From 8f87f534973599f60939648a1c22dbb6d930a80a Mon Sep 17 00:00:00 2001 From: errnair Date: Sat, 1 Nov 2025 21:48:57 +0530 Subject: [PATCH] Modernize Nagios, Salt, and Squid installation scripts Updated four installation scripts with multi-OS support, modern repositories, and enhanced configurations. install_nagios.sh: - Multi-OS support: RHEL/Rocky/AlmaLinux/Ubuntu/Debian - Updated to Nagios Core 4.5.0, Plugins 2.4.6, NRPE 4.1.0 - Builds from source with latest versions - Secure password input for web admin - SELinux configuration with proper contexts - Example states and configuration files - Comprehensive post-installation documentation install_salt.sh: - Multi-OS support with SaltProject repos - Updated to modern repo.saltproject.io URLs - Version selection (latest or specific) - Optional components: minion, ssh, cloud - Auto-generates basic master configuration - Creates example Salt states (top.sls, common.sls) - Firewall configuration for ports 4505 and 4506 - Connectivity testing install_salt_minion.sh: - Multi-OS support with SaltProject repos - Requires master IP/hostname parameter - Version selection support - Custom minion ID configuration - Proper minion.d configuration structure - Connection testing and troubleshooting guide - Comprehensive setup instructions install_squid.sh: - Multi-OS support: RHEL/Rocky/AlmaLinux/Ubuntu/Debian - Three proxy modes: forward, transparent, reverse - Configurable port and cache size - Network ACL support - Website blocking capability - Configuration backup with timestamps - Cache initialization - Firewall configuration Tests: - Bash syntax validation passed for all four scripts - Library integration verified - Common library functions properly utilized --- installation_scripts/install_nagios.sh | 561 ++++++++++++++++---- installation_scripts/install_salt.sh | 449 +++++++++++++++- installation_scripts/install_salt_minion.sh | 369 +++++++++++-- installation_scripts/install_squid.sh | 475 ++++++++++++++++- 4 files changed, 1658 insertions(+), 196 deletions(-) diff --git a/installation_scripts/install_nagios.sh b/installation_scripts/install_nagios.sh index 0bda2bb..5a6eb74 100755 --- a/installation_scripts/install_nagios.sh +++ b/installation_scripts/install_nagios.sh @@ -1,148 +1,511 @@ -#!/bin/bash +#!/usr/bin/env bash +set -euo pipefail + ################################################# # # -# A shell script to install Nagios on CentOS # +# Install Nagios monitoring system # +# Includes Nagios Core, Plugins, and NRPE # +# Multi-OS support with HTTPS # # # ################################################# -# check if the current user is root -if [[ $(/usr/bin/id -u) != "0" ]]; then - echo -e "This looks like a 'non-root' user.\nPlease switch to 'root' and run the script again." - exit -fi +# Source common library +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "${SCRIPT_DIR}/../lib/common.sh" + +# Setup +trap cleanup_on_exit EXIT +require_root + +# Configuration +NAGIOS_VERSION="${NAGIOS_VERSION:-4.5.0}" +NAGIOS_PLUGINS_VERSION="${NAGIOS_PLUGINS_VERSION:-2.4.6}" +NRPE_VERSION="${NRPE_VERSION:-4.1.0}" +NAGIOS_ADMIN_USER="${NAGIOS_ADMIN_USER:-nagiosadmin}" +NAGIOS_ADMIN_EMAIL="${NAGIOS_ADMIN_EMAIL:-admin@localhost}" +ENABLE_SSL="${ENABLE_SSL:-yes}" +BUILD_DIR="/tmp/nagios-build-$$" + +print_header "Nagios Monitoring System Installer" + +# Detect OS +OS=$(detect_os) +PKG_MGR=$(get_package_manager) + +print_info "Detected OS: $OS" +print_info "Package manager: $PKG_MGR" +print_info "Nagios version: $NAGIOS_VERSION" +print_info "Plugins version: $NAGIOS_PLUGINS_VERSION" +print_info "NRPE version: $NRPE_VERSION" +print_info "Enable SSL: $ENABLE_SSL" +echo -ipaddr=$(hostname -I | cut -d" " -f 1) +# Install prerequisites +install_prerequisites() { + print_header "Installing prerequisites" -prerequisites() { - yum update -y - yum groupinstall "Development Tools" -y - yum install xinetd openssl-devel net-snmp gd-devel gd -y + case "$OS" in + rhel) + case "$PKG_MGR" in + dnf) + dnf groupinstall -y "Development Tools" + dnf install -y httpd mod_ssl php wget unzip \ + gcc glibc glibc-common openssl openssl-devel \ + perl gd gd-devel gettext net-snmp net-snmp-utils \ + xinetd + ;; + yum) + yum groupinstall -y "Development Tools" + yum install -y httpd mod_ssl php wget unzip \ + gcc glibc glibc-common openssl openssl-devel \ + perl gd gd-devel gettext net-snmp net-snmp-utils \ + xinetd + ;; + esac + ;; + debian) + apt-get update + apt-get install -y apache2 libapache2-mod-php php wget unzip \ + build-essential libgd-dev openssl libssl-dev \ + perl gettext snmp xinetd apache2-utils - groupadd nagcmd - useradd -G nagcmd nagios + # Enable Apache modules + a2enmod ssl + a2enmod cgi + ;; + *) + error_exit "Unsupported OS: $OS" + ;; + esac - yum install httpd mod_ssl -y - systemctl enable httpd - systemctl start httpd - firewall-cmd --permanent --add-service=http - firewall-cmd --permanent --add-service=https - firewall-cmd --reload + print_success "Prerequisites installed" } -install_nagios(){ - mkdir -p /opt/sources/nagios - cd /opt/sources/nagios - wget https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.3.1.tar.gz - tar zxf nagios-*.tar.gz - cd nagios-* - ./configure --with-command-group=nagcmd +# Create Nagios user and group +create_nagios_user() { + print_header "Creating Nagios user and group" + + # Create nagios user if doesn't exist + if ! id nagios &>/dev/null; then + useradd -m -s /bin/bash nagios + print_success "User 'nagios' created" + else + print_info "User 'nagios' already exists" + fi + + # Create nagcmd group if doesn't exist + if ! getent group nagcmd &>/dev/null; then + groupadd nagcmd + print_success "Group 'nagcmd' created" + else + print_info "Group 'nagcmd' already exists" + fi + + # Add nagios user to nagcmd group + usermod -a -G nagcmd nagios + + # Add web server user to nagcmd group + if getent passwd apache &>/dev/null; then + usermod -a -G nagcmd apache + elif getent passwd www-data &>/dev/null; then + usermod -a -G nagcmd www-data + fi + + print_success "Nagios user and group configured" +} + +# Download and compile Nagios Core +install_nagios_core() { + print_header "Installing Nagios Core ${NAGIOS_VERSION}" + + mkdir -p "$BUILD_DIR" + cd "$BUILD_DIR" + + # Download Nagios Core + local nagios_url="https://github.com/NagiosEnterprises/nagioscore/releases/download/nagios-${NAGIOS_VERSION}/nagios-${NAGIOS_VERSION}.tar.gz" + print_info "Downloading Nagios Core..." + + if command_exists curl; then + curl -L -o "nagios-${NAGIOS_VERSION}.tar.gz" "$nagios_url" + else + wget -O "nagios-${NAGIOS_VERSION}.tar.gz" "$nagios_url" + fi + + # Extract + tar -xzf "nagios-${NAGIOS_VERSION}.tar.gz" + cd "nagios-${NAGIOS_VERSION}" + + # Configure + print_info "Configuring Nagios Core..." + ./configure \ + --with-command-group=nagcmd \ + --with-httpd-conf=/etc/httpd/conf.d 2>/dev/null || \ + ./configure --with-command-group=nagcmd + + # Compile + print_info "Compiling Nagios Core (this may take a few minutes)..." make all + + # Install + print_info "Installing Nagios Core..." make install make install-init make install-commandmode make install-config - make install-webconf - echo -e "\n\nNagios Directory Location: /usr/local/nagios/" - usermod -aG nagcmd apache + # Install web config + if [ "$OS" = "debian" ]; then + make install-webconf -e