Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zabbix packages - upgrade to 3.0 #118

Closed
wants to merge 13 commits into from
Closed

zabbix packages - upgrade to 3.0 #118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
893d577
zabbix agent lts - fix merge conflict
dbaio Apr 22, 2016
41e803c
zabbix agent lts - upgrade to 3.0
dbaio Apr 12, 2016
4dede24
zabbix proxy lts - fix merge conflict
dbaio Apr 22, 2016
76789ad
zabbix proxy lts - upgrade to 3.0
dbaio Apr 12, 2016
4606bae
zabbix agent lts - fix merge conflict
dbaio Apr 22, 2016
6ecd9c4
net-mgmt/zabbix3-{server,proxy,agent}: Add SSL/TLS support
opsec Apr 5, 2016
e36810e
zabbix agent lts - tls-related changes
dbaio Apr 21, 2016
ca3abe6
zabbix agent lts - bump version
dbaio Apr 21, 2016
7c5bb65
zabbix agent lts - fix code
dbaio Apr 21, 2016
cb89afb
zabbix agent lts - fix permission
dbaio Apr 21, 2016
037cc2a
zabbix proxy lts - tls-related changes
dbaio Apr 21, 2016
ac5c30d
zabbix proxy lts - bump version
dbaio Apr 21, 2016
9a8e6c6
zabbix proxy lts - copy/paste fix
dbaio Apr 22, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions net-mgmt/pfSense-pkg-zabbix-agent/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

PORTNAME= pfSense-pkg-zabbix-agent
PORTVERSION= 0.8.9
PORTREVISION= 2
PORTREVISION= 4
CATEGORIES= net-mgmt
MASTER_SITES= # empty
DISTFILES= # empty
Expand All @@ -13,7 +13,7 @@ COMMENT= pfSense package zabbix-agent

LICENSE= ESF

RUN_DEPENDS= ${LOCALBASE}/sbin/zabbix_agent:net-mgmt/zabbix22-agent
RUN_DEPENDS= ${LOCALBASE}/sbin/zabbix_agentd:net-mgmt/zabbix3-agent

NO_BUILD= yes
NO_MTREE= yes
Expand Down
66 changes: 62 additions & 4 deletions net-mgmt/pfSense-pkg-zabbix-agent/files/usr/local/pkg/zabbix-agent-lts.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,12 @@ require_once("util.inc");
require_once("functions.inc");
require_once("pkg-utils.inc");
require_once("globals.inc");
require_once("certs.inc");

define('ZABBIX_AGENT_BASE', '/usr/local');

function php_deinstall_zabbix_agent_lts() {
unlink_if_exists(ZABBIX_AGENT_BASE . "/etc/zabbix22/zabbix_agentd.conf");
unlink_if_exists(ZABBIX_AGENT_BASE . "/etc/zabbix3/zabbix_agentd.conf");
unlink_if_exists("/var/log/zabbix-agent-lts/zabbix_agentd_lts.log");
unlink_if_exists("/var/run/zabbix-agent-lts/zabbix_agentd_lts.pid");

Expand Down Expand Up @@ -132,6 +133,44 @@ function sync_package_zabbix_agent_lts() {
$ListenIp = $zbagent_config['listenip'] ?: "0.0.0.0";
$ListenPort = $zbagent_config['listenport'] ?: "10050";
$TimeOut = $zbagent_config['timeout'] ?: "3";
$TLSConnect = $zbagent_config['tlsconnect'];
$TLSAccept = $zbagent_config['tlsaccept'] ?: "unencrypted";

if ($zbagent_config['tlscaso']) {
$TlsCAfile = "TLSCAFile=/usr/local/etc/ssl/cert.pem";
} else {
if ($zbagent_config['tlscafile'] != "none") {
$ca = lookup_ca($zbagent_config['tlscafile']);
zabbix_add_keyfile($ca['crt'], "ca");
$TlsCAfile = "TLSCAFile=/usr/local/etc/zabbix3/zabbix_agentd.ca";
}
}

if ($zbagent_config['tlscrlfile'] != "none") {
$crl = lookup_crl($zbagent_config['tlscrlfile']);
crl_update($crl);
zabbix_add_keyfile($crl['text'], "crl-verify");
$TlsCRLfile = "TLSCRLFile=/usr/local/etc/zabbix3/zabbix_agentd.crl-verify";
}

