summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rwxr-xr-xautomap37
-rwxr-xr-xipaconf107
-rwxr-xr-xmknfs56
-rwxr-xr-xmkraid53
-rwxr-xr-xmonitoring/icinga-agent108
-rwxr-xr-xmonitoring/icinga-master120
6 files changed, 481 insertions, 0 deletions
diff --git a/automap b/automap
new file mode 100755
index 0000000..b92b0b9
--- /dev/null
+++ b/automap
@@ -0,0 +1,37 @@
1#!/bin/sh
2#
3# Configures a FreeIPA client to use a provided location for automount
4
5help() {
6 echo "usage: automap [--append] --location location"
7 echo "-a, --append:\tappend location (default is to replace existing locations)"
8 echo "-l, --location:\tname of automount location"
9 exit 1
10}
11
12[ $(id -u) -ne 0 ] && echo "error: must be run as root" && exit 1
13
14opts=$(getopt -o "a,h,l:" -l "append,help,location:" -- "$@")
15eval set -- "$opts"
16location=
17append=0
18while true
19do
20 case "$1" in
21 '-a' | '--append') append=1 shift; continue ;;
22 '-l' | '--location') location="$2" shift 2; continue ;;
23 '-h' | '--help') help ;;
24 '--') shift; break ;;
25 esac
26done
27[ -z "$location" ] && help
28
29domain="$(grep "domain =" /etc/ipa/default.conf | cut -d '=' -f 2 | tr -d ' ')"
30dc1="$(echo $domain | cut -d '.' -f 1)"
31dc2="$(echo $domain | cut -d '.' -f 2)"
32mstr="+ldap:automountmapname=auto.master,cn=$location,cn=automount,dc=$dc1,dc=$dc2"
33drct="/-\tldap:automountmapname=auto.direct,cn=$location,cn=automount,dc=$dc1,dc=$dc2"
34str="$mstr\n$drct"
35[ $append -eq 0 ] && echo $str > /etc/auto.master || echo $str >> /etc/auto.master
36
37systemctl restart autofs
diff --git a/ipaconf b/ipaconf
new file mode 100755
index 0000000..7d653d2
--- /dev/null
+++ b/ipaconf
@@ -0,0 +1,107 @@
1#!/bin/sh
2#
3# configures a FreeIPA client system by:
4# enrolling in a FreeIPA domain (includes ldap,kerberos,ntp
5# setting up FreeIPA server as an nss target
6# configuring as a kerberized NFSv4 client or server
7# configuring for FreeIPA-managed automount
8
9help() {
10 echo "usage: ipaconf --dns-server dns_server --ipa-domain ipa.domain"\
11 "--ntp-server ntp_server [--nfs-server]"
12 echo "\n-d, --dns-server:\tIP of DNS server containing IPA records"
13 echo "-f, --nfs-server:\tConfigure client as an NFS server in the IPA domain"
14 echo "-i, --ipa-domain:\tIPA domain base (e.g. example.com)"
15 echo "-n, --ntp-server:\tIP or hostname of NTP server for the IPA domain"
16 exit 1
17}
18
19[ $(id -u) -ne 0 ] && echo "error: must be run as root" && exit 1
20
21opts=$(getopt -o "d:,f:,h,i:,n:" -l "dns-server:,nfs-server,help,ipa-domain:,ntp-server:" -- "$@")
22eval set -- "$opts"
23dnssrv=
24nfssrv=0
25ipadomain=
26ntpsrv=
27while true
28do
29 case "$1" in
30 '-d' | '--dns-server') dnssrv="$2" shift 2; continue ;;
31 '-f' | '--nfs-server') nfssrv=1 shift; continue ;;
32 '-i' | '--ipa-domain') ipadomain="$2" shift 2; continue ;;
33 '-n' | '--ntp-server') ntpsrv="$2" shift 2; continue ;;
34 '-h' | '--help') help ;;
35 '--') shift; break ;;
36 esac
37done
38[ -z "$dnssrv" ] && help
39[ -z "$ipadomain" ] && help
40[ -z "$ntpsrv" ] && help
41
42
43# FreeIPA client currently only in backports for Debian 11
44grep -q bullseye-backports /etc/apt/sources.list || echo "deb https://deb.debian.org/debian bullseye-backports main" >> /etc/apt/sources.list
