init

7 files changed, 290 insertions, 0 deletions

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..5467cfe
--- /dev/null
+++ b/README.md
@@ -0,0 +1,51 @@
+Ben Copeland 10/01/2014
+
+- Description
+
+	- Retrieve expiry dates on SSL certificates using CLI53 and Zabbix Descovery to automatically generate alerts
+
+	The script uses cli53 (command line route53) to get our hostnames. 
+	Using the retrieves hostnames, openssl retrieves the certificates 
+	from the given host and exports the results into a json file.
+
+	This file is fed through another script to export only hostnames
+	to zabbix. Zabbix uses the hostname field to discover the hosts
+	that have ssl certicates. Using Zabbix discovery rules the hosts
+	and days left on the ssl certificate are import into zabbix.
+
+- Files explained
+
+- sslcheck.sh
+	- The scripts that uses cli53 and gets the certificate
+	- Runs in location /etc/zabbix/scripts/
+	- Must export file ssldays.json for sslcheck.sh
+- gethosts.sh
+	- Discovery script for zabbix. Exports hostnames in json format
+	- Depends on exported json file from sslcheck.sh (/etc/zabbix/scripts/ssldays.json)
+- zabbix_template_sslcheck.xml
+	- Zabbix template file. Holds the descovery rules and triggers. 
+
+
+- Dependencies 
+
+- CLI53 (https://github.com/barnybug/cli53)
+	- /etc/boto.cfg (aws_access_key and aws_secert_key) IAM user dns-editor 
+	- pythonpip
+- zabbix_template_sslcheck.xml (zabbix template, descovery rules + triggers)
+	- /etc/zabbix/scripts/sslcheck.sh  
+			- /etc/zabbix/scripts/ssldays.json
+			- cronjob (0 0 * * * /bin/bash /etc/zabbix/scripts/sslcheck.sh linaro.org 443 > /etc/zabbix/scripts/ssldays.json)
+				- Script MUST run at midnight and not overlap zabbix retreving the json file, others zabbix will fail.
+	- /etc/zabbix/scripts/gethosts.sh
+	- userparameter_sslcheck.conf - parameters set on zabbix-agent for the zabbix server
+	
+
+- Limitations/Improvements
+	- Openssl does not support timeout. This means bash command "timeout" has to be used, which results in the bash script running slowly.
+	- Maybe look into using SSL3 (http://thinkinginsoftware.blogspot.co.uk/2013/01/openssl-hanging-connected00000003.html)
+	- zabbix CANNOT access ssldays.json when sslcheck.sh is running, since it will NOT be a complete json file
+		- have to login into zabbix and click every SSL certifcate and "reenable" the unsupported item. Or delete and recreate the template on the host
+		- crontab runs at midnight
+		- Look into only writing file once the list is complete
+	- When SSL has over 1000days zabbix reports "kdays". 
+		- Patch to fix problem:  https://support.zabbix.com/browse/ZBXNEXT-768
\ No newline at end of file
diff --git a/crontab b/crontab
new file mode 100644
index 0000000..aad30a1
--- /dev/null
+++ b/crontab
@@ -0,0 +1,3 @@
+0 8 * * * /bin/bash /etc/zabbix/scripts/sslcheck.sh linaro.org 443 > /etc/zabbix/scripts/ssldays_cron.json
+0 */5 * * * /bin/bash cp /etc/zabbix/scripts/ssldays_cron.json /etc/zabbix/scripts/ssldays.json
+0 */5 * * * /bin/bash /usr/local/share/zabbix/externalscripts/zbx-exim-stats.sh &> /dev/null
\ No newline at end of file
diff --git a/scripts/gethosts.sh b/scripts/gethosts.sh
new file mode 100755
index 0000000..1891999
--- /dev/null
+++ b/scripts/gethosts.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+echo -e "{\n\t\"data\":["	    
+	    cat /etc/zabbix/scripts/ssldays.json | grep {#HOST} | cut -f4 -d '"' | while read line
+	    do
+		XHOST=`echo $line | awk '{print $1}'`
+		#echo -e "\t{ \"{#HOST}\":\t\"${XHOST}\" },"
+
+
+		    echo  "${final:+,}"
+		    final=,
+			printf "\t{\n"
+		    printf "\t\t\"{#HOST}\":\"${XHOST}\"\n"
+			printf "\t}\n"
+
+	    done
+	    echo -e "\t]\n}"
diff --git a/scripts/sslcheck.sh b/scripts/sslcheck.sh
new file mode 100755
index 0000000..f92b76b
--- /dev/null
+++ b/scripts/sslcheck.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+################################################################################
+# Description:
+#  Retrieves SSL certificate from remote server and returns the remaining number
+#  of valid days.