if ($zbagent_config['tlscertfile'] != "none") {
$cert = lookup_cert($zbagent_config['tlscertfile']);

zabbix_add_keyfile($cert['crt'], "cert");
$TlsCERTfile = "TLSCertFile=/usr/local/etc/zabbix3/zabbix_agentd.cert";

zabbix_add_keyfile($cert['prv'], "key");
$TlsKEYfile = "TLSKeyFile=/usr/local/etc/zabbix3/zabbix_agentd.key";
}

if (! empty($zbagent_config['tlspskidentity']) ) {
$TLSPSKIdentity = "TLSPSKIdentity={$zbagent_config['tlspskidentity']}";
}

if (! empty($zbagent_config['tlspskfile']) ) {
zabbix_add_keyfile($zbagent_config['tlspskfile'], "psk");
$TLSPSKFile = "TLSPSKFile=/usr/local/etc/zabbix3/zabbix_agentd.psk";
}

$zbagent_conf_file = <<< EOF
Server={$zbagent_config['server']}
Expand All @@ -148,10 +187,18 @@ Timeout={$TimeOut}
BufferSend={$BufferSend}
BufferSize={$BufferSize}
StartAgents={$StartAgents}
TLSConnect={$TLSConnect}
TLSAccept={$TLSAccept}
{$TlsCAfile}
{$TlsCRLfile}
{$TlsCERTfile}
{$TlsKEYfile}
{$TLSPSKIdentity}
{$TLSPSKFile}
{$UserParams}

EOF;
file_put_contents(ZABBIX_AGENT_BASE . "/etc/zabbix22/zabbix_agentd.conf", strtr($zbagent_conf_file, array("\r" => "")));
file_put_contents(ZABBIX_AGENT_BASE . "/etc/zabbix3/zabbix_agentd.conf", strtr($zbagent_conf_file, array("\r" => "")));
}
}

Expand Down Expand Up @@ -203,8 +250,8 @@ EOF;

// Check startup script files
// Create a few directories and ensure the sample files are in place
if (!is_dir(ZABBIX_AGENT_BASE . "/etc/zabbix22")) {
mwexec("/bin/mkdir -p " . ZABBIX_AGENT_BASE . "/etc/zabbix22");
if (!is_dir(ZABBIX_AGENT_BASE . "/etc/zabbix3")) {
mwexec("/bin/mkdir -p " . ZABBIX_AGENT_BASE . "/etc/zabbix3");
}

$dir_checks = <<< EOF
Expand Down Expand Up @@ -250,4 +297,15 @@ EOF;
conf_mount_ro();
}

// Based on openvpn_add_keyfile() function
function zabbix_add_keyfile(& $data, $directive) {
global $g;

$fpath = "/usr/local/etc/zabbix3/zabbix_agentd.{$directive}";

file_put_contents($fpath, base64_decode($data));
@chmod($fpath, 0600);
@chown($fpath, "zabbix");
}