45
46# Install required packages
47apt update
48apt install freeipa-client nfs-common autofs autofs-ldap -y
49[ $nfssrv -eq 1 ] && apt install nfs-kernel-server -y
50
51# Change DNS
52echo "domain $ipadomain\nsearch $ipadomain\nnameserver $dnssrv" > /etc/resolv.conf
53
54# Move chrony conf so IPA installer can configure its own
55mv /etc/chrony/chrony.conf /etc/chrony/chrony.conf.ipabk
56
57# Configure and enroll client
58ipa-client-install --mkhomedir --ntp-server=$ntpsrv
59
60# Configure SSSD
61# Do not specify services if using systemd as they will be socket activated
62$(pgrep -x systemd >/dev/null) && sed -i "/^services =/d" /etc/sssd/sssd.conf
63# Enable enumeration of domain if NFS server - for assigning permissions to shares
64[ $nfssrv -eq 1 ] && sed -i "s/\[domain\/$ipadomain\]/[domain\/$ipadomain]\nenumerate = True/" /etc/sssd/sssd.conf
65systemctl restart sssd
66
67# Configure automount
68dc1="$(echo $ipadomain | cut -d '.' -f 1)"
69dc2="$(echo $ipadomain | cut -d '.' -f 2)"
70echo "[ autofs ]
71master_map_name = /etc/auto.master
72timeout = 300
73browse_mode = no
74ldap_uri = "ldap:///dc=$dc1,dc=$dc2"
75map_object_class = automountMap
76entry_object_class = automount
77map_attribute = automountMapName
78entry_attribute = automountKey
79value_attribute= automountInformation
80auth_conf_file = /etc/autofs_ldap_auth.conf
81[ amd ]
82dismount_interval = 300" > /etc/autofs.conf
83
84echo "<?xml version="1.0" ?>
85<autofs_ldap_sasl_conf
86 usetls="no"
87 tlsrequired="no"
88 authrequired="yes"
89 authtype="GSSAPI"
90 clientprinc="host/$(hostname)@$(echo $ipadomain | tr [:lower:] [:upper:])"
91/>" > /etc/autofs_ldap_auth.conf
92chmod 600 /etc/autofs_ldap_auth.conf
93
94# Restart autofs to apply existing automount configuration
95systemctl restart autofs
96
97# Configure NFS
98sed -i "s/NEED_IDMAPD.*$/NEED_IDMAPD=yes"
99sed -i "s/NEED_GSSD.*$/NEED_GSSD=yes"
100[ $nfssrv -eq 1 ] && sed -i "s/NEED_SVCGSSD.*$/NEEDSVCGSSD=\"yes\"/" /etc/default/nfs-kernel-server
101systemctl restart nfs-kernel-server
102
103# Manaul steps for NFS server
104ipasrv=$(grep "server =" /etc/ipa/default.conf | cut -d '=' -f 2 | tr -d ' ')
105[ $nfssrv -eq 1 ] && echo -e "\n\nNEXT\n\nUse kinit to obtain a kerberos ticket (e.g. kinit admin) and run the following commands\nipa service-add nfs/$(hostname)\nipa-getkeytab -s $ipasrv -p nfs/$(hostname) -k /etc/krb5.keytab from this machine"
106
107
diff --git a/mknfs b/mknfs
new file mode 100755
index 0000000..5b04a9f
--- /dev/null
+++ b/mknfs
@@ -0,0 +1,56 @@
1#!/bin/sh
2#
3# Configures and exports an NFS share
4
5help() {
6 echo "usage: mknfs --clients nfs_client --path nfs_path"\
7 "[--options \"opt1,opt2,opt3...\"] [--sec sec_option] [-f]"
8 echo "\n-c, --clients\tNFS export client"
9 echo "-f, --force\tmake directory if it doesn't exist"
10 echo "-o, --options\tAdditional NFS export options - quoted and comma separated"
11 echo "-p, --path\tPath of directory to be exported - must be absolute"
12 echo "-s, --sec\tNFS security settings - defaults to sys"
13 echo "\nexample: mknfs --clients server.example.com --path /srv/nfs/backups"\
14 "--options \"crossmnt,async\" --sec krb5p"
15 exit
16}
17