+#
+# Usage:
+#   zext_ssl_cert.sh <hostname_or_IP> <port>
+#
+# Zabbix item:
+#  Type               : external check
+#  Key                : zext_ssl_cert.sh[port]
+#  Type of information: Numeric (float)
+################################################################################
+SHELL=/bin/bash PATH=/bin:/sbin:/usr/bin:/usr/sbin 
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+domain=$1
+getport=$2
+getdomain=`cli53 export $domain | awk '{ print $1 }' |  sed 's/[^a-z|0-9|.-]//g; ' | sed '/^$/d' | uniq `
+fqdn=`echo "$getdomain" | while read a; do echo $a.$domain; done`
+port=`echo "$fqdn" | while read b; do echo $getport; done`
+IFS=" "
+set -- $fqdn
+N=0
+
+first=1
+
+ 
+  #json header
+echo -n  '{
+        "data":['
+ 
+ 
+echo $fqdn | while read LINE;do
+	N=$((N+1))
+	#####TIMEOUT is important. Due to openssl having no timeout options, hosts can hang for a long time.
+	end_date=`timeout 15 openssl s_client -ssl3 -host $LINE -port $getport -showcerts </dev/null 2>/dev/null |
+        sed -n '/BEGIN CERTIFICATE/,/END CERT/p' |
+        openssl x509 -text 2>/dev/null |
+        sed -n 's/ *Not After : *//p'`
+
+	if [ -n "$end_date" ]
+		then
+			end_date_seconds=`date '+%s' --date "$end_date"`
+    		now_seconds=`date '+%s'`
+	        days=`echo "($end_date_seconds-$now_seconds)/24/3600" | bc`
+			first=0
+	
+		    echo  "${final:+,}"
+		    final=,
+			printf "\t{\n"
+		    printf "\t\t\"{#HOST}\":\"$LINE\",\n"
+			printf "\t\t\"{#DAYS}\":\"$days\"\n"
+			printf "\t}\n"
+	fi
+done
+
+  echo '
+          ]
+  }'
diff --git a/scripts/sslcheck_manual.sh b/scripts/sslcheck_manual.sh
new file mode 100755
index 0000000..b50a2de
--- /dev/null
+++ b/scripts/sslcheck_manual.sh
@@ -0,0 +1,14 @@
+#! /bin/sh
+host=$1
+port=$2
+end_date=`openssl s_client -host $host -port $port -showcerts </dev/null 2>/dev/null |
+          sed -n '/BEGIN CERTIFICATE/,/END CERT/p' |
+	  openssl x509 -text 2>/dev/null |
+	  sed -n 's/ *Not After : *//p'`
+
+if [ -n "$end_date" ]
+then
+    end_date_seconds=`date '+%s' --date "$end_date"`
+    now_seconds=`date '+%s'`
+    echo "($end_date_seconds-$now_seconds)/24/3600" | bc
+fi
diff --git a/zabbix_agentd.d/userparameter_sslcheck.conf b/zabbix_agentd.d/userparameter_sslcheck.conf
new file mode 100644
index 0000000..15980a6
--- /dev/null
+++ b/zabbix_agentd.d/userparameter_sslcheck.conf
@@ -0,0 +1,3 @@
+UserParameter=sslmanual[*],/etc/zabbix/scripts/sslcheck_manual.sh $1 $2
+UserParameter=ssldiscover,/etc/zabbix/scripts/gethosts.sh
+UserParameter=ssldays[*],cat /etc/zabbix/scripts/ssldays.json | sed -n '/\"$1\"/{n;p}' | sed 's/[^a-z|0-9|.-]//g;'
diff --git a/zabbix_template_sslcheck.xml b/zabbix_template_sslcheck.xml
new file mode 100644
index 0000000..8f96408
--- /dev/null
+++ b/zabbix_template_sslcheck.xml
@@ -0,0 +1,143 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<zabbix_export>
+    <version>2.0</version>
+    <date>2014-01-13T16:00:25Z</date>
+    <groups>
+        <group>
+            <name>Templates</name>
+        </group>
+    </groups>
+    <templates>
+        <template>
+            <template>Template_SSLCheck</template>
+            <name>Template_SSLCheck</name>
+            <groups>
+                <group>
+                    <name>Templates</name>
+                </group>
+            </groups>
+            <applications>
+                <application>
+                    <name>SSL certificate</name>
+                </application>
+            </applications>
+            <items/>
+            <discovery_rules>
+                <discovery_rule>
+                    <name>SSL Discovery</name>
+                    <type>0</type>
+                    <snmp_community/>
+                    <snmp_oid/>
+                    <key>ssldiscover</key>
+                    <delay>60</delay>
+                    <status>0</status>
+                    <allowed_hosts/>
+                    <snmpv3_securityname/>
+                    <snmpv3_securitylevel>0</snmpv3_securitylevel>
+                    <snmpv3_authpassphrase/>
+                    <snmpv3_privpassphrase/>
+                    <delay_flex/>
+                    <params/>
+                    <ipmi_sensor/>
+                    <authtype>0</authtype>
+                    <username/>
+                    <password/>
+                    <publickey/>
+                    <privatekey/>
+                    <port/>
+                    <filter>:</filter>
+                    <lifetime>30</lifetime>
+                    <description/>
