Nagios – New installation on Debian 9

If you have to install a really great network those such as Nagios those will be steps needed:

1.Installing Apache2 + PHP (Skip if you already have one):

apt-get install apache2 libapache2-mod-php7.0 php7.0
# enable cgi
a2enmod rewrite headers cgi
systemctl restart apache2

# setup correct timezone in php
mcedit /etc/php/7.0/apache2/php.ini
# set date.timezone according to http://php.net/manual/en/timezones.php
systemctl restart apache2

# info.php
echo '<?php phpinfo(); ?>' >/var/www/html/info.php

# open browser apache_server_ip/info.php and check 'default timezone'

apt-get install apache2 libapache2-mod-php7.0 php7.0

# enable cgi

a2enmod rewrite headers cgi

systemctl restart apache2

# setup correct timezone in php

mcedit /etc/php/7.0/apache2/php.ini

# set date.timezone according to http://php.net/manual/en/timezones.php

systemctl restart apache2

# info.php

echo '<?php phpinfo(); ?>' >/var/www/html/info.php

# open browser apache_server_ip/info.php and check 'default timezone'

2.Installing Nagios core:

# pre-request to build nagios from source:
apt-get install autoconf gcc libc6 make apache2-utils libgd-dev

# get source from https://www.nagios.org/downloads/nagios-core/
wget https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.3.4.tar.gz
tar xzf nagios-4.3.4.tar.gz
cd nagios-4.3.4/
./configure --with-httpd-conf=/etc/apache2/sites-enabled

# Output should look like this:
*** Configuration summary for nagios 4.3.4 2017-08-24 ***:

 General Options:
 -------------------------
        Nagios executable:  nagios
        Nagios user/group:  nagios,nagios
       Command user/group:  nagios,nagios
             Event Broker:  yes
        Install ${prefix}:  /usr/local/nagios
    Install ${includedir}:  /usr/local/nagios/include/nagios
                Lock file:  /run/nagios.lock
   Check result directory:  ${prefix}/var/spool/checkresults
           Init directory:  /etc/init.d
  Apache conf.d directory:  /etc/apache2/sites-enabled
             Mail program:  /usr/bin/mail
                  Host OS:  linux-gnu
          IOBroker Method:  epoll

 Web Interface Options:
 ------------------------
                 HTML URL:  http://localhost/nagios/
                  CGI URL:  http://localhost/nagios/cgi-bin/
 Traceroute (used by WAP):  /usr/sbin/traceroute


Review the options above for accuracy.  If they look okay,
type 'make all' to compile the main program and CGIs.

##################

# next we need to 'make' it ;-)
make all

# Output should look like this:
Enjoy.

# and we will in few minutes
# lets us create user for nagios
useradd nagios
# we will add him to apache group
usermod -a -G nagios www-data

# last but not least:
make install

# Output should look like this:

/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/libexec
/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/var
/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/var/archives
/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/var/spool/checkresults
chmod g+s /usr/local/nagios/var/spool/checkresults

*** Main program, CGIs and HTML files installed ***

You can continue with installing Nagios as follows (type 'make'
without any arguments for a list of all possible options):

  make install-init
     - This installs the init script in /etc/init.d

  make install-commandmode
     - This installs and configures permissions on the
       directory for holding the external command file

  make install-config
     - This installs sample config files in /usr/local/nagios/etc


##############

# let's add init script
make install-init
# and enable init script
systemctl enable nagios.service

# install and configure permissions for external command file:
make install-commandmode

# and add sample configuration so nagios will start:
make install-config

# add nagios-site apache configuration file:
make install-webconf

# we need to create nagiosadmin account for http
htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

# finally we can restart apache and start nagios:
systemctl restart apache2
systemctl start nagios

# open browser and type: nagios_ip_address/nagios/

100

101

102

103

# pre-request to build nagios from source:

apt-get install autoconf gcc libc6 make apache2-utils libgd-dev

# get source from https://www.nagios.org/downloads/nagios-core/

wget https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.3.4.tar.gz

tar xzf nagios-4.3.4.tar.gz

cd nagios-4.3.4/

./configure --with-httpd-conf=/etc/apache2/sites-enabled

# Output should look like this:

*** Configuration summary for nagios 4.3.4 2017-08-24 ***:

General Options:

