From patchwork Wed Feb 28 18:58:34 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Robin Roevens X-Patchwork-Id: 7566 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4TlPMV2LWZz3wmD for ; Wed, 28 Feb 2024 19:20:38 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4TlPMP56d2z2NG; Wed, 28 Feb 2024 19:20:33 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4TlPMP4PPsz32bK; Wed, 28 Feb 2024 19:20:33 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4TlPMK6HJdz32bK for ; Wed, 28 Feb 2024 19:20:29 +0000 (UTC) Received: from layka.disroot.org (layka.disroot.org [178.21.23.139]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPS id 4TlPMJ1ry3z1XD for ; Wed, 28 Feb 2024 19:20:28 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=disroot.org header.s=mail header.b=D16oece2; dmarc=pass (policy=reject) header.from=disroot.org; spf=pass (mail01.ipfire.org: domain of robin.roevens@disroot.org designates 178.21.23.139 as permitted sender) smtp.mailfrom=robin.roevens@disroot.org ARC-Seal: i=1; s=202003rsa; d=lists.ipfire.org; t=1709148028; a=rsa-sha256; cv=none; b=LLB57QYq/bpmsTYUoZRGQFkbcyIBsAJP/jkV7DD65Tnsziw49wHo1h8X42gp+/rDHNHCcr sGLGozi4JfPgpmIUUEtQJvxYUXQxMIv0fgSD2Kkx2nrUzvIE0hp6aPR9CEag7ljv4bIBZ2 Ekxa9W57deVkA6ghxnvwRIz7830Lsn5uTbQIMNdoIyP7tI3+qaOD/TGQ92nFSNf1wZMiQ7 82pBdbG5LdZFvYnCOC6TuJK2P0yreoF1eQsWDW1FJoBErKFs+I+NX4wm3KGh8THwb+6qBV C3Gy7uj2JSf8DZSZy4JSyDipNjtYqDlGqmEHIPwUfqnbvt86X4X1YE8Rfvz9kw== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=disroot.org header.s=mail header.b=D16oece2; dmarc=pass (policy=reject) header.from=disroot.org; spf=pass (mail01.ipfire.org: domain of robin.roevens@disroot.org designates 178.21.23.139 as permitted sender) smtp.mailfrom=robin.roevens@disroot.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1709148028; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Nswrd1c2WgY1rPEg8rF2qkKY3yslCL+GrJ9mihHJUGc=; b=Snb+dA1u01xVvkSed+pOzHZ/wbk5mJeuzkFCUZ6fY7D7/ILHGy1FYPhtUJESvExryolSZJ N1e/2nFRE3DSe5mpsNcKbURoZ+hWk0KYAbY7bqtwPDsYTrjnjUMXl5u0g4A1+lQ9z5sXrq GFdtkmMllp+ejU1OghEWaSb5Jk9UFW8QTqKTHEC0FCF+91f1/42dPP1cHv7ApAI7QdHrd0 h1bxevb/sD4uqwwwtslrQHI+KUlGG68Kl6Q5MUhILUttKlYUk0ZNA9cKDlWsc75aia9in6 nTQzK+zG/8O0N7TEu5WX7PF7NaIufXb4dtrDe1blHqkWcaL0Dn8OgiYc2MX+VA== Received: from localhost (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id 6D1AE41943 for ; Wed, 28 Feb 2024 20:20:27 +0100 (CET) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2t2a9pEhDGFz for ; Wed, 28 Feb 2024 20:20:25 +0100 (CET) Received: from chojin.sicho.home (amaterasu.sicho.home [192.168.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (no client certificate requested) (Authenticated sender) by hachiman (MailScanner Milter) with SMTP id 80D3718A0F3; Wed, 28 Feb 2024 20:20:19 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1709148025; bh=JSvPBr8CVn6AaMfflpLFe21ZL5Iboy4+InaY4TFw2L8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=D16oece2AV9H8dzpTG0DMZfmSAkz5m/fW0hgXE69N55DPPznMU2YzF+svsTc0HbKH 1BBE9QimWZANT3tzw75oXao2ic3iXpP2TXhyn9LWUj42IeqZu8xBaD7DeqlraVm0zM KaxdvzKs7lnnA86hzmpOnBKtxOkz0+ymS/NAvKyrhWTGDkUzZrET7RTB5Xusf5E4jI FGK5NEy+reserN0HLNWEuEJ4JEjA4D61RUJ7oE25RL+7wiTvFl2lHuEjptxuZg4+gy im7hyet1qjLS8xdPzi6AWRssPGJL2NsqKK5goTENSkfMHAXvaYNfUmLjF8fI58Ross YN5qhvF/Rhymg== From: Robin Roevens To: development@lists.ipfire.org Subject: [PATCH 1/3] zabbix_agentd: Update to 6.0.27 (LTS) Date: Wed, 28 Feb 2024 19:58:34 +0100 Message-ID: <20240228191952.28258-2-robin.roevens@disroot.org> In-Reply-To: <20240228191952.28258-1-robin.roevens@disroot.org> References: <20240228191952.28258-1-robin.roevens@disroot.org> MIME-Version: 1.0 X-sicho-MailScanner-ID: 80D3718A0F3.A8A80 X-sicho-MailScanner: Found to be clean X-sicho-MailScanner-From: robin.roevens@disroot.org X-sicho-MailScanner-Watermark: 1709752819.95016@XNj0azaVwFynkB2066vtpw X-Rspamd-Queue-Id: 4TlPMJ1ry3z1XD X-Spamd-Result: default: False [-3.07 / 11.