aboutsummaryrefslogtreecommitdiff
path: root/flakes/private
diff options
context:
space:
mode:
Diffstat (limited to 'flakes/private')
-rw-r--r--flakes/private/monitoring/myplugins.nix23
-rwxr-xr-xflakes/private/monitoring/plugins/check_dnssec195
2 files changed, 218 insertions, 0 deletions
diff --git a/flakes/private/monitoring/myplugins.nix b/flakes/private/monitoring/myplugins.nix
index 35730bb..f76f2c1 100644
--- a/flakes/private/monitoring/myplugins.nix
+++ b/flakes/private/monitoring/myplugins.nix
@@ -69,8 +69,31 @@ in
69 dns = { 69 dns = {
70 commands = { 70 commands = {
71 check_dns = "$USER1$/check_dns -H $ARG1$ -s $HOSTADDRESS$ $ARG2$"; 71 check_dns = "$USER1$/check_dns -H $ARG1$ -s $HOSTADDRESS$ $ARG2$";
72 check_dns_soa = "$USER2$/check_dns_soa -H $ARG1$ -z $ARG2$ -M $ARG3$";
73 check_dnssec = "$USER2$/check_dnssec -z $ARG1$";
72 check_external_dns = "$USER1$/check_dns -H $ARG2$ -s $ARG1$ $ARG3$"; 74 check_external_dns = "$USER1$/check_dns -H $ARG2$ -s $ARG1$ $ARG3$";
73 }; 75 };
76 chunk = let
77 soa_plugin = pkgs.fetchurl {
78 name = "check_dns_soa";
79 url = "https://exchange.nagios.org/components/com_mtree/attachment.php?link_id=1429&cf_id=24";
80 sha256 = "sha256-Yy4XO19Fb7WdHZZmhUfyyAGBnxJyFWwc7U3HiWyE8wc=";
81 };
82 in ''
83 cp ${./plugins}/check_dnssec $out/
84 patchShebangs $out/check_dnssec
85 wrapProgram $out/check_dnssec --prefix PATH : ${lib.makeBinPath [
86 pkgs.bind.dnsutils pkgs.gnugrep pkgs.gawk pkgs.which pkgs.coreutils
87 ]}
88
89 cp ${soa_plugin} $out/check_dns_soa
90 chmod +xw $out/check_dns_soa
91 patchShebangs $out/check_dns_soa
92 sed -i -e 's/^use utils qw.*$/my %ERRORS = ("OK" => 0, "WARNING" => 1, "CRITICAL" => 2, "UNKNOWN" => 3);my $TIMEOUT = 10;/' -e '/^use lib /d' $out/check_dns_soa
93 wrapProgram $out/check_dns_soa --prefix PERL5LIB : ${pkgs.perlPackages.makePerlPath [
94 pkgs.perlPackages.NetDNS
95 ]}
96 '';
74 }; 97 };
75 mdadm = { 98 mdadm = {
76 commands = { 99 commands = {
diff --git a/flakes/private/monitoring/plugins/check_dnssec b/flakes/private/monitoring/plugins/check_dnssec
new file mode 100755
index 0000000..a6e408d
--- /dev/null
+++ b/flakes/private/monitoring/plugins/check_dnssec
@@ -0,0 +1,195 @@
1#!/usr/bin/env bash
2
3# check_dnssec_expiry.sh
4#
5# Copyright 2017 by Mario Rimann <mario@rimann.org>
6# Licensed under the permissive MIT license, see LICENSE.md
7#
8# Development of this script was partially sponsored by my
9# employer internezzo, see http://www.internezzo.ch
10#
11# If this script helps you to make your work easier, please consider
12# to give feedback or do something good, see https://rimann.org/support
13
14usage() {
15 cat - >&2 << _EOT_
16usage $0 -z <zone> [-w <warning %>] [-c <critical %>] [-r <resolver>] [-f <always failing domain>]
17
18 -z <zone>
19 specify zone to check
20 -w <critical %>
21 warning time left percentage
22 -c <critical %>
23 critical time left percentage
24 -r <resolver>
25 specify which resolver to use.
26 -f <always failing domain>
27 specify a domain that will always fail DNSSEC.
28 used to test if DNSSEC is supported in used tools.