+                    <item_prototypes>
+                        <item_prototype>
+                            <name>{#HOST} SSL Expiry</name>
+                            <type>0</type>
+                            <snmp_community/>
+                            <multiplier>0</multiplier>
+                            <snmp_oid/>
+                            <key>ssldays[{#HOST}]</key>
+                            <delay>21600</delay>
+                            <history>90</history>
+                            <trends>365</trends>
+                            <status>0</status>
+                            <value_type>3</value_type>
+                            <allowed_hosts/>
+                            <units>!days</units>
+                            <delta>0</delta>
+                            <snmpv3_securityname/>
+                            <snmpv3_securitylevel>0</snmpv3_securitylevel>
+                            <snmpv3_authpassphrase/>
+                            <snmpv3_privpassphrase/>
+                            <formula>1</formula>
+                            <delay_flex/>
+                            <params/>
+                            <ipmi_sensor/>
+                            <data_type>0</data_type>
+                            <authtype>0</authtype>
+                            <username/>
+                            <password/>
+                            <publickey/>
+                            <privatekey/>
+                            <port/>
+                            <description/>
+                            <inventory_link>0</inventory_link>
+                            <applications>
+                                <application>
+                                    <name>SSL certificate</name>
+                                </application>
+                            </applications>
+                            <valuemap/>
+                        </item_prototype>
+                    </item_prototypes>
+                    <trigger_prototypes>
+                        <trigger_prototype>
+                            <expression>{Template_SSLCheck:ssldays[{#HOST}].last(0)}&lt;3</expression>
+                            <name>SSL Expiry Date on {#HOST} less than 3 days</name>
+                            <url/>
+                            <status>0</status>
+                            <priority>5</priority>
+                            <description/>
+                            <type>0</type>
+                        </trigger_prototype>
+                        <trigger_prototype>
+                            <expression>{Template_SSLCheck:ssldays[{#HOST}].last(0)}&lt;7</expression>
+                            <name>SSL Expiry Date on {#HOST} less than 7 days</name>
+                            <url/>
+                            <status>0</status>
+                            <priority>4</priority>
+                            <description/>
+                            <type>0</type>
+                        </trigger_prototype>
+                        <trigger_prototype>
+                            <expression>{Template_SSLCheck:ssldays[{#HOST}].last(0)}&lt;15</expression>
+                            <name>SSL Expiry Date on {#HOST} less than 15 days</name>
+                            <url/>
+                            <status>0</status>
+                            <priority>3</priority>
+                            <description/>
+                            <type>0</type>
+                        </trigger_prototype>
+                        <trigger_prototype>
+                            <expression>{Template_SSLCheck:ssldays[{#HOST}].last(0)}&lt;30</expression>
+                            <name>SSL Expiry Date on {#HOST} less than 30 days</name>
+                            <url/>
+                            <status>0</status>
+                            <priority>2</priority>
+                            <description/>
+                            <type>0</type>
+                        </trigger_prototype>
+                    </trigger_prototypes>
+                    <graph_prototypes/>
+                </discovery_rule>
+            </discovery_rules>
+            <macros>
+                <macro>
+                    <macro>{$SSL_PORT}</macro>
+                    <value>443</value>
+                </macro>
+            </macros>
+            <templates/>
+            <screens/>
+        </template>
+    </templates>
+</zabbix_export>