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM(-1.00)[-1.000]; DMARC_POLICY_ALLOW(-0.50)[disroot.org,reject]; R_MISSING_CHARSET(0.50)[]; SPF_REPUTATION_SPAM(0.44)[0.14779301462933]; R_SPF_ALLOW(-0.20)[+a]; R_DKIM_ALLOW(-0.20)[disroot.org:s=mail]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.01)[]; IP_REPUTATION_HAM(-0.01)[asn: 50673(0.00), country: NL(-0.01), ip: 178.21.23.139(0.00)]; RCPT_COUNT_TWO(0.00)[2]; PREVIOUSLY_DELIVERED(0.00)[development@lists.ipfire.org]; ARC_NA(0.00)[]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; ASN(0.00)[asn:50673, ipnet:178.21.23.0/24, country:NL]; DKIM_REPUTATION(0.00)[0]; FUZZY_BLOCKED(0.00)[rspamd.com]; MISSING_XM_UA(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[disroot.org:+]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mail01.haj.ipfire.org Message-ID-Hash: GMWN2D2YFAWWWTGTDWFA5BPMEROIECJC X-Message-ID-Hash: GMWN2D2YFAWWWTGTDWFA5BPMEROIECJC X-MailFrom: robin.roevens@disroot.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: - Update from version 6.0.22 to 6.0.27 - Update of rootfile not required Bugs fixed: - ZBX-23715: Fixed persistent directory path not following symlinks upon creation - ZBX-22933: Improved vfs.file.regmatch and vfs.file.regexp items to use buffered file read Full changelogs since 6.0.22: - https://www.zabbix.com/rn/rn6.0.23 - https://www.zabbix.com/rn/rn6.0.24 - https://www.zabbix.com/rn/rn6.0.25 - https://www.zabbix.com/rn/rn6.0.26 - https://www.zabbix.com/rn/rn6.0.27 Reviewed-by: Adolf Belka --- lfs/zabbix_agentd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd index 0033d9a2c..65e111d2f 100644 --- a/lfs/zabbix_agentd +++ b/lfs/zabbix_agentd @@ -26,7 +26,7 @@ include Config SUMMARY = Zabbix Agent -VER = 6.0.22 +VER = 6.0.27 THISAPP = zabbix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = zabbix_agentd -PAK_VER = 11 +PAK_VER = 12 DEPS = fping @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = bba7911a24b00827c58d84938b5786d07f1eb44cbcad94cddf68b484ac9a2f514beb60225d006b8cefc5bbf92e51da27f26d9f6681e10f6322ed0841394e8d9d +$(DL_FILE)_BLAKE2 = 793bb887bd8f0d3c2f3d15a4ed9bb5b1fcfb13fcf80ea077672744a1bd8524e213eaf53291e0f9eecb9eb055fee6f1e29e91f890b54698906beac21ca54db4e9 install : $(TARGET) From patchwork Wed Feb 28 18:58:35 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Robin Roevens X-Patchwork-Id: 7567 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4TlPMW1wJZz3wvx for ; Wed, 28 Feb 2024 19:20:39 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4TlPMP6nLsz3Lc; Wed, 28 Feb 2024 19:20:33 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4TlPMP61Nkz32gx; Wed, 28 Feb 2024 19:20:33 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4TlPML5TXBz3009 for ; Wed, 28 Feb 2024 19:20:30 +0000 (UTC) Received: from layka.disroot.org (layka.disroot.org [178.21.23.139]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPS id 4TlPMK2qghz2Jv for ; Wed, 28 Feb 2024 19:20:29 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=disroot.org header.s=mail header.b=QF8ObTPF; dmarc=pass (policy=reject) header.from=disroot.org; spf=pass (mail01.ipfire.org: domain of robin.roevens@disroot.org designates 