29 -t <DNS record type to check>
30 specify a DNS record type for calculating the remaining lifetime.
31 For example SOA, A, etc.
32_EOT_
33 exit 255
34}
35
36# Parse the input options
37while getopts ":z:w:c:r:f:h:t:" opt; do
38 case $opt in
39 z)
40 zone=$OPTARG
41 ;;
42 w)
43 warning=$OPTARG
44 ;;
45 c)
46 critical=$OPTARG
47 ;;
48 r)
49 resolver=$OPTARG
50 ;;
51 f)
52 alwaysFailingDomain=$OPTARG
53 ;;
54 t)
55 recordType=$OPTARG
56 ;;
57 h)
58 usage ;;
59 esac
60done
61
62
63# Check if dig is available at all - fail hard if not
64pathToDig=$( which dig )
65if [[ ! -e $pathToDig ]]; then
66 echo "No executable of dig found, cannot proceed without dig. Sorry!"
67 exit 1
68fi
69
70# Check if we got a zone to validate - fail hard if not
71if [[ -z $zone ]]; then
72 echo "Missing zone to test - please provide a zone via the -z parameter."
73 usage
74 exit 3
75fi
76
77# Check if we got warning/critical percentage values, use defaults if not
78if [[ -z $warning ]]; then
79 warning=20
80fi
81if [[ -z $critical ]]; then
82 critical=10
83fi
84
85
86# Use Google's 8.8.8.8 resolver as fallback if none is provided
87if [[ -z $resolver ]]; then
88 resolver="8.8.8.8"
89fi
90
91if [[ -z $alwaysFailingDomain ]]; then
92 alwaysFailingDomain="dnssec-failed.org"
93fi
94
95# Use SOA record type as fallback
96if [[ -z $recordType ]]; then
97 recordType="SOA"
98fi
99
100# Check the resolver to properly validate DNSSEC at all (if he doesn't, every further test is futile and a waste of bandwith)
101checkResolverDoesDnssecValidation=$(dig +nocmd +nostats +noquestion $alwaysFailingDomain @${resolver} | grep "opcode: QUERY" | grep "status: SERVFAIL")
102if [[ -z $checkResolverDoesDnssecValidation ]]; then
103 echo "WARNING: Resolver seems to not validate DNSSEC signatures - going further seems hopeless right now."
104 exit 1
105fi
106
107# Check if the resolver delivers an answer for the domain to test
108checkDomainResolvableWithDnssecEnabledResolver=$(dig +short @${resolver} SOA $zone)
109if [[ -z $checkDomainResolvableWithDnssecEnabledResolver ]]; then
110
111 checkDomainResolvableWithDnssecValidationExplicitelyDisabled=$(dig +short @${resolver} SOA $zone +cd)
112
113 if [[ ! -z $checkDomainResolvableWithDnssecValidationExplicitelyDisabled ]]; then
114 echo "CRITICAL: The domain $zone can be validated without DNSSEC validation - but will fail on resolvers that do validate DNSSEC."
115 exit 2
116 else
117 echo "CRITICAL: The domain $zone cannot be resolved via $resolver as resolver while DNSSEC validation is active."
118 exit 2
119 fi
120fi
121
122# Check if the domain is DNSSEC signed at all
123# (and emerge a WARNING in that case, since this check is about testing DNSSEC being "present" and valid which is not the case for an unsigned zone)
124checkZoneItselfIsSignedAtAll=$( dig $zone @$resolver DS +short )
125if [[ -z $checkZoneItselfIsSignedAtAll ]]; then
126 echo "WARNING: Zone $zone seems to be unsigned itself (= resolvable, but no DNSSEC involved at all)"
127 exit 1
128fi
129
130
131# Check if there are multiple RRSIG responses and check them one after the other
132now=$(date +"%s")
133rrsigEntries=$( dig @$resolver $recordType $zone +dnssec | grep RRSIG )
134if [[ -z $rrsigEntries ]]; then
135 echo "CRITICAL: There is no RRSIG for the SOA of your zone."