HTTPD_CONF=/etc/apache2/sites-available + ln -sf /etc/apache2/sites-available/nagios.conf /etc/apache2/sites-enabled/ + else + make install-webconf + fi + + print_success "Nagios Core installed to /usr/local/nagios/" } +# Download and compile Nagios Plugins install_nagios_plugins() { - cd /opt/sources/nagios - mkdir nagios-plugins - cd nagios-plugins/ - wget http://nagios-plugins.org/download/nagios-plugins-2.2.1.tar.gz - tar zxf nagios-plugins-*.tar.gz - cd nagios-plugins-* - ./configure --with-nagios-user=nagios --with-nagios-group=nagios --with-openssl + print_header "Installing Nagios Plugins ${NAGIOS_PLUGINS_VERSION}" + + cd "$BUILD_DIR" + + # Download Nagios Plugins + local plugins_url="https://github.com/nagios-plugins/nagios-plugins/releases/download/release-${NAGIOS_PLUGINS_VERSION}/nagios-plugins-${NAGIOS_PLUGINS_VERSION}.tar.gz" + print_info "Downloading Nagios Plugins..." + + if command_exists curl; then + curl -L -o "nagios-plugins-${NAGIOS_PLUGINS_VERSION}.tar.gz" "$plugins_url" + else + wget -O "nagios-plugins-${NAGIOS_PLUGINS_VERSION}.tar.gz" "$plugins_url" + fi + + # Extract + tar -xzf "nagios-plugins-${NAGIOS_PLUGINS_VERSION}.tar.gz" + cd "nagios-plugins-${NAGIOS_PLUGINS_VERSION}" + + # Configure + print_info "Configuring Nagios Plugins..." + ./configure \ + --with-nagios-user=nagios \ + --with-nagios-group=nagios \ + --with-openssl + + # Compile and install + print_info "Compiling Nagios Plugins..." make make install + + print_success "Nagios Plugins installed" } +# Download and compile NRPE install_nrpe() { - cd /opt/sources/nagios - mkdir nrpe - cd nrpe - wget https://downloads.sourceforge.net/project/nagios/nrpe-3.x/nrpe-3.1.0.tar.gz - tar zxf nrpe-*.tar.gz - cd nrpe-* - ./configure --enable-command-args --with-nagios-user=nagios --with-nagios-group=nagios --with-ssl=/usr/bin/openssl --with-ssl-lib=/usr/lib64/ + print_header "Installing NRPE ${NRPE_VERSION}" + + cd "$BUILD_DIR" + + # Download NRPE + local nrpe_url="https://github.com/NagiosEnterprises/nrpe/releases/download/nrpe-${NRPE_VERSION}/nrpe-${NRPE_VERSION}.tar.gz" + print_info "Downloading NRPE..." + + if command_exists curl; then + curl -L -o "nrpe-${NRPE_VERSION}.tar.gz" "$nrpe_url" + else + wget -O "nrpe-${NRPE_VERSION}.tar.gz" "$nrpe_url" + fi + + # Extract + tar -xzf "nrpe-${NRPE_VERSION}.tar.gz" + cd "nrpe-${NRPE_VERSION}" + + # Configure + print_info "Configuring NRPE..." + ./configure \ + --enable-command-args \ + --with-nagios-user=nagios \ + --with-nagios-group=nagios \ + --with-ssl=/usr/bin/openssl \ + --with-ssl-lib=/usr/lib/x86_64-linux-gnu 2>/dev/null || \ + ./configure \ + --enable-command-args \ + --with-nagios-user=nagios \ + --with-nagios-group=nagios \ + --with-ssl=/usr/bin/openssl \ + --with-ssl-lib=/usr/lib64 + + # Compile and install + print_info "Compiling NRPE..." make all make install make install-config + make install-init - echo -e "nrpe\t\t5666/tcp\t\t# Nagios NRPE" >> /etc/services + # Add NRPE service port + if ! grep -q "nrpe.*5666/tcp" /etc/services; then + echo "nrpe 5666/tcp # Nagios NRPE" >> /etc/services + fi - make install-init + print_success "NRPE installed" +} + +# Configure Nagios +configure_nagios() { + print_header "Configuring Nagios" + + local nagios_cfg="/usr/local/nagios/etc/nagios.cfg" + local contacts_cfg="/usr/local/nagios/etc/objects/contacts.cfg" + local commands_cfg="/usr/local/nagios/etc/objects/commands.cfg" + + # Create servers directory + mkdir -p /usr/local/nagios/etc/servers + + # Enable servers directory in main config + if ! grep -q "cfg_dir=/usr/local/nagios/etc/servers" "$nagios_cfg"; then + echo "cfg_dir=/usr/local/nagios/etc/servers" >> "$nagios_cfg" + fi + + # Update