178.21.23.139 as permitted sender) smtp.mailfrom=robin.roevens@disroot.org ARC-Seal: i=1; s=202003rsa; d=lists.ipfire.org; t=1709148029; a=rsa-sha256; cv=none; b=SdwWe8d3dtOZyAbCqxqAu1RgkN6umjAfYm3aPYoXyz6PyxT0N2QbnNT/tFPM7Qayj+AtTS i70mcvMV9XU3hUK04xtV6useXJgGDa1dG9pIODG9pHVPdBTr4+8lwwtRKZvVqMS1eET1Ua Sn7sykNV1gOJy80eXNszJTrTrY6yBEAL6yQYamIjiga/VrNmMJXTXWwKL2pLrdEUhe9lB/ LkUhW/Z8Cep4gg2TTjGrUxfCgf9iPGpqB5GZbhehRZTovupK0g3oSs5L01Agn5lCOgJMT8 8nXIe71jY17jMW1b5S0MKa+OQ73Y3p0c6Lo/+EMDaoxi5neBxOcQyHWL019Qog== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=disroot.org header.s=mail header.b=QF8ObTPF; dmarc=pass (policy=reject) header.from=disroot.org; spf=pass (mail01.ipfire.org: domain of robin.roevens@disroot.org designates 178.21.23.139 as permitted sender) smtp.mailfrom=robin.roevens@disroot.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1709148029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=2D/780I4u0cFPPccHJJ9fKdf627GtLYlaI7z7I7F1i4=; b=LQz8PkHy3gMttWvdizOIjHKzRaX0ToHfY2mKuYF/XknlM4ixFVNDcJn+csm+DCAuzk5Aye cVHw4jsfKyO1cVB0ETLNDcNuhkLeYfZkbzOF4ks3cNdC9QYWqUdsfUohnLPYhfJsn2SiRH u7eJtTFsnO7ZzOZZj49s0/vm2UFn6wrOiWELYziEBkOYE9VO8lo1tOAgKbExrlTIbh0Udm 4jno4AeiBYGdos0PWJLU4e90uLGI42lA5ljR9+CaUxmogNLPmlYaT0Sebtpleu1x3nd4sK G0omfta32nZNLNaPjXRf/PJgQAQ8GXlRuf2mfrzZDAEzOiPkwsh5cI9slUe0IQ== Received: from localhost (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id AB8C44142E for ; Wed, 28 Feb 2024 20:20:28 +0100 (CET) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2UPXH0GgMoZU for ; Wed, 28 Feb 2024 20:20:26 +0100 (CET) Received: from chojin.sicho.home (amaterasu.sicho.home [192.168.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (no client certificate requested) (Authenticated sender) by hachiman (MailScanner Milter) with SMTP id 997F918A0F6; Wed, 28 Feb 2024 20:20:19 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1709148026; bh=YGZOVL/h2gf/6o7VW6vY1ywg9dVsvljLBA1ZNHcSJ1I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QF8ObTPFB2g4iQKT78hVxR7NEZM+uQ4xsYKMZDIwWDDcThG54VlftrJPwONxi2PgI Q3Y8DH9ptPJmp7gY7KyY8VnyWsR90PkdkttqG+fRy2Ub2Moigk8eCKATSITNMY4h1u /Ds/jRsmnhorcZPc2IFSTc5KU/tO7Vgou6r87JNuvE4rY8Ouj7I1SeN2/czPELEBzQ cx8UGhuO9bHV3M3JTlOJH+G6VgLIfN+yTl9FXX+rSJnED2bR/zSZXQQmWxSuvsXLjT e3kcNPxExcnhKVHSPqayjVu6NuCMBMRUF5o/XpT+56LNrSUZsxge9ig3RoRRdZ8eut kaaZ0BKttcy7w== From: Robin Roevens To: development@lists.ipfire.org Subject: [PATCH 2/3] zabbix_agentd: Add helper script to get and verify certificate details Date: Wed, 28 Feb 2024 19:58:35 +0100 Message-ID: <20240228191952.28258-3-robin.roevens@disroot.org> In-Reply-To: <20240228191952.28258-1-robin.roevens@disroot.org> References: <20240228191952.28258-1-robin.roevens@disroot.org> MIME-Version: 1.0 X-sicho-MailScanner-ID: 997F918A0F6.A8A80 X-sicho-MailScanner: Found to be clean X-sicho-MailScanner-From: robin.roevens@disroot.org X-sicho-MailScanner-Watermark: 1709752819.95121@JJxClYKcrnKfKGPUVqIsJQ X-Rspamd-Queue-Id: 4TlPMK2qghz2Jv X-Spamd-Result: default: False [-2.60 / 11.00]; BAYES_HAM(-2.51)[97.81%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM(-1.00)[-1.000]; DMARC_POLICY_ALLOW(-0.50)[disroot.org,reject]; R_MISSING_CHARSET(0.50)[]; SPF_REPUTATION_SPAM(0.44)[0.14513598913944]; R_SPF_ALLOW(-0.20)[+a:c]; R_DKIM_ALLOW(-0.20)[disroot.org:s=mail]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.01)[]; IP_REPUTATION_HAM(-0.01)[asn: 50673(0.00), country: NL(-0.01), ip: 