18opts=$(getopt -o "c:,f,h,o:,p:,s:" -l "clients:,force, help,options:,path:,sec:" -- "$@")
19eval set -- "$opts"
20clients=
21options=""
22path=
23sec="sys"
24force=0
25while true
26do
27 case "$1" in
28 '-c' | '--clients') clients="$2" shift 2; continue ;;
29 '-f' | '--force') force=1 shift; continue ;;
30 '-o' | '--options') options="$2" shift 2; continue ;;
31 '-p' | '--path') path="$2" shift 2; continue ;;
32 '-s' | '--sec') sec="$2" shift 2; continue ;;
33 '-h' | '--help') help ;;
34 '--') shift; break ;;
35 esac
36done
37[ -z "$clients" ] && help
38[ -z "$path" ] && help
39
40# Validate path
41[ "$(echo $path | cut -d'/' -f1)" != "" ] &&
42 echo "error: path is not absolute" && exit 1
43[ ! -d $path -a $force -eq 0 ] &&
44 echo "error: directory does not exist (use -f to create)" && exit 1
45[ ! -d $path -a $force -eq 1 ] && mkdir -p $path
46
47# Set some sane defaults if no options are specified
48[ "$options" = "" ] && options="rw,sync,no_subtree_check"
49
50# Make sure security option is valid
51[ $sec != "sys" -a $sec != "krb5" -a $sec != "krb5i" -a $sec != "krb5p" ] &&
52 echo "error: invalid security option - must be one of sys,krb5,krb5i,krb5p"
53
54echo "$path\t$clients(sec=$sec,$options)" >> /etc/exports
55exportfs -au
56exportfs -ar
diff --git a/mkraid b/mkraid
new file mode 100755
index 0000000..b2fe60b
--- /dev/null
+++ b/mkraid
@@ -0,0 +1,53 @@
1#!/bin/sh
2
3help() {
4 echo "usage: mkraid --id array_id --name array_name --level raid_level" \
5 "--devices 'raid_device_1 raid_device_2 ...'" \
6 "--spares 'spare_device_1 spare_device_2 ...'"
7 echo "\n-i, --id:\tid of RAID array as a number up to 127"
8 echo "-n, --name:\tname of RAID array"
9 echo "-l, --level:\tRAID level"
10 echo "-d, --devices:\tdevices in RAID array - quoted and space separated"
11 echo "-s, --spares:\thot spare devices - quoted and space separated if multiple"
12 echo "\nexample: mkraid --id 0 --name arr1 --level 5 --devices"\
13 "'/dev/sda /dev/sdb /dev/sdc' --spares /dev/sdd"
14 exit
15}
16
17opts=$(getopt -o "i:,n:,l:,d:,s:h" -l "id:,name:,level:,devices:,spares:,help" -- "$@")
18eval set -- "$opts"
19id=
20name=
21level=
22devices=
23spares=
24while true
25do
26 case "$1" in
27 '-i' | '--id') id="$2" shift 2; continue ;;
28 '-n' | '--name') name="$2" shift 2; continue ;;
29 '-l' | '--level') level="$2" shift 2; continue ;;
30 '-d' | '--devices') devices="$2" shift 2; continue ;;
31 '-s' | '--spares') spares="$2" shift 2; continue ;;
32 '-h' | '--help') help ;;
33 '--') shift; break ;;
34 esac
35done
36[ -z "$id" ] && help
37[ -z "$name" ] && help
38[ -z "$level" ] && help
39[ -z "$devices" ] && help
40[ -z "$spares" ] && help
41
42numdevs=$(echo $devices | tr ' ' '\n' | wc -l)
43numspare=$(echo $spares | tr ' ' '\n' | wc -l)
44
45echo "mdadm --create /dev/md$id --level=$level --raid-devices=$numdevs $devices --spare-devices=$numspare $spares"
46
47exit
48
49mdadm --create /dev/md$id --level=$level --raid-devices=$numdevs $devices --spare-devices=$numspare $spares
50
51uuid="$(mdadm --detail /dev/md0 | grep UUID | tr -d '[:space:]' | cut -d ':' -f 2-)"
52
53echo "ARRAY /dev/md$id metadata=1.2 UUID=$uuid name=$name" >> /etc/mdadm/mdadm.conf
diff --git a/monitoring/icinga-agent b/monitoring/icinga-agent
new file mode 100755
index 0000000..328d65b