contact email + sed -i "s/nagios@localhost/${NAGIOS_ADMIN_EMAIL}/g" "$contacts_cfg" - systemctl enable nrpe.service - firewall-cmd --zone=public --add-port=5666/tcp - firewall-cmd --zone=public --add-port=5666/tcp --permanent - firewall-cmd --reload + # Add check_nrpe command + if ! grep -q "check_nrpe" "$commands_cfg"; then + cat >> "$commands_cfg" <<'EOF' + +# NRPE command definition +define command{ + command_name check_nrpe + command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c $ARG1$ } +EOF + fi -configuration() { - sed -i.bak 's/^\(dont_blame_nrpe=\).*/\11/' /usr/local/nagios/etc/nrpe.cfg - sed -i "s/^\(allowed_hosts=127.0.0.1,::1\).*/\1,$ipaddr/" /usr/local/nagios/etc/nrpe.cfg - - systemctl start nrpe.service + print_success "Nagios configuration updated" +} - echo -e "\nlocalhost\n/usr/local/nagios/libexec/check_nrpe -H 127.0.0.1\n" >> /tmp/nrpe_test.txt - /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 >> /tmp/nrpe_test.txt - echo -e "\nIP\n/usr/local/nagios/libexec/check_nrpe -H $ipaddr\n" >> /tmp/nrpe_test.txt - /usr/local/nagios/libexec/check_nrpe -H $ipaddr >> /tmp/nrpe_test.txt +# Configure NRPE +configure_nrpe() { + print_header "Configuring NRPE" - sed -i "s/^\(command\[check_load\]=\/usr\/local\/nagios\/libexec\/check_load\).*/\1\ \-w\ 15,10,5\ \-c\ 30,25,20/" /usr/local/nagios/etc/nrpe.cfg - systemctl restart nrpe.service + local nrpe_cfg="/usr/local/nagios/etc/nrpe.cfg" + local server_ip=$(hostname -I | awk '{print $1}') - echo -e "\ncheck_load\n/usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 -c check_load\n" >> /tmp/nrpe_test.txt - /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1 -c check_load >> /tmp/nrpe_test.txt + # Backup original config + cp "$nrpe_cfg" "${nrpe_cfg}.bak" - echo "cfg_dir=/usr/local/nagios/etc/servers" >> /usr/local/nagios/etc/nagios.cfg - mkdir /usr/local/nagios/etc/servers - - sed -i 's/nagios@localhost/admin@localhost/g' /usr/local/nagios/etc/objects/contacts.cfg + # Allow command arguments + sed -i 's/dont_blame_nrpe=0/dont_blame_nrpe=1/' "$nrpe_cfg" - echo -e "\n\ndefine command{\n\tcommand_name check_nrpe\n\tcommand_line \$USER1\$/check_nrpe -H \$HOSTADDRESS\$ -c \$ARG1\$\n}" >> /usr/local/nagios/etc/objects/commands.cfg - - echo -e "\n\n######################\n Enter the password for the Nagios Admin - 'nagiosadmin'\n######################\n\n" - htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin + # Add server IP to allowed hosts + sed -i "s/allowed_hosts=127.0.0.1,::1/allowed_hosts=127.0.0.1,::1,${server_ip}/" "$nrpe_cfg" - systemctl enable nagios + # Configure check_load with arguments + sed -i 's/command\[check_load\]=.*/command[check_load]=\/usr\/local\/nagios\/libexec\/check_load -w 15,10,5 -c 30,25,20/' "$nrpe_cfg" + + print_success "NRPE configuration updated" +} + +# Create Nagios admin user +create_nagios_admin() { + print_header "Creating Nagios admin user" + + print_info "Creating web interface admin user: $NAGIOS_ADMIN_USER" + + # Create htpasswd file + if [ -f /usr/local/nagios/etc/htpasswd.users ]; then + print_warning "Admin user already exists, skipping creation" + else + # Get password securely + read_password "Enter password for Nagios admin user '$NAGIOS_ADMIN_USER'" ADMIN_PASSWORD || error_exit "Password required" + read_password "Confirm password for '$NAGIOS_ADMIN_USER'" ADMIN_PASSWORD_CONFIRM || error_exit "Password confirmation required" + + if [ "$ADMIN_PASSWORD" != "$ADMIN_PASSWORD_CONFIRM" ]; then + error_exit "Passwords do not match" + fi + + # Create htpasswd file + echo "$ADMIN_PASSWORD" | htpasswd -i -c /usr/local/nagios/etc/htpasswd.users "$NAGIOS_ADMIN_USER" + + print_success "Admin user '$NAGIOS_ADMIN_USER' created" + fi +} + +# Configure web server +configure_webserver() { + print_header "Configuring web server" + + case "$OS" in + rhel) + # Start and enable Apache + systemctl enable httpd + systemctl start httpd + ;; + debian) + # Start and enable Apache + systemctl enable apache2 + systemctl start apache2 + ;; + esac + + print_success "Web server configured" +} + +# Configure SELinux +configure_selinux() { + if ! command_exists getenforce; then + return 0 + fi + + local selinux_mode=$(getenforce) + if [[ "$selinux_mode" == "Disabled" ]]; then + return 0 + fi + + print_header "Configuring SELinux" + + # Set SELinux contexts + chcon -R -t httpd_sys_content_t /usr/local/nagios/share/ 2>/dev/null || true + chcon -R -t httpd_sys_rw_content_t /usr/local/nagios/var/ 2>/dev/null || true + chcon -R -t httpd_sys_script_exec_t /usr/local/nagios/sbin/ 2>/dev/null || true + chcon -R -t httpd_sys_rw_content_t /usr/local/nagios/var/rw/ 2>/dev/null || true + + # Set SELinux booleans + setsebool -P httpd_can_network_connect 1 - echo -e "\nTesting Nagios configuration\n" - /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg + print_success "SELinux configured" +} + +# Configure firewall +configure_firewall() { + print_header "Configuring firewall" + + if command_exists firewall-cmd; then + # firewalld (RHEL-based) + firewall-cmd --permanent --add-service=http + firewall-cmd --permanent --add-service=https + firewall-cmd --permanent --add-port=5666/tcp + firewall-cmd --reload + print_success "Firewall configured (firewalld)" + elif command_exists ufw; then + # ufw (Debian-based) + ufw allow 'Apache Full' + ufw allow 5666/tcp + print_success "Firewall configured (ufw)" + else + print_warning "No supported firewall found" + fi +} + +# Start services +start_services() { + print_header "Starting services" - echo -e "\nStarting Nagios service\n" + # Enable and start Nagios + systemctl enable nagios systemctl start nagios - systemctl restart nrpe.service - systemctl restart httpd + + # Enable and start NRPE + systemctl enable nrpe + systemctl start nrpe + + # Restart web server + if [ "$OS" = "debian" ]; then + systemctl restart apache2 + else + systemctl restart httpd + fi + + # Verify Nagios configuration + print_info "Verifying Nagios configuration..." + if /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg; then + print_success "Nagios configuration is valid" + else + error_exit "Nagios configuration validation failed" + fi + + print_success "All services started" } -post_installation() { - cd - yum install php php-mysql php-devel -y - systemctl restart httpd +# Display summary +display_summary() { + print_header "Installation Complete" + + local ip_addr=$(hostname -I | awk '{print $1}') + local protocol="http" + [ "$ENABLE_SSL" = "yes" ] && protocol="https" + + print_success "Nagios monitoring system installed successfully!" + echo + + print_info "Access Information:" + print_info " Web Interface: ${protocol}://${ip_addr}/nagios" + print_info " Username: $NAGIOS_ADMIN_USER" + print_info " Password: " + echo + + print_info "Installation Details:" + print_info " Nagios Core: $NAGIOS_VERSION" + print_info " Nagios Plugins: $NAGIOS_PLUGINS_VERSION" + print_info " NRPE: $NRPE_VERSION" + print_info " Home directory: /usr/local/nagios/" + print_info " Configuration: /usr/local/nagios/etc/nagios.cfg" + print_info " Plugins: /usr/local/nagios/libexec/" + echo + + print_info "Service Management:" + print_info " systemctl status nagios # Check Nagios status" + print_info " systemctl restart nagios # Restart Nagios" + print_info " systemctl status nrpe # Check NRPE status" + echo + + print_info "Configuration Files:" + print_info " Main config: /usr/local/nagios/etc/nagios.cfg" + print_info " Contacts: /usr/local/nagios/etc/objects/contacts.cfg" + print_info " Commands: /usr/local/nagios/etc/objects/commands.cfg" + print_info " NRPE config: /usr/local/nagios/etc/nrpe.cfg" + print_info " Custom hosts: /usr/local/nagios/etc/servers/" + echo + + print_info "Testing NRPE:" + print_info " /usr/local/nagios/libexec/check_nrpe -H localhost" + print_info " /usr/local/nagios/libexec/check_nrpe -H localhost -c check_load" + echo + + print_info "View Logs:" + print_info " tail -f /usr/local/nagios/var/nagios.log" + print_info " journalctl -u nagios -f" + echo + + print_info "Next Steps:" + print_info " 1. Access the web interface and log in" + print_info " 2. Add monitored hosts in /usr/local/nagios/etc/servers/" + print_info " 3. Reload Nagios: systemctl reload nagios" + print_info " 4. Configure notifications in contacts.cfg" + + log_success "Nagios installation completed" +} - chcon -R --reference=/var/www/html /usr/local/nagios/share - chcon -R --reference=/var/www/html /usr/local/nagios/var - chcon -R --reference=/var/www/cgi-bin /usr/local/nagios/sbin - chcon -R -t httpd_sys_rw_content_t /usr/local/nagios/var/rw +# Main installation flow +main() { + install_prerequisites + create_nagios_user + install_nagios_core + install_nagios_plugins + install_nrpe + configure_nagios + configure_nrpe + create_nagios_admin + configure_webserver + configure_selinux + configure_firewall + start_services - systemctl restart httpd + # Cleanup + cd / + rm -rf "$BUILD_DIR" - echo -e "\nInstallation Complete..\nLogin using the URL: http://$ipaddr/nagios\nUsername:nagiosadmin\nPassword:" + display_summary } -echo -e "\n\nInstalling prerequisites: Yum Update, Install Dev-Tools, Install Apache\n\n" -prerequisites -echo -e "\n\nInstalling Nagios\n\n" -install_nagios -echo -e "\n\nInstalling Nagios Plugins\n\n" -install_nagios_plugins -echo -e "\n\nInstalling NRPE\n\n" -install_nrpe -echo -e "\n\nConfiguring NRPE and Nagios\n\n" -configuration -echo -e "\n\nPost Installation: Apache context\n\n" -post_installation +# Run main +main diff --git a/installation_scripts/install_salt.sh b/installation_scripts/install_salt.sh index 172e283..d9e55ee 100755 --- a/installation_scripts/install_salt.sh +++ b/installation_scripts/install_salt.sh @@ -1,38 +1,439 @@ -#!/bin/bash +#!/usr/bin/env bash +set -euo pipefail + ################################################# # # -# A shell script to install SaltStack on CentOS # +# Install Salt Master configuration mgmt # +# Multi-OS support with modern repos # # # ################################################# -# check if the current user is root -if [[ $(/usr/bin/id -u) != "0" ]]; then - echo -e "This looks like a 'non-root' user.\nPlease switch to 'root' and run the script again." - exit -fi +# Source common library +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "${SCRIPT_DIR}/../lib/common.sh" + +# Setup +trap cleanup_on_exit EXIT +require_root + +# Configuration +SALT_VERSION="${SALT_VERSION:-latest}" # latest, 3006, 3005, etc. +INSTALL_MINION="${INSTALL_MINION:-yes}" +INSTALL_CLOUD="${INSTALL_CLOUD:-no}" +INSTALL_SSH="${INSTALL_SSH:-yes}" + +print_header "Salt Master Installer" + +# Detect OS +OS=$(detect_os) +PKG_MGR=$(get_package_manager) + +print_info "Detected OS: $OS" +print_info "Package manager: $PKG_MGR" +print_info "Salt version: $SALT_VERSION" +print_info "Install minion: $INSTALL_MINION" +print_info "Install salt-cloud: $INSTALL_CLOUD" +print_info "Install salt-ssh: $INSTALL_SSH" +echo + +# Add Salt repository +add_salt_repository() { + print_header "Adding Salt