?>
101 changes: 101 additions & 0 deletions net-mgmt/pfSense-pkg-zabbix-agent/files/usr/local/pkg/zabbix-agent-lts.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,107 @@
]]>
</description>
</field>
<field>
<name>TLS-RELATED Parameters</name>
<type>listtopic</type>
</field>
<field>
<fielddescr>TLS Connect</fielddescr>
<fieldname>tlsconnect</fieldname>
<description>
<![CDATA[
How the agent should connect to server or proxy. Used for active checks.<br/>
Only one value can be specified:<br/>
<strong>unencrypted</strong> - connect without encryption<br/>
<strong>psk</strong> - connect using TLS and a pre-shared key<br/>
<strong>cert</strong> - connect using TLS and a certificate<br/>
]]>
</description>
<type>select</type>
<default_value>unencrypted</default_value>
<options>
<option><name>unencrypted</name><value>unencrypted</value></option>
<option><name>psk</name><value>psk</value></option>
<option><name>cert</name><value>cert</value></option>
</options>
</field>
<field>
<fielddescr>TLS Accept</fielddescr>
<fieldname>tlsaccept</fieldname>
<description>
<![CDATA[
What incoming connections to accept.<br/>
Multiple values can be specified:<br/>
<strong>unencrypted</strong> - connect without encryption<br/>
<strong>psk</strong> - connect using TLS and a pre-shared key<br/>
<strong>cert</strong> - connect using TLS and a certificate<br/>
]]>
</description>
<type>select</type>
<default_value>unencrypted</default_value>
<options>
<option><name>unencrypted</name><value>unencrypted</value></option>
<option><name>psk</name><value>psk</value></option>
<option><name>cert</name><value>cert</value></option>
</options>
<multiple/>
<size>3</size>
</field>
<field>
<fielddescr>TLS CA</fielddescr>
<fieldname>tlscafile</fieldname>
<description>Top-level CA certificate for peer certificate verification.</description>
<type>select_source</type>
<source><![CDATA[$config['ca']]]></source>
<source_name>descr</source_name>
<source_value>refid</source_value>
<show_disable_value>none</show_disable_value>
<default_value>none</default_value>
</field>
<field>
<fielddescr>TLS CA System</fielddescr>
<fieldname>tlscaso</fieldname>
<description>Use the CA certificate list from the operating system. This option overrides prior option.</description>
<type>checkbox</type>
</field>
<field>
<fielddescr>TLS CRL</fielddescr>
<fieldname>tlscrlfile</fieldname>
<description>List of revoked certificates.</description>
<type>select_source</type>
<source><![CDATA[$config['crl']]]></source>
<source_name>descr</source_name>
<source_value>refid</source_value>
<show_disable_value>none</show_disable_value>
<default_value>none</default_value>
</field>
<field>
<fielddescr>TLS Cert</fielddescr>
<fieldname>tlscertfile</fieldname>
<description>Agent certificate.</description>
<type>select_source</type>
<source><![CDATA[$config['cert']]]></source>
<source_name>descr</source_name>
<source_value>refid</source_value>
<show_disable_value>none</show_disable_value>
<default_value>none</default_value>
</field>
<field>
<fielddescr>TLS PSK Identity</fielddescr>
<fieldname>tlspskidentity</fieldname>
<description>Unique, case sensitive string used to identify the pre-shared key.</description>
<type>input</type>
<size>60</size>
</field>
<field>
<fielddescr>TLS PSK</fielddescr>
<fieldname>tlspskfile</fieldname>
<encoding>base64</encoding>
<type>textarea</type>
<rows>5</rows>
<cols>50</cols>
<description></description>
</field>
<field>
<fielddescr>User Parameters</fielddescr>
<fieldname>userparams</fieldname>
Expand Down
4 changes: 2 additions & 2 deletions net-mgmt/pfSense-pkg-zabbix-proxy/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

PORTNAME= pfSense-pkg-zabbix-proxy
PORTVERSION= 0.8.9
PORTREVISION= 2
PORTREVISION= 4
CATEGORIES= net-mgmt
MASTER_SITES= # empty
DISTFILES= # empty
Expand All @@ -13,7 +13,7 @@ COMMENT= pfSense package zabbix-proxy

LICENSE= ESF

RUN_DEPENDS= ${LOCALBASE}/sbin/zabbix_proxy:net-mgmt/zabbix22-proxy
RUN_DEPENDS= ${LOCALBASE}/sbin/zabbix_proxy:net-mgmt/zabbix3-proxy

NO_BUILD= yes
NO_MTREE= yes
Expand Down
66 changes: 62 additions & 4 deletions net-mgmt/pfSense-pkg-zabbix-proxy/files/usr/local/pkg/zabbix-proxy-lts.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,12 @@ require_once("util.inc");
require_once("functions.inc");
require_once("pkg-utils.inc");
require_once("globals.inc");
require_once("certs.inc");

define('ZABBIX_PROXY_BASE', '/usr/local');

function php_deinstall_zabbix_proxy_lts() {
unlink_if_exists(ZABBIX_PROXY_BASE . "/etc/zabbix22/zabbix_proxy_lts.conf");
unlink_if_exists(ZABBIX_PROXY_BASE . "/etc/zabbix3/zabbix_proxy_lts.conf");
unlink_if_exists("/var/log/zabbix-proxy-lts/zabbix_proxy_lts.log");
unlink_if_exists("/var/run/zabbix-proxy-lts/zabbix_proxy_lts.pid");