178.21.23.139(0.00)]; RCPT_COUNT_TWO(0.00)[2]; PREVIOUSLY_DELIVERED(0.00)[development@lists.ipfire.org]; FUZZY_BLOCKED(0.00)[rspamd.com]; MIME_TRACE(0.00)[0:+]; ARC_NA(0.00)[]; TO_DN_SOME(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; ASN(0.00)[asn:50673, ipnet:178.21.23.0/24, country:NL]; DKIM_REPUTATION(0.00)[0]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; MISSING_XM_UA(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[disroot.org:+]; FROM_HAS_DN(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mail01.haj.ipfire.org Message-ID-Hash: LWHO32RS234FPXIALVXBQUDNGAN6ASZL X-Message-ID-Hash: LWHO32RS234FPXIALVXBQUDNGAN6ASZL X-MailFrom: robin.roevens@disroot.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Add script to parse openssl output on certificates and return it as JSON for consumption by the Zabbix agent. Reviewed-by: Adolf Belka --- .../ipfire_certificate_detail.sh | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100755 config/zabbix_agentd/ipfire_certificate_detail.sh diff --git a/config/zabbix_agentd/ipfire_certificate_detail.sh b/config/zabbix_agentd/ipfire_certificate_detail.sh new file mode 100755 index 000000000..9ca0ef5de --- /dev/null +++ b/config/zabbix_agentd/ipfire_certificate_detail.sh @@ -0,0 +1,91 @@ +#!/bin/bash +############################################################################### +# ipfire_certificate_detail.sh - Get certificate details and validation results +# in JSON format for use by Zabbix agent +# +# Author: robin.roevens (at) disroot.org +# Version: 1.0 +# +# Copyright (C) 2007-2024 IPFire Team +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +############################################################################### + +# Required binaries +OPENSSL=/usr/bin/openssl +DATE=/bin/date + +# Parameter checking +[[ $1 ]] || { echo "{\"error\":\"No CA certificate file given.\"}"; exit 1; } +[[ -f $1 ]] || { echo "{\"error\":\"CA certificate not found: $1.\"}"; exit 1; } +[[ -r $1 ]] || { echo "{\"error\":\"No read permission on CA certificate: $1.\"}"; exit 1; } +[[ $2 ]] || { echo "{\"error\":\"No certificate file given.\"}"; exit 1; } +[[ -f $2 ]] || { echo "{\"error\":\"Certificate not found: $2.\"}"; exit 1; } +[[ -r $2 ]] || { echo "{\"error\":\"No read permission on certificate $2.\"}"; exit 1; } +[[ -x $OPENSSL ]] || { echo "{\"error\":\"$OPENSSL binary not found or no permission.\"}"; exit 1; } +[[ -x $DATE ]] || { echo "{\"error\":\"$DATE binary not found or no permission.\"}"; exit 1; } + +cafile=$1 +cert=$2 + +# Parse certificate details +cert_details=$(${OPENSSL} x509 -in "${cert}" -noout -text -certopt no_header,no_sigdump) +version=$(echo "${cert_details}" | grep "Version:" | sed 's/^ \+Version: \([0-9]\+\) (.\+)$/\1/g') +serial_number=$(echo "${cert_details}" | grep -A1 "Serial Number:" | tr -d '\n' | sed 's/^ \+Serial Number:\(\( \(.*\) ([0-9]\+x[0-9]\+).*\)\|\( \+\(.*\)$\)\)/\3\5/g') +signature_algorithm=$(echo "${cert_details}" | grep "Signature Algorithm:" | sed 's/^ \+Signature Algorithm: //g') +issuer=$(echo "${cert_details}" | grep "Issuer:" | sed 's/^ \+Issuer: //g' | sed 's/"/\\"/g') +not_before_value=$(echo "${cert_details}" | grep "Not Before:" | sed 's/^ \+Not Before: //g') +not_before_timestamp=$(${DATE} -d "${not_before_value}" +%s) +not_after_value=$(echo "${cert_details}" | grep "Not After :" | sed 's/^ \+Not After : //g') +not_after_timestamp=$(${DATE} -d "${not_after_value}" +%s) +subject=$(echo "${cert_details}" | grep "Subject:" | sed 's/^ \+Subject: //g' | sed 's/"/\\"/g') +public_key_algorithm=$(echo "${cert_details}" | grep "Public Key Algorithm:" | sed 's/^ \+Public Key Algorithm: //g') + +# Verify certificate +cert_verify=$(${OPENSSL} verify -CAfile "${cafile}" "${cert}" 2>&1) +if [[ $? != 0 ]]; then + result_value="invalid" + result_message="failed to verify certificate: x509: $(echo "${cert_verify}" | grep -E "error [0-9]+" | sed 's/^.