
• dont hardcode facter versions in tests #61 (bastelfreak)
• Allow stdlib 8.0.0 #53 (smortex)

v5.0.0 (2021-05-06)

Full Changelog

Breaking changes:

• Add Puppet 7 support; Drop Puppet 5 support; concat/stdlib: Allow 7.x #48 (bastelfreak)
• Drop EOL EL 5 & 6 #44 (ekohl)

Implemented enhancements:

• Support IP addresses with subnets in allowed_hosts #47 (mleiner)
• Add pid directory management #38 (coreone)

Fixed bugs:

• Add amd64 as recognised Gentoo arch #40 (optiz0r)

Closed issues:

• Error when package_name is customized #41

v4.0.0 (2020-05-10)

Full Changelog

Breaking changes:

• drop Ubuntu 14.04 support #26 (bastelfreak)
• modulesync 2.7.0 and drop puppet 4 #23 (bastelfreak)

Implemented enhancements:

• Add commands and plugins parameters #17 (alexjfisher)

Fixed bugs:

• Allow puppetlabs/concat 6.x, puppetlabs/stdlib 6.x; require at least concat 4.1.0 instead of 3.0.0 #24 (dhoppe)

Closed issues:

• Adding interface for Hiera and nrpe resources #16

Merged pull requests:

• Use voxpupuli-acceptance #33 (ekohl)
• Enable changing allow_weak_random_seed config param #29 (jorhett)
• drop RHEL5, add Debian8/ubuntu16 support #19 (bastelfreak)
• Add more acceptance tests #15 (alexjfisher)
• Add basic acceptance tests #14 (alexjfisher)

v3.0.0 (2018-11-07)

Full Changelog

This is the first VoxPupuli release of puppet/nrpe. puppet/nrpe is a fork of pdxcat/nrpe.

Users migrating from pdxcat/nrpe should carefully review any breaking changes that may affect them.

Breaking changes:

• Use modern facts and stdlib fact() function #10 (alexjfisher)
• Add reference docs and remove redundant recurse parameter #9 (alexjfisher)
• Convert to EPP templates and add Puppet 4+ data types to parameters #6 (alexjfisher)

Implemented enhancements:

• Add supplementary_groups parameter #7 (alexjfisher)
• Parameterize nrpe::command file mode #5 (alexjfisher)

Merged pull requests:

• Major refactor into install/config/service pattern #8 (alexjfisher)
• Fixup metadata.json, add travis secret for VP fork #4 (alexjfisher)
• Use full apache 2 license text #3 (alexjfisher)
• Update README #2 (alexjfisher)

v2.1.1 (2016-06-09)

• Fix file perms

v2.1.0 (2016-06-07)

• Take the parameters given to the module into account, rather than the defaults from the params.pp when creating commands.
• Fix nrpe::include_dir bug
• make management of nrpe package optional
• Use variable for title of service resource to be consistent
• Allow other users than root to be sudoed

v2.0.0 (2015-06-16)

• Add Gentoo support.
• Re-add inherit params.
• Allow hiera-based override of nrpe user/group/pid.
• Fix variable naming.
• 1ca413e Add all other NRPE config parameters: allow_bash_command_substitution, log_facility, server_port, command_prefix, debug, connection_timeout; also add dont_blame_nrpe to nrpe::params.
• Add support for SLES
• Added support to set file mode of plugin file
• Added support for the 'content' attribute for a plugin
• Added sudo support
• Add support for OpenBSD.
• Make command_timeout configurable.
• Allow to specify fully qualified commands.
• Specify server_address in nrpe class.
• change package name from nrpe2 to nrpe for freebsd
• add 32bit architecture for RedHat OS family
• removed dont_blame_nrpe from params
• Fixed typo, missing bracket after list in params.pp near line 78
• corrected syntax
• added dont_blame_nrpe
• corrected FreeBSD package names
• added SUSE default params
• cfg template w/ @libdir fact

(v1.0.0) (2014-02-26)

Summary:

This release adds FreeBSD osfamily support and support for adding nrpe plugins.

Features:

• Add FreeBSD support
• Add plugin command

Bugfixes:

• OpenCSW changed the paths of configs files

v0.0.4 (2013-10-20)

Summary:

This is a bug fix release

Bug fixes:

• Fix puppet 3.x bug with array namevars
• Puppet lint fixes

v0.0.3 (2013/09/25)

• Add Rakefile, Gemfile and update .gitignore
• Merge pull request #1 from ripienaar/puppet_3_2_1_deprecations
• Puppet 3.2.1 has deprecated 'foo' as a means of accessing variables in templates instead now requiring '@foo' and will log warnings about this.

v0.0.2 (2013/02/02)

• Bump version to 0.0.2 for forge release
• Remove nrpe plugin.
• Fix spelling of the word command in README
• Ignore pkg directory
• Add ability to purge nrpe::commands
• Add smoke tests
• Add dependencies to the README
• Fix typo with nagios_plugin package for solaris
• Add nagios-plugin package param
• Add nrpe::command functionality
• Add redhat params to nrpe
• Change allowed_hosts from a string to an array
• Initial commit for nrpe module

* This Changelog was automatically generated by github_changelog_generator