Expand Down Expand Up @@ -84,6 +85,44 @@ function sync_package_zabbix_proxy_lts() {
if ($zbproxy_config['proxyenabled'] == "on") {
$Mode = (is_numericint($zbproxy_config['proxymode']) ? $zbproxy_config['proxymode'] : 0);
$AdvancedParams = base64_decode($zbproxy_config['advancedparams']);
$TLSConnect = $zbproxy_config['tlsconnect'];
$TLSAccept = $zbproxy_config['tlsaccept'] ?: "unencrypted";

if ($zbproxy_config['tlscaso']) {
$TlsCAfile = "TLSCAFile=/usr/local/etc/ssl/cert.pem";
} else {
if ($zbproxy_config['tlscafile'] != "none") {
$ca = lookup_ca($zbproxy_config['tlscafile']);
zabbix_add_keyfile($ca['crt'], "ca");
$TlsCAfile = "TLSCAFile=/usr/local/etc/zabbix3/zabbix_proxy.ca";
}
}

if ($zbproxy_config['tlscrlfile'] != "none") {
$crl = lookup_crl($zbproxy_config['tlscrlfile']);
crl_update($crl);
zabbix_add_keyfile($crl['text'], "crl-verify");
$TlsCRLfile = "TLSCRLFile=/usr/local/etc/zabbix3/zabbix_proxy.crl-verify";
}

if ($zbproxy_config['tlscertfile'] != "none") {
$cert = lookup_cert($zbproxy_config['tlscertfile']);

zabbix_add_keyfile($cert['crt'], "cert");
$TlsCERTfile = "TLSCertFile=/usr/local/etc/zabbix3/zabbix_proxy.cert";

zabbix_add_keyfile($cert['prv'], "key");
$TlsKEYfile = "TLSKeyFile=/usr/local/etc/zabbix3/zabbix_proxy.key";
}

if (! empty($zbproxy_config['tlspskidentity']) ) {
$TLSPSKIdentity = "TLSPSKIdentity={$zbproxy_config['tlspskidentity']}";
}

if (! empty($zbproxy_config['tlspskfile']) ) {
zabbix_add_keyfile($zbproxy_config['tlspskfile'], "psk");
$TLSPSKFile = "TLSPSKFile=/usr/local/etc/zabbix3/zabbix_proxy.psk";
}

$zbproxy_conf_file = <<< EOF
Server={$zbproxy_config['server']}
Expand All @@ -98,10 +137,18 @@ FpingLocation=/usr/local/sbin/fping
# but if there was, the binary would likely also be in /usr/local/sbin.
Fping6Location=/usr/local/sbin/fping6
ProxyMode={$Mode}
TLSConnect={$TLSConnect}
TLSAccept={$TLSAccept}
{$TlsCAfile}
{$TlsCRLfile}
{$TlsCERTfile}
{$TlsKEYfile}
{$TLSPSKIdentity}
{$TLSPSKFile}
{$AdvancedParams}

EOF;
file_put_contents(ZABBIX_PROXY_BASE . "/etc/zabbix22/zabbix_proxy.conf", strtr($zbproxy_conf_file, array("\r" => "")));
file_put_contents(ZABBIX_PROXY_BASE . "/etc/zabbix3/zabbix_proxy.conf", strtr($zbproxy_conf_file, array("\r" => "")));
}
}

Expand Down Expand Up @@ -153,8 +200,8 @@ EOF;

// Check startup script files
// Create a few directories and ensure the sample files are in place
if (!is_dir(ZABBIX_PROXY_BASE . "/etc/zabbix22")) {
mwexec("/bin/mkdir -p " . ZABBIX_PROXY_BASE . "/etc/zabbix22");
if (!is_dir(ZABBIX_PROXY_BASE . "/etc/zabbix3")) {
mwexec("/bin/mkdir -p " . ZABBIX_PROXY_BASE . "/etc/zabbix3");
}

$dir_checks = <<< EOF
Expand Down Expand Up @@ -218,4 +265,15 @@ EOF;
conf_mount_ro();
}

// Based on openvpn_add_keyfile() function
function zabbix_add_keyfile(& $data, $directive) {
global $g;

$fpath = "/usr/local/etc/zabbix3/zabbix_proxy.{$directive}";

file_put_contents($fpath, base64_decode($data));
@chmod($fpath, 0600);
@chown($fpath, "zabbix");
}

?>
Loading