\+: \(.\+\)/\1/g')" +else + result_value="valid" + result_message="certificate verified successfully" +fi + +# Generate fingerprints +sha1_fingerprint=$(${OPENSSL} x509 -in "${cert}" -noout -fingerprint -sha1 | cut -d= -f2) +sha256_fingerprint=$(${OPENSSL} x509 -in "${cert}" -noout -fingerprint -sha256 | cut -d= -f2) + +# Print certificate details in JSON +echo -n "{\"x509\":{" +echo -n "\"version\":\"${version}\"," +echo -n "\"serial_number\":\"${serial_number}\"," +echo -n "\"signature_algorithm\":\"${signature_algorithm}\"," +echo -n "\"issuer\":\"${issuer}\"," +echo -n "\"not_before\":{" +echo -n "\"value\":\"${not_before_value}\"," +echo -n "\"timestamp\":\"${not_before_timestamp}\"}," +echo -n "\"not_after\":{" +echo -n "\"value\":\"${not_after_value}\"," +echo -n "\"timestamp\":\"${not_after_timestamp}\"}," +echo -n "\"subject\":\"${subject}\"," +echo -n "\"public_key_algorithm\":\"${public_key_algorithm}\"}," +echo -n "\"result\":{" +echo -n "\"value\":\"${result_value}\"," +echo -n "\"message\":\"${result_message}\"}," +echo -n "\"sha1_fingerprint\":\"${sha1_fingerprint}\"," +echo -n "\"sha256_fingerprint\":\"${sha256_fingerprint}\"" +echo -n "}" + +exit 0 \ No newline at end of file From patchwork Wed Feb 28 18:58:36 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Robin Roevens X-Patchwork-Id: 7565 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4TlPMS3qR4z3wvx for ; Wed, 28 Feb 2024 19:20:36 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4TlPMP2vZgz1FC; Wed, 28 Feb 2024 19:20:33 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4TlPMP29Ynz32W7; Wed, 28 Feb 2024 19:20:33 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4TlPMK6BLxz3009 for ; Wed, 28 Feb 2024 19:20:29 +0000 (UTC) Received: from layka.disroot.org (layka.disroot.org [178.21.23.139]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPS id 4TlPMJ249Gz2Jq for ; Wed, 28 Feb 2024 19:20:28 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=disroot.org header.s=mail header.b=OUcqIEpn; dmarc=pass (policy=reject) header.from=disroot.org; spf=pass (mail01.ipfire.org: domain of robin.roevens@disroot.org designates 178.21.23.139 as permitted sender) smtp.mailfrom=robin.roevens@disroot.org ARC-Seal: i=1; s=202003rsa; d=lists.ipfire.org; t=1709148028; a=rsa-sha256; cv=none; b=Sd0eYQF4mQGX5GjVmXT/c0RzDalpl+A2dtBifRAnsWfBRS4tGTnytfFnAm4f8eWu3vWjFI iUO6YB2AHG68oJnVD5Wvk36DNpMK5MMuiJ1WZvH+Ct1/UVcxVOX0JFUzLHcErJyL5oCEKr UayhlY9qjDEpcHLaIu+3XSGhr/ds/tuzRznTxn1eT3nlHwM1ApkJJtOG0ZCsLNRR6gWNbu i+t4pDtDgCyNE0/sehLrwyilZGV+iLhiZFRTAmj/0Vfu5L1Gc0oAEO3/gNdAhRD61U/qLT K7p9gurml9sc0eiVbT02ZL6lH1EtrO2Tnh21vORwsi/eWkH6BeUkCQ79vuoOXQ== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=disroot.org header.s=mail header.b=OUcqIEpn; dmarc=pass (policy=reject) header.from=disroot.org; spf=pass (mail01.ipfire.org: domain of robin.roevens@disroot.org designates 178.21.23.139 as permitted sender) smtp.mailfrom=robin.roevens@disroot.