summaryrefslogtreecommitdiff
path: root/articles/icinga-agent.html
diff options
context:
space:
mode:
Diffstat (limited to 'articles/icinga-agent.html')
-rw-r--r--articles/icinga-agent.html135
1 files changed, 135 insertions, 0 deletions
diff --git a/articles/icinga-agent.html b/articles/icinga-agent.html
new file mode 100644
index 0000000..e0aa6c0
--- /dev/null
+++ b/articles/icinga-agent.html
@@ -0,0 +1,135 @@
1<!DOCTYPE html>
2<html lang=en>
3 <head>
4 <title></title>
5 <meta charset="utf-8"/>
6 <link rel="shortcut icon" href="favicon.ico"/>
7 <link rel='stylesheet' href='../style.css'/>
8 <meta name="viewport" content="width=device-width, initial-scale=1">
9 </head>
10<body>
11 <header><h1>Icinga Agent Node Installation and Configuration</h1></header>
12 <main>
13 <p>With the Icinga master node configured, the servers we want
14 to monitor can now be added as agent nodes. As the names suggest,
15 the Icinga master node pushes the desired configuration to agent
16 nodes, while agent nodes report the configured status checks back
17 to the master. Communication between the master and agent nodes is
18 encrypted via TLS, with the master node acting as a certificate
19 authority.</p>
20
21 <p>You can find my script to automate this process
22 <a href=https://git.chudnick.com/server-scripts/tree/monitoring/icinga-agent>
23 here</a>.</p>
24
25 <h2>Install Pakcages</h2>
26 <p>Start by installing the required packages on the server to be
27 monitored.</p>
28
29 <pre><code>apt install icinga2 monitoring-plugins
30monitoring-plugins-contrib</code></pre>
31
32 <h2>Initialize PKI with master</h2>
33 <p>Now we need to setup the PKI that will be used for the communication
34 with the master node. The first step is to generate a certificate
35 signing request. Replace <em>hostname</em> with the FQDN of the server.</p>
36
37 <pre><code>icinga2 pki new-cert --cn "<em>hostname</em>" --cert "/etc/icinga2/pki/<em>hostname</em>.crt" --csr "/etc/icinga2/pki/<em>hostname</em>.csr" --key "/etc/icinga2/pki/<em>hostname</em>.key"</code></pre>
38
39 <p>Next we save the master node's public key certificate. Replace
40 <em>master</em> with the FQDN of your master node.</p>
41
42 <pre><code>icinga2 pki save-cert --host "<em>master</em>" --port 5665 --key "/etc/icinga2/pki/<em>hostname</em>.key" --trustedcert "/etc/icinga2/pki/trusted-master.crt"</code></pre>
43
44 <p>Receive signed certificate from the master node.</p>
45
46 <pre><code>icinga2 pki request --host "<em>master</em>" --port 5665 --key "/etc/icinga2/pki/<em>hostname</em>.key" --cert "/etc/icinga2/pki/<em>hostname</em>.crt" --trustedcert "/etc/icinga2/pki/trusted-master.crt" --ca "/etc/icinga2/pki/ca.crt"</code></pre>
47
48 <h2>Deploy configuration files</h2>
49 <p>Write Icinga configuration.</p>
50
51 <pre><code><strong>/etc/icinga2/icinga2.conf</strong>
52include "constants.conf"
53const NodeName = "$nodename"
54include "zones.conf"
55include "features-enabled/*.conf"
56include &lt;itl&gt;
57include &lt;plugins&gt;
58include &lt;plugins-contrib&gt;
59include &lt;manubulon&gt;
60include &lt;windows-plugins&gt;
61include &lt;nscp&gt;"</code></pre>
62
63 <p>Write zones configuration.</p>
64
65 <pre><code><strong>/etc/icinga2/zones.conf</strong>
66echo "object Endpoint "<em>hostname</em>" {}
67object Zone "<em>hostname</em>" {
68 parent = "<em>master</em>"
69 endpoints = [ "<em>hostname</em>" ]
70}
71object Zone "<em>master</em>" {
72 endpoints = [ "<em>master</em>" ]
73}
74object Endpoint "<em>master</em>" {
75 host = "<em>master</em>"
76}
77object Zone "director-global" {
78 global = true
79}</code></pre>
80
81 <p>Write API configuration file.</p>
82
83 <pre><code><strong>/etc/icinga2/features-available/api.conf</strong>
84echo "object ApiListener \"api\" {
85 accept_commands = true
86 accept_config = true
87}</code></pre>
88
89 <h2>Enable API</h2>
90 <p>Next, we need to enable the API on the agent.</p>
91
92 <pre><code>icinga2 feature enable api
93
94mkdir -p /var/lib/icinga2/certs
95
96cp /etc/icinga2/pki/<em>hostname</em>.crt /etc/icinga2/pki/<em>hostname</em>.key /etc/icinga2/pki/ca.crt /var/lib/icinga2/certs/
97
98chown -R nagios: /var/lib/icinga2/certs/</code></pre>
99
100 <h2>Sign agent CSR on Master</h2>
101 <p>The only action needed on the master node is to sign the agent's
102 CSR. Logon to your master node and run the following:</p>
103
104 <pre><code>fpr="$(icinga2 ca list | tail -1 | cut -d '|' -f 1)"
105icinga2 ca sign $fpr</code></pre>
106
107 <h2>Configure Firewall</h2>
108 <p>Before finishing we need to open the proper firewall port.
109 I will use UFW in the example here and allow traffic only only
110 from the master node for best security.</p>
111
112 <pre><code>ufw allow proto tcp from <em>master-ip</em> to any port 5665</code></pre>
113
114 <h2>Restart Icinga on Agent</h2>
115 <p>Finally, restart the icinga service on the agent node.</p>
116
117 <pre><code>systemctl restart icinga2</code></pre>
118
119 <p>The Icinga agent node will now pull down configuration from the master.
120 You will know that this worked if <em>/var/lib/icinga2/api/zones</em>
121 begins to populate with new files.</p>
122<p>
123<hr>
124Consider <a href=../donate.html>donating</a> if this article was useful.
125<a class=qr href=../images/bitcoin.png>[BTC]</a>
126</p>
127 </main>
128 <footer>
129 <a href=../kb.html>Knowledge Base</a>
130 <br>
131 <a href=../index.html>www.chudnick.com</a>
132 </footer>
133</body>
134</html>
135