136 exit 2
137else
138 while read -r rrsig; do
139 # Get the RRSIG entry and extract the date out of it
140 expiryDateOfSignature=$( echo $rrsig | awk '{print $9}')
141 checkValidityOfExpirationTimestamp=$( echo $expiryDateOfSignature | egrep '[0-9]{14}')
142 if [[ -z $checkValidityOfExpirationTimestamp ]]; then
143 echo "UNKNOWN: Something went wrong while checking the expiration of the RRSIG entry - investigate please".
144 exit 3
145 fi
146
147 inceptionDateOfSignature=$( echo $rrsig | awk '{print $10}')
148 checkValidityOfInceptionTimestamp=$( echo $inceptionDateOfSignature | egrep '[0-9]{14}')
149 if [[ -z $checkValidityOfInceptionTimestamp ]]; then
150 echo "UNKNOWN: Something went wrong while checking the inception date of the RRSIG entry - investigate please".
151 exit 3
152 fi
153
154 # Fiddle out the expiry and inceptiondate of the signature to have a base to do some calculations afterwards
155 expiryDateAsString="${expiryDateOfSignature:0:4}-${expiryDateOfSignature:4:2}-${expiryDateOfSignature:6:2} ${expiryDateOfSignature:8:2}:${expiryDateOfSignature:10:2}:00"
156 expiryDateOfSignatureAsUnixTime=$( date -u -d "$expiryDateAsString" +"%s" 2>/dev/null )
157 if [[ $? -ne 0 ]]; then
158 # if we come to this place, something must have gone wrong converting the date-string. This can happen as e.g. MacOS X and Linux don't behave the same way in this topic...
159 expiryDateOfSignatureAsUnixTime=$( date -j -u -f "%Y-%m-%d %T" "$expiryDateAsString" +"%s" )
160 fi
161 inceptionDateAsString="${inceptionDateOfSignature:0:4}-${inceptionDateOfSignature:4:2}-${inceptionDateOfSignature:6:2} ${inceptionDateOfSignature:8:2}:${inceptionDateOfSignature:10:2}:00"
162 inceptionDateOfSignatureAsUnixTime=$( date -u -d "$inceptionDateAsString" +"%s" 2>/dev/null )
163 if [[ $? -ne 0 ]]; then
164 # if we come to this place, something must have gone wrong converting the date-string. This can happen as e.g. MacOS X and Linux don't behave the same way in this topic...
165 inceptionDateOfSignatureAsUnixTime=$( date -j -u -f "%Y-%m-%d %T" "$inceptionDateAsString" +"%s" )
166 fi
167
168
169 # calculate the remaining lifetime of the signature
170 totalLifetime=$( expr $expiryDateOfSignatureAsUnixTime - $inceptionDateOfSignatureAsUnixTime)
171 remainingLifetimeOfSignature=$( expr $expiryDateOfSignatureAsUnixTime - $now)
172 remainingPercentage=$( expr "100" \* $remainingLifetimeOfSignature / $totalLifetime)
173
174 # store the result of this single RRSIG's check
175 if [[ -z $maxRemainingLifetime || $remainingLifetimeOfSignature -gt $maxRemainingLifetime ]]; then
176 maxRemainingLifetime=$remainingLifetimeOfSignature
177 maxRemainingPercentage=$remainingPercentage
178 fi
179 done <<< "$rrsigEntries"
180fi
181
182
183
184
185# determine if we need to alert, and if so, how loud to cry, depending on warning/critial threshholds provided
186if [[ $maxRemainingPercentage -lt $critical ]]; then
187 echo "CRITICAL: DNSSEC signature for $zone is very short before expiration! ($maxRemainingPercentage% remaining) | sig_lifetime=$maxRemainingLifetime sig_lifetime_percentage=$remainingPercentage%;$warning;$critical"
188 exit 2
189elif [[ $remainingPercentage -lt $warning ]]; then
190 echo "WARNING: DNSSEC signature for $zone is short before expiration! ($maxRemainingPercentage% remaining) | sig_lifetime=$maxRemainingLifetime sig_lifetime_percentage=$remainingPercentage%;$warning;$critical"
191 exit 1
192else
193 echo "OK: DNSSEC signatures for $zone seem to be valid and not expired ($maxRemainingPercentage% remaining) | sig_lifetime=$maxRemainingLifetime sig_lifetime_percentage=$remainingPercentage%;$warning;$critical"
194 exit 0
195fi
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 10:35:55 +0000