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1709148028; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=DOAUNNfRLdDA3kdLrISzM/3O4tZKAhKbeaYDc7XNEQA=; b=EdDFAT8xGphLQlJWVsssiWlySYpodVg2CQGo1jhfWzW/6WncCTMTRoGCdydmOd7ukWpoDm 3Mfw57LZXnI3XQRdOhEgFo3S/1hHRqT5mMuLqAoerJWrrP50I3rSEyK5EJ+JJ/TDhycm3g ClqUzQLJp7bbfL0aK9cbEPd8PE53Vn/PALUBDtr5IanQUKwwjQ1zUsuE+/1aD2CGVKBQwi Oxr2+N8b+m6jQAjwFZdXKsLqSxh0naf5C88FZXSzpyY30TZEGHPyOcCP6wWzSh0DcPwOA6 fviSKGigXcNO/j0rgLMEO8T80PHiBIUCHo340mYBzoMJf2zLmdhJt8KDUf/lfw== Received: from localhost (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id A0090411D7 for ; Wed, 28 Feb 2024 20:20:27 +0100 (CET) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id daAZbhVy67t2 for ; Wed, 28 Feb 2024 20:20:26 +0100 (CET) Received: from chojin.sicho.home (amaterasu.sicho.home [192.168.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (no client certificate requested) (Authenticated sender) by hachiman (MailScanner Milter) with SMTP id A8C6318A0F9; Wed, 28 Feb 2024 20:20:19 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1709148026; bh=viL5WOe3v6L5+FkoqUaCdBcc7O6/GphLRUpYC+SWPjY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OUcqIEpnauHKOnnW82xl8C1ncKev79Yvnyy+OSjjiFgVqTFi5HvPi2q5B8vvoCr30 zTdrporW0zoiPdHbqy6BkwYRG61fkbkpNjstDsSdh6ESQINqbZBTEFkywDPHOIBGaz ab5X9pZHTSTPbS2Pd+JZcDJY8llzRKQns4Oi1T1ZVPQr/dIN7Balve9JUy4gjYKZTg qQNUwogU8xsnPT1CqYe5PzLF97pkarxOvZ6w7AUgx+UNSZ06i2TevyIKDNwRFvUPXI zzbbEkpdav7js18uuAhOBkaq1rOYmP8VsgaBcFu5HcDMeV1TvTHduM0Wi7zJZNA2wB v71cw+Hzr1V3Q== From: Robin Roevens To: development@lists.ipfire.org Subject: [PATCH 3/3] zabbix_agentd: Add OpenVPN certificates items Date: Wed, 28 Feb 2024 19:58:36 +0100 Message-ID: <20240228191952.28258-4-robin.roevens@disroot.org> In-Reply-To: <20240228191952.28258-1-robin.roevens@disroot.org> References: <20240228191952.28258-1-robin.roevens@disroot.org> MIME-Version: 1.0 X-sicho-MailScanner-ID: A8C6318A0F9.A8A80 X-sicho-MailScanner: Found to be clean X-sicho-MailScanner-From: robin.roevens@disroot.org X-sicho-MailScanner-Watermark: 1709752819.99164@zbvyao6b+5Q7/9o/xtUlMg X-Rspamd-Queue-Id: 4TlPMJ249Gz2Jq X-Spamd-Result: default: False [-3.07 / 11.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM(-1.00)[-1.000]; DMARC_POLICY_ALLOW(-0.50)[disroot.org,reject]; R_MISSING_CHARSET(0.50)[]; SPF_REPUTATION_SPAM(0.44)[0.14779301462933]; R_SPF_ALLOW(-0.20)[+a]; R_DKIM_ALLOW(-0.20)[disroot.org:s=mail]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.01)[]; IP_REPUTATION_HAM(-0.01)[asn: 50673(0.00), country: NL(-0.01), ip: 178.21.23.139(0.00)]; RCPT_COUNT_TWO(0.00)[2]; PREVIOUSLY_DELIVERED(0.00)[development@lists.ipfire.org]; FUZZY_BLOCKED(0.00)[rspamd.com]; MIME_TRACE(0.00)[0:+]; ARC_NA(0.00)[]; TO_DN_SOME(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; ASN(0.00)[asn:50673, ipnet:178.21.23.0/24, country:NL]; DKIM_REPUTATION(0.00)[0]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; MISSING_XM_UA(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[disroot.org:+]; FROM_HAS_DN(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mail01.haj.ipfire.org Message-ID-Hash: VJVNH4R4FDGDL4L46ZCZ3QDCE6HTRQL7 X-Message-ID-Hash: VJVNH4R4FDGDL4L46ZCZ3QDCE6HTRQL7 X-MailFrom: robin.roevens@disroot.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: - Adds Zabbix Agent userparameters `ipfire.ovpn.clientcert` and `ipfire.ovpn.cacert` for the agent to get details about openvpn client, server and ca certificates. - Moves all `ipfire.ovpn.