-------------------------

Nagios executable: nagios

Nagios user/group: nagios,nagios

Command user/group: nagios,nagios

Event Broker: yes

Install ${prefix}: /usr/local/nagios

Install ${includedir}: /usr/local/nagios/include/nagios

Lock file: /run/nagios.lock

Check result directory: ${prefix}/var/spool/checkresults

Init directory: /etc/init.d

Apache conf.d directory: /etc/apache2/sites-enabled

Mail program: /usr/bin/mail

Host OS: linux-gnu

IOBroker Method: epoll

Web Interface Options:

------------------------

HTML URL: http://localhost/nagios/

CGI URL: http://localhost/nagios/cgi-bin/

Traceroute (used by WAP): /usr/sbin/traceroute

Review the options above for accuracy. If they look okay,

type 'make all' to compile the main program and CGIs.

##################

# next we need to 'make' it ;-)

make all

# Output should look like this:

Enjoy.

# and we will in few minutes

# lets us create user for nagios

useradd nagios

# we will add him to apache group

usermod -a -G nagios www-data

# last but not least:

make install

# Output should look like this:

/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/libexec

/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/var

/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/var/archives

/usr/bin/install -c -m 775 -o nagios -g nagios -d /usr/local/nagios/var/spool/checkresults

chmod g+s /usr/local/nagios/var/spool/checkresults

*** Main program, CGIs and HTML files installed ***

You can continue with installing Nagios as follows (type 'make'

without any arguments for a list of all possible options):

make install-init

- This installs the init script in /etc/init.d

make install-commandmode

- This installs and configures permissions on the

directory for holding the external command file

make install-config

- This installs sample config files in /usr/local/nagios/etc

##############

# let's add init script

make install-init

# and enable init script

systemctl enable nagios.service

# install and configure permissions for external command file:

make install-commandmode

# and add sample configuration so nagios will start:

make install-config

# add nagios-site apache configuration file:

make install-webconf

# we need to create nagiosadmin account for http

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

# finally we can restart apache and start nagios:

systemctl restart apache2

systemctl start nagios

# open browser and type: nagios_ip_address/nagios/

3.Installing Nagios Plugins (needed !)

# pre-require
apt-get install libmcrypt-dev make libssl-dev bc gawk dc build-essential snmp libnet-snmp-perl gettext libldap2-dev smbclient fping default-libmysqlclient-dev

# get latest source file! from https://github.com/nagios-plugins/nagios-plugins/releases
wget https://github.com/nagios-plugins/nagios-plugins/archive/release-2.2.1.tar.gz
tar zxvf release-2.2.1.tar.gz
cd nagios-plugins-release-2.2.1/
./tools/setup
./configure
make
make install

# now we should have all commands in /usr/local/nagios/libexec/
ls /usr/local/nagios/libexec/

# restart nagios so he can load those:
systemctl restart nagios.service

# pre-require

apt-get install libmcrypt-dev make libssl-dev bc gawk dc build-essential snmp libnet-snmp-perl gettext libldap2-dev smbclient fping default-libmysqlclient-dev

# get latest source file! from https://github.com/nagios-plugins/nagios-plugins/releases

wget https://github.com/nagios-plugins/nagios-plugins/archive/release-2.2.1.tar.gz

tar zxvf release-2.2.1.tar.gz

cd nagios-plugins-release-2.2.1/

./tools/setup

./configure

make

make install

# now we should have all commands in /usr/local/nagios/libexec/

ls /usr/local/nagios/libexec/

# restart nagios so he can load those:

systemctl restart nagios.service

4.Enable SSL for Nagios (and not only)

# enable module
a2enmod ssl
systemctl restart apache2

# edit apache to redirect traffic to ssl
mcedit /etc/apache2/sites-enabled/000-default.conf
# add this to VirtualHost:
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{HTTP_HOST}/$1

# after modification file should look like this:
<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html

        RewriteEngine on
        RewriteCond %{HTTPS} off
        RewriteRule ^(.*) https://%{HTTP_HOST}/$1