--- /dev/null
+++ b/monitoring/icinga-agent
@@ -0,0 +1,108 @@
1#!/bin/sh
2#
3# Configirues an icinga2 agent (with on-demand csr signing)
4
5icingauser="nagios"
6certdir="/etc/icinga2/pki"
7api_certdir="/var/lib/icinga2/certs"
8nodename="$(hostname)"
9global_zone="director-global"
10master_fqdn=""
11
12# Install packages
13apt install -y icinga2 monitoring-plugins monitoring-plugins-contrib
14
15# Register with master via self-service API
16apikey=""
17displayname=""
18# Not pretty but gets the job done
19dev="$(ip link | grep ^2: | head -1 | cut -d':' -f 2 | tr -d ' ')"
20ipv4="$(ip addr show $dev | grep "inet " | sed "s/^\s*//;s/\// /" | cut -d ' ' -f 2)"
21ipv6="$(ip addr show $dev | grep "inet6 " | sed "s/^\s*//;s/\// /" | cut -d ' ' -f 2)"
22
23result=$(curl -i "http://$master_fqdn/icingaweb2/director/self-service/register-host?name=$nodename&key=$apikey" \
24 -H "Accept: application/json" \
25 -X "POST" \
26 -d "{\"display_name\":\"$displayname\",\"address\":\"$ipv4\",\"address6\":\"$ipv6\"}")
27echo $result | grep -q error && \
28 echo "error: unable to register with master (is the api key correct?)" && \
29 exit 2
30
31
32# Initialize PKI with master
33icinga2 pki new-cert \
34 --cn "pbs.home.local" \
35 --cert "$certdir/$nodename.crt" \
36 --csr "$certdir/$nodename.csr" \
37 --key "$certdir/$nodename.key"
38
39
40icinga2 pki save-cert \
41 --host "$master_fqdn" \
42 --port 5665 \
43 --key "$certdir/$nodename.key" \
44 --trustedcert "$certdir/trusted-master.crt"
45
46icinga2 pki request \
47 --host "$master_fqdn" \
48 --port 5665 \
49 --key "$certdir/$nodename.key" \
50 --cert "$certdir/$nodename.crt" \
51 --trustedcert "$certdir/trusted-master.crt" \
52 --ca "$certdir/ca.crt"
53
54# Deploy config files
55echo "include \"constants.conf\"
56const NodeName = \"$nodename\"
57include \"zones.conf\"
58include \"features-enabled/*.conf\"
59include <itl>
60include <plugins>
61include <plugins-contrib>
62include <manubulon>
63include <windows-plugins>
64include <nscp>" > /etc/icinga2/icinga2.conf
65
66echo "object Endpoint \"$nodename\" {}
67object Zone \"$nodename\" {
68 parent = \"$master_fqdn\"
69 endpoints = [ \"$nodename\" ]
70}
71object Zone \"$master_fqdn\" {
72 endpoints = [ \"$master_fqdn\" ]
73}
74object Endpoint \"$master_fqdn\" {
75 host = \"$master_fqdn\"
76}
77object Zone \"$global_zone\" {
78 global = true
79}" > /etc/icinga2/zones.conf
80
81echo "object ApiListener \"api\" {
82 accept_commands = true
83 accept_config = true
84}" > /etc/icinga2/features-available/api.conf
85
86# Enable API
87icinga2 feature enable api
88mkdir -p $api_certdir
89cp $certdir/$nodename.crt $certdir/$nodename.key $certdir/ca.crt $api_certdir/
90chown -R $icingauser:$icingauser $api_certdir/
91
92# Next step
93echo "
94
95NOW
96
97Run the following on the Icinga master:
98fpr=\"\$(icinga2 ca list | tail -1 | cut -d '|' -f 1)\"
99icinga2 ca sign \$fpr
100
101
102THEN
103
104Restart icinga2 on the agent:
105\"systemctl restart icinga2\"
106
107"
108
diff --git a/monitoring/icinga-master b/monitoring/icinga-master
new file mode 100755
index 0000000..ed82bc5
--- /dev/null
+++ b/monitoring/icinga-master
@@ -0,0 +1,120 @@
1#!/bin/sh
2#
3# Configuration for an Iciniga2 master (with icingaweb2, director, and mysql backend)