*` userparameters to a separate config file `userparameter_ovpn.conf` to enable users to selectively disable openvpn items when not needed - Includes `ipfire_certificate_detail.sh` script in sudoers for Zabbix Agent as it needs root permission to read openvpn certificate details. - Adapts lfs install script to install new script and configfile - Adds new script and configfile to rootfiles Reviewed-by: Adolf Belka --- config/rootfiles/packages/zabbix_agentd | 3 +++ config/zabbix_agentd/sudoers | 1 + config/zabbix_agentd/userparameter_ipfire.conf | 8 +------- config/zabbix_agentd/userparameter_ovpn.conf | 13 +++++++++++++ lfs/zabbix_agentd | 7 +++++++ 5 files changed, 25 insertions(+), 7 deletions(-) create mode 100644 config/zabbix_agentd/userparameter_ovpn.conf diff --git a/config/rootfiles/packages/zabbix_agentd b/config/rootfiles/packages/zabbix_agentd index 729a47ac6..8e10cb4c8 100644 --- a/config/rootfiles/packages/zabbix_agentd +++ b/config/rootfiles/packages/zabbix_agentd @@ -20,3 +20,6 @@ var/ipfire/zabbix_agentd/zabbix_agentd_ipfire_mandatory.conf var/ipfire/zabbix_agentd/userparameters var/ipfire/zabbix_agentd/userparameters/userparameter_pakfire.conf var/ipfire/zabbix_agentd/userparameters/userparameter_ipfire.conf +var/ipfire/zabbix_agentd/userparameters/userparameter_ovpn.conf +var/ipfire/zabbix_agentd/scripts +var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh diff --git a/config/zabbix_agentd/sudoers b/config/zabbix_agentd/sudoers index d93ec5d55..138c75635 100644 --- a/config/zabbix_agentd/sudoers +++ b/config/zabbix_agentd/sudoers @@ -9,3 +9,4 @@ # Defaults:zabbix !requiretty zabbix ALL=(ALL) NOPASSWD: /opt/pakfire/pakfire status, /usr/sbin/fping, /usr/local/bin/getipstat, /bin/cat /var/run/ovpnserver.log +zabbix ALL=(ALL) NOPASSWD: /var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh diff --git a/config/zabbix_agentd/userparameter_ipfire.conf b/config/zabbix_agentd/userparameter_ipfire.conf index ba0c6c2ca..d2d0c8307 100644 --- a/config/zabbix_agentd/userparameter_ipfire.conf +++ b/config/zabbix_agentd/userparameter_ipfire.conf @@ -9,10 +9,4 @@ UserParameter=ipfire.net.fw.hits.raw,sudo /usr/local/bin/getipstat -xf | grep "/ # Number of currently Active DHCP leases UserParameter=ipfire.dhcpd.clients,grep -s -E 'lease|bind' /var/state/dhcp/dhcpd.leases | sed ':a;/{$/{N;s/\n//;ba}' | grep "state active" | wc -l # Number of Captive Portal clients -UserParameter=ipfire.captive.clients,awk -F ',' 'length($2) == 17 {sum += 1} END {if (length(sum) == 0) print 0; else print sum}' /var/ipfire/captive/clients -# Discovery of configured ovpn clients -UserParameter=ipfire.ovpn.clients.discovery,cat /var/ipfire/ovpn/ovpnconfig 2>/dev/null | awk -F',' 'BEGIN { ORS = ""; print "[" } { printf "%s{\"{#NAME}\":\"%s\",\"{#COMMONNAME}\":\"%s\",\"{#STATE}\":\"%s\",\"{#REMARK}\":\"%s\",\"{#TYPE}\":\"%s\"}", separator, $3, $4, $2, $27, $5; separator = ","; } END { print "]" }' -# Get OpenVPN status report -UserParameter=ipfire.ovpn.statusreport.get,sudo cat /var/run/ovpnserver.log 2>/dev/null | awk -F"," 'function unixtime(t) { gsub(/[-:]/," ",t); return mktime(t) } BEGIN { ORS = ""; print "{" } /^Updated,.+/ { printf "\"timestamp\":%s,\"clients\":[",unixtime($2) } /^.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,[0-9]+,[0-9]+,.+/ { if ($1 != "Common Name") { printf "%s{\"common_name\":\"%s\",\"real_address\":\"%s\",\"bytes_in\":\"%s\",\"bytes_out\":\"%s\",\"connected_since\":\"%s\"}", separator, $1, $2, $3, $4, unixtime($5); separator = ","; } } /^ROUTING TABLE/ { print "],\"routing_table\":["; separator = "" } /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,.