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

# enable ssl apache config file without it you will get SSL_ERROR_RX_RECORD_TOO_LONG error
a2ensite default-ssl.conf

# let us restart apache
systemctl restart apache2.service

# enable module

a2enmod ssl

systemctl restart apache2

# edit apache to redirect traffic to ssl

mcedit /etc/apache2/sites-enabled/000-default.conf

# add this to VirtualHost:

RewriteEngine on

RewriteCond %{HTTPS} off

RewriteRule ^(.*) https://%{HTTP_HOST}/$1

# after modification file should look like this:

ServerAdmin webmaster@localhost

DocumentRoot /var/www/html

RewriteEngine on

RewriteCond %{HTTPS} off

RewriteRule ^(.*) https://%{HTTP_HOST}/$1

ErrorLog ${APACHE_LOG_DIR}/error.log

CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

# enable ssl apache config file without it you will get SSL_ERROR_RX_RECORD_TOO_LONG error

a2ensite default-ssl.conf

# let us restart apache

systemctl restart apache2.service

Why I’m moving from Baikal to Radicale (CalDav & CardDav)

Saber/Dav which is a core component of Baikal is looking for maintainer (full story here)

It’s been some time now that I moved from Google Calendar service to self-hosted, open source solution.

I never notice any down sides with accessibility – maybe my need were simple enough 🙂

I’m not saying that Baikal is dead, if your are interested in Baikal fell free to lookup those posts (installation, updating)

As for me I started noticing one minor issue I had with Baikal, that is complicated calendar sharing setup – it IS possible to share calendars but its more complicated than it should be, it was announce that sharing will be added later after big code rewrite and I waited (because I wouldn’t even be able to contribute to php7.0+silex anyway), but here I found new solution… Radicale, it also don’t support sharing calendars via web-panel, but for me it got one BIG advanted in sharing zone, user rights, and with one little ACL list I was able to share whatever I wanted.

None of both solution support migration tools for this process so It was a bit of pain (as for now I wasn’t able to find too that would migrate my ‘Tasks’ from calendar, but I never used it as much and migration was done by hand with me clicking 2 buttons on each of 20 tasks I had left)

If you are interested, here are links related to process of installing, configure and migrate data from one solution to other:

Links coming soon

Linux – Apache Part 2: Enable SSL

There are multiply reasons why you would like to use ssl for your http and create usable https for you and your viewers.

This post is about SSL configuration for your working www server. If you didn’t setup one right now please go back to this post: Linux – Apache Part 1: Instalation and configuration

Lets begin:

#install application that will help you create your own certificates for vhosts
apt-get install ssl-cert
#when we will be ask about hostname enter domain name for page you want to create certificate
make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/ssl/private/www.example.com
cp /etc/ssl/private/www.example.com /etc/ssl/certs/www.example.com.pem
mv /etc/ssl/private/www.example.com /etc/ssl/private/www.example.com.key
#now we need to edit both files, the one in private dir need to have part about key
#file in certs dir need to have public-key part only
vim /etc/ssl/private/www.example.com.key
vim /etc/ssl/certs/www.example.com.pem
#secure private key from others
chmod 600 /etc/ssl/private/www.example.com.key

#enable ssl module for apache
a2enmod ssl
cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/example.com-ssl.conf
vim /etc/apache2/sites-available/example.com-ssl.conf

#file example.com-ssl.conf
<IfModule mod_ssl.c>
        <VirtualHost adres.ip:443>
                ServerAdmin webmaster@example.com
                ServerName example.com:443
                DocumentRoot /var/www/example.com/public_html
                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined
                SSLEngine on
                SSLCertificateFile      /etc/ssl/certs/example.pem
                SSLCertificateKeyFile /etc/ssl/private/example.key
                <FilesMatch ".(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>

                BrowserMatch "MSIE [2-6]" 
                                nokeepalive ssl-unclean-shutdown 
                                downgrade-1.0 force-response-1.0
                # MSIE 7 and newer should be able to use keepalive
                BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

        </VirtualHost>
</IfModule>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
#end example.com-ssl.conf
a2ensite example.com-ssl.conf
service apache2 restart

#install application that will help you create your own certificates for vhosts

apt-get install ssl-cert

#when we will be ask about hostname enter domain name for page you want to create certificate

make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/ssl/private/www.example.com

cp /etc/ssl/private/www.example.com /etc/ssl/certs/www.example.com.pem

mv /etc/ssl/private/www.example.com /etc/ssl/private/www.example.com.key

#now we need to edit both files, the one in private dir need to have part about key