4
5ido_user="icinga2"
6ido_password="changeme"
7
8icingaweb2_user="icingaweb2"
9icingaweb2_password="changeme"
10
11director_user="director"
12director_password="changeme"
13
14admin_user="admin"
15admin_password="changeme"
16
17# Install packages
18apt install -y incinga2 icingaweb2 icinga2-ido-mysql icingaweb2-module-director \
19 monitoring-plugins monitoring-plugins-contrib
20
21# Secure mysql
22mysql_secure_installation
23
24# Create primary monitoring database
25mysql -u root -e "CREATE DATABASE icinga2;
26GRANT SELECT, INSERT, UPDATE, DELETE, DROP, CREATE VIEW, INDEX, EXECUTE
27ON icinga2.* TO '$ido_user'@'localhost' IDENTIFIED BY '$ido_password';
28FLUSH PRIVILEGES; "
29mysql -u root icinga2 </usr/share/icinga2-ido-mysql/scheme/mysql.sql
30echo "library \"db_ido_mysql\"
31object IdoMysqlConnection \"ido-mysql\" {
32 user = \"$ido_user\",
33 password = \"$ido_password\",
34 host = \"localhost\",
35 databse = \"icinga2\"
36}" > /etc/icinga2/features-available/ido-mysql.conf
37icinga2 feature enable ido-mysql
38
39# Create icingaweb2 database
40mysql -u root -e "CREATE DATABASE icingaweb2;
41GRANT ALL ON icingaweb2.* TO '$icingaweb2_user'@'localhost'
42IDENTIFIED BY '$icingaweb2_password';
43FLUSH PRIVILEGES;"
44mysql icingaweb2 </usr/share/icingaweb2/etc/scheme/mysql.schema.sql
45# Create initial admin user to login to icingaweb2
46passhash="$(php -r "echo password_hash(\"$admin_password\", PASSWORD_DEFAULT);")"
47mysql -u root -e "USE icingaweb2;
48INSERT INTO icingaweb_user (name, active, password_hash)
49VALUES (\"$admin_user\", 1, \"$passhash\");
50FLUSH PRIVILEGES; "
51
52# Create director database
53mysql -u root -e "CREATE DATABASE director CHARACTER SET 'utf8';
54GRANT ALL on director.* TO '$director_user'@'localhost'
55IDENTIFIED BY '$director_password';
56FLUSH PRIVILEGES;"
57icingacli module enable director
58icingacli director migration run --verbose
59
60# Setup API
61icinga2 api setup
62
63# Restart service
64systemctl restart icinga2
65
66
67# -- Icingaweb2 Configuration --
68
69# Configure authentication
70echo "[icingaweb2]
71backend = \"db\"
72resource = \"icingaweb2\"
73" > /etc/icingaweb2/authentication.ini
74
75# Configure resources
76echo "[icinga2]
77type = \"db\"
78db = \"mysql\"
79host \"localhost\"
80port = \"\"
81dbname = \"icinga2\"
82username = \"$icinga2_user\"
83password = \"$icinga2_password\"
84charset = \"\"
85use_ssl = \"0\"
86
87[icingaweb2]
88type = \"db\"
89db = \"mysql\"
90host \"localhost\"
91port = \"\"
92dbname = \"icingaweb2\"
93username = \"$icingaweb2_user\"
94password = \"$icingaweb2_password\"
95charset = \"\"
96use_ssl = \"0\"
97
98[icingaweb2]
99type = \"db\"
100db = \"mysql\"
101host \"localhost\"
102port = \"\"
103dbname = \"director\"
104username = \"$director_user\"
105password = \"$director_password\"
106charset = \"utf8\"
107use_ssl = \"0\"
108" > /etc/icingaweb2/resources.ini
109
110# Configure roles
111echo "[admins]
112users = \"$admin_user\"
113permissions = \"*\" " > /etc/icingaweb2/roles.ini
114
115# Configure director
116echo "[db]
117resource = \"director\"
118" > /etc/icingaweb2/modules/director/config.ini
119
120echo "NOW\nBrowse to http://$(hostname)/icingaweb2/ and login as $admin_user"