+/ { if ($1 != "Virtual Address") { printf "%s{\"common_name\":\"%s\",\"virtual_address\":\"%s\",\"real_address\":\"%s\",\"last_ref\":\"%s\"}", separator, $2, $1, $3, unixtime($4); separator = "," } } END { print "]}" }' -# Allow item key to be called with (unused) parameters. This allows the #SINGLETON method of discovering this item only when openvpn service is active -Alias=ipfire.ovpn.statusreport.get[]:ipfire.ovpn.statusreport.get \ No newline at end of file +UserParameter=ipfire.captive.clients,awk -F ',' 'length($2) == 17 {sum += 1} END {if (length(sum) == 0) print 0; else print sum}' /var/ipfire/captive/clients \ No newline at end of file diff --git a/config/zabbix_agentd/userparameter_ovpn.conf b/config/zabbix_agentd/userparameter_ovpn.conf new file mode 100644 index 000000000..a7a6d8535 --- /dev/null +++ b/config/zabbix_agentd/userparameter_ovpn.conf @@ -0,0 +1,13 @@ +# Parameters for monitoring IPFire OpenVPN specific metrics +# +# Discovery of configured ovpn clients +UserParameter=ipfire.ovpn.clients.discovery,cat /var/ipfire/ovpn/ovpnconfig 2>/dev/null | awk -F',' 'BEGIN { ORS = ""; print "[" } { printf "%s{\"{#NAME}\":\"%s\",\"{#COMMONNAME}\":\"%s\",\"{#STATE}\":\"%s\",\"{#REMARK}\":\"%s\",\"{#TYPE}\":\"%s\"}", separator, $3, $4, $2, $27, $5; separator = ","; } END { print "]" }' +# Get OpenVPN status report +UserParameter=ipfire.ovpn.statusreport.get,sudo cat /var/run/ovpnserver.log 2>/dev/null | awk -F"," 'function unixtime(t) { gsub(/[-:]/," ",t); return mktime(t) } BEGIN { ORS = ""; print "{" } /^Updated,.+/ { printf "\"timestamp\":%s,\"clients\":[",unixtime($2) } /^.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,[0-9]+,[0-9]+,.+/ { if ($1 != "Common Name") { printf "%s{\"common_name\":\"%s\",\"real_address\":\"%s\",\"bytes_in\":\"%s\",\"bytes_out\":\"%s\",\"connected_since\":\"%s\"}", separator, $1, $2, $3, $4, unixtime($5); separator = ","; } } /^ROUTING TABLE/ { print "],\"routing_table\":["; separator = "" } /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,.+/ { if ($1 != "Virtual Address") { printf "%s{\"common_name\":\"%s\",\"virtual_address\":\"%s\",\"real_address\":\"%s\",\"last_ref\":\"%s\"}", separator, $2, $1, $3, unixtime($4); separator = "," } } END { print "]}" }' +# Get OpenVPN client certificate details +UserParameter=ipfire.ovpn.clientcert[*],sudo /var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh /var/ipfire/ovpn/ca/cacert.pem /var/ipfire/ovpn/certs/$1cert.pem +UserParameter=ipfire.ovpn.cacert,sudo /var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh /var/ipfire/ovpn/ca/cacert.pem /var/ipfire/ovpn/ca/cacert.pem + +# Allow item key to be called with (unused) parameters. This allows the #SINGLETON method of discovering this item only when openvpn service is active +Alias=ipfire.ovpn.statusreport.get[]:ipfire.ovpn.statusreport.get +Alias=ipfire.ovpn.cacert[]:ipfire.ovpn.cacert \ No newline at end of file diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd index 65e111d2f..5f274c309 100644 --- a/lfs/zabbix_agentd +++ b/lfs/zabbix_agentd @@ -110,6 +110,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) /var/ipfire/zabbix_agentd/userparameters/userparameter_pakfire.conf install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/userparameter_ipfire.conf \ /var/ipfire/zabbix_agentd/userparameters/userparameter_ipfire.conf + install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/userparameter_ovpn.conf \ + /var/ipfire/zabbix_agentd/userparameters/userparameter_ovpn.conf + + # Install IPFire-specific Zabbix Agent scripts + -mkdir -pv /var/ipfire/zabbix_agentd/scripts + install -v -m 755 $(DIR_SRC)/config/zabbix_agentd/ipfire_certificate_detail.sh \ + /var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh # Create directory for additional agent modules -mkdir -pv /usr/lib/zabbix