#file in certs dir need to have public-key part only

vim /etc/ssl/private/www.example.com.key

vim /etc/ssl/certs/www.example.com.pem

#secure private key from others

chmod 600 /etc/ssl/private/www.example.com.key

#enable ssl module for apache

a2enmod ssl

cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/example.com-ssl.conf

vim /etc/apache2/sites-available/example.com-ssl.conf

#file example.com-ssl.conf

ServerAdmin webmaster@example.com

ServerName example.com:443

DocumentRoot /var/www/example.com/public_html

ErrorLog ${APACHE_LOG_DIR}/error.log

CustomLog ${APACHE_LOG_DIR}/access.log combined

SSLEngine on

SSLCertificateFile /etc/ssl/certs/example.pem

SSLCertificateKeyFile /etc/ssl/private/example.key

SSLOptions +StdEnvVars

</FilesMatch>

SSLOptions +StdEnvVars

</Directory>

BrowserMatch "MSIE [2-6]"

nokeepalive ssl-unclean-shutdown

downgrade-1.0 force-response-1.0

# MSIE 7 and newer should be able to use keepalive

BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

#end example.com-ssl.conf

a2ensite example.com-ssl.conf

service apache2 restart

You can always go back and check those posts:

Linux – Apache Part 1: Instalation and configuration

or foward:

Linux – Apache Part 2: Enable SSL

Linux – Apache Part 3: PHP

Linux – Apache Part 4: MySQL and MariaDB Database

Linux – Apache Part 1: Instalation and configuration

Our own www server is sometimes needed when building webapp, it is also used in internal like in external networks.

Here is as simple recipe for it:

#set proper hostname
hostnamectl set-hostname nasz_hostname

vim /etc/hosts
#add this line to file
ip.address hostname.domain hostname

apt-get install apache2 apache2-doc apache2-utils

#disable default vhost
a2dissite 000-default.conf

#create your own vhost conf
vim /etc/apache2/sites-available/example.com.conf
<VirtualHost *:80> 
     ServerAdmin webmaster@example.com
     ServerName example.com
     ServerAlias www.example.com
     DocumentRoot /var/www/example.com/public_html/
     ErrorLog /var/www/example.com/logs/error.log 
     CustomLog /var/www/example.com/logs/access.log combined
</VirtualHost>

mkdir -p /var/www/example.net/public_html
mkdir /var/www/example.net/logs
a2ensite example.com.conf
service apache2 reload

#set proper hostname

hostnamectl set-hostname nasz_hostname

vim /etc/hosts

#add this line to file

ip.address hostname.domain hostname

apt-get install apache2 apache2-doc apache2-utils

#disable default vhost

a2dissite 000-default.conf

#create your own vhost conf

vim /etc/apache2/sites-available/example.com.conf

ServerAdmin webmaster@example.com

ServerName example.com

ServerAlias www.example.com

DocumentRoot /var/www/example.com/public_html/

ErrorLog /var/www/example.com/logs/error.log

CustomLog /var/www/example.com/logs/access.log combined

</VirtualHost>

mkdir -p /var/www/example.net/public_html

mkdir /var/www/example.net/logs

a2ensite example.com.conf

service apache2 reload

This configuration is proper for local use.

But if your server will be available outside your network then make those also:

vim /etc/apache2/conf-enabled/security.conf
#disable server signature
ServerSignature Off
ServerTokens Prod

vim /etc/apache2/conf-enabled/security.conf

#disable server signature

ServerSignature Off

ServerTokens Prod

vim /etc/apache2/apache2.conf
#disable directory listing and symlinks
<Directory /var/www/>
        #Options Indexes FollowSymLinks
        Options -Indexes
        AllowOverride All
        Require all granted
</Directory>

vim /etc/apache2/apache2.conf

#disable directory listing and symlinks

#Options Indexes FollowSymLinks

Options -Indexes

AllowOverride All

Require all granted

</Directory>

#add security module
apt-get install libapache2-modsecurity
/etc/init.d/apache2 restart

#remamber that you need to proper configure security module, which is not covered here

#add security module

apt-get install libapache2-modsecurity

/etc/init.d/apache2 restart

#remamber that you need to proper configure security module, which is not covered here

Next parts:

Linux – Apache Part 2: Enable SSL

Linux – Apache Part 3: PHP

Linux – Apache Part 4: MySQL and MariaDB Database

M	T	W	T	F	S	S
« Oct
			1	2	3	4
5	6	7	8	9	10	11
12	13	14	15	16	17	18
19	20	21	22	23	24	25
26	27	28	29	30