Set up Nagios Core 4.5 distributed monitoring with NRPE for remote host checks

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Default values
NAGIOS_VERSION="4.5.0"
PLUGINS_VERSION="2.4.6"
NAGIOS_SERVER_IP=""
INSTALL_TYPE=""

usage() {
    echo "Usage: $0 <server|remote> [nagios_server_ip]"
    echo "  server: Install Nagios Core server"
    echo "  remote: Install NRPE client (requires nagios_server_ip)"
    exit 1
}

cleanup() {
    echo -e "${RED}Installation failed. Cleaning up...${NC}"
    systemctl stop nagios 2>/dev/null || true
    systemctl stop nrpe 2>/dev/null || true
    rm -rf /tmp/nagios* /tmp/release-* 2>/dev/null || true
}

trap cleanup ERR

log() {
    echo -e "${GREEN}$1${NC}"
}

warn() {
    echo -e "${YELLOW}$1${NC}"
}

error() {
    echo -e "${RED}$1${NC}"
}

# Detect OS and set package manager
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            WEB_USER="www-data"
            WEB_SERVICE="apache2"
            APACHE_CONF_DIR="/etc/apache2/sites-enabled"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            WEB_USER="apache"
            WEB_SERVICE="httpd"
            APACHE_CONF_DIR="/etc/httpd/conf.d"
            FIREWALL_CMD="firewall-cmd"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            WEB_USER="apache"
            WEB_SERVICE="httpd"
            APACHE_CONF_DIR="/etc/httpd/conf.d"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    error "Cannot detect OS distribution"
    exit 1
fi

check_root() {
    if [[ $EUID -ne 0 ]]; then
        error "This script must be run as root or with sudo"
        exit 1
    fi
}

install_server() {
    log "[1/10] Updating system packages..."
    $PKG_UPDATE

    log "[2/10] Installing build dependencies..."
    if [[ "$PKG_MGR" == "apt" ]]; then
        $PKG_INSTALL wget build-essential apache2 php libapache2-mod-php php-gd libgd-dev unzip openssl libssl-dev
    else
        $PKG_INSTALL epel-release
        dnf groupinstall -y "Development Tools"
        $PKG_INSTALL httpd php php-cli gcc glibc glibc-common wget unzip gd gd-devel openssl-devel
    fi

    log "[3/10] Creating Nagios user and group..."
    groupadd -f nagios
    useradd -g nagios -d /home/nagios -s /bin/bash nagios 2>/dev/null || true
    usermod -a -G nagios $WEB_USER

    log "[4/10] Downloading and compiling Nagios Core..."
    cd /tmp
    wget -O nagios-${NAGIOS_VERSION}.tar.gz https://github.com/NagiosEnterprises/nagioscore/archive/nagios-${NAGIOS_VERSION}.tar.gz
    tar xzf nagios-${NAGIOS_VERSION}.tar.gz
    cd nagioscore-nagios-${NAGIOS_VERSION}

    ./configure --with-httpd-conf=$APACHE_CONF_DIR
    make all
    make install
    make install-init
    make install-config
    make install-webconf

    log "[5/10] Downloading and installing Nagios plugins..."
    cd /tmp
    wget -O nagios-plugins-${PLUGINS_VERSION}.tar.gz https://github.com/nagios-plugins/nagios-plugins/archive/release-${PLUGINS_VERSION}.tar.gz
    tar xzf nagios-plugins-${PLUGINS_VERSION}.tar.gz
    cd nagios-plugins-release-${PLUGINS_VERSION}

    ./tools/setup
    ./configure
    make
    make install

    log "[6/10] Installing NRPE..."
    cd /tmp
    wget -O nrpe-4.1.0.tar.gz https://github.com/NagiosEnterprises/nrpe/archive/nrpe-4.1.0.tar.gz
    tar xzf nrpe-4.1.0.tar.gz
    cd nrpe-nrpe-4.1.0
    ./configure
    make check_nrpe
    make install-plugin

    log "[7/10] Setting permissions..."
    chown -R nagios:nagios /usr/local/nagios
    chmod 755 /usr/local/nagios
    chmod 755 /usr/local/nagios/etc
    chmod 644 /usr/local/nagios/etc/*

    log "[8/10] Configuring web interface..."
    echo -e "nagiosadmin\nnagiosadmin" | htpasswd -c -i /usr/local/nagios/etc/htpasswd.users nagiosadmin
    warn "Default password set to 'nagiosadmin' - please change this!"

    log "[9/10] Configuring web server..."
    if [[ "$PKG_MGR" == "apt" ]]; then
        a2enmod rewrite
        a2enmod cgi
    fi

    systemctl enable $WEB_SERVICE
    systemctl start $WEB_SERVICE

    log "[10/10] Starting Nagios service..."
    /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg
    systemctl enable nagios
    systemctl start nagios

    log "Nagios Core installation completed!"
    log "Web interface: http://$(hostname -I | awk '{print $1}')/nagios"
    log "Username: nagiosadmin"
    warn "Password: nagiosadmin (CHANGE THIS!)"
}

install_remote() {
    if [[ -z "$NAGIOS_SERVER_IP" ]]; then
        error "Nagios server IP required for remote installation"
        usage
    fi

    log "[1/5] Updating system packages..."
    $PKG_UPDATE

    log "[2/5] Installing NRPE and plugins..."
    if [[ "$PKG_MGR" == "apt" ]]; then
        $PKG_INSTALL nagios-nrpe-server nagios-plugins-basic nagios-plugins-standard
        NRPE_CONFIG="/etc/nagios/nrpe.cfg"
        PLUGINS_DIR="/usr/lib/nagios/plugins"
    else
        $PKG_INSTALL epel-release
        $PKG_INSTALL nrpe nagios-plugins-all
        NRPE_CONFIG="/etc/nagios/nrpe.cfg"
        PLUGINS_DIR="/usr/lib64/nagios/plugins"
    fi

    log "[3/5] Configuring NRPE..."
    cp $NRPE_CONFIG $NRPE_CONFIG.bak
    sed -i "s/allowed_hosts=127.0.0.1/allowed_hosts=127.0.0.1,$NAGIOS_SERVER_IP/" $NRPE_CONFIG

    cat >> $NRPE_CONFIG << EOF

# Custom commands
command[check_users]=$PLUGINS_DIR/check_users -w 5 -c 10
command[check_load]=$PLUGINS_DIR/check_load -r -w .15,.10,.05 -c .30,.25,.20
command[check_disk_root]=$PLUGINS_DIR/check_disk -w 20% -c 10% -p /
command[check_zombie_procs]=$PLUGINS_DIR/check_procs -w 5 -c 10 -s Z
command[check_total_procs]=$PLUGINS_DIR/check_procs -w 150 -c 200
EOF

    chmod 644 $NRPE_CONFIG
    chown root:root $NRPE_CONFIG

    log "[4/5] Configuring firewall..."
    if [[ "$FIREWALL_CMD" == "ufw" ]]; then
        ufw --force enable
        ufw allow from $NAGIOS_SERVER_IP to any port 5666
    else
        systemctl enable firewalld
        systemctl start firewalld
        firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$NAGIOS_SERVER_IP\" port protocol=\"tcp\" port=\"5666\" accept"
        firewall-cmd --reload
    fi

    log "[5/5] Starting NRPE service..."
    systemctl enable nrpe
    systemctl start nrpe

    log "NRPE installation completed!"
    log "Service listening on port 5666 for connections from $NAGIOS_SERVER_IP"
}

verify_installation() {
    if [[ "$INSTALL_TYPE" == "server" ]]; then
        if systemctl is-active --quiet nagios && systemctl is-active --quiet $WEB_SERVICE; then
            log "✓ Nagios Core server is running"
        else
            error "✗ Nagios services are not running properly"
        fi
    else
        if systemctl is-active --quiet nrpe; then
            log "✓ NRPE service is running"
        else
            error "✗ NRPE service is not running properly"
        fi
    fi
}

# Main execution
check_root

if [[ $# -eq 0 ]]; then
    usage
fi

INSTALL_TYPE="$1"

case "$INSTALL_TYPE" in
    server)
        install_server
        ;;
    remote)
        if [[ $# -lt 2 ]]; then
            error "Nagios server IP required for remote installation"
            usage
        fi
        NAGIOS_SERVER_IP="$2"
        install_remote
        ;;
    *)
        usage
        ;;
esac

verify_installation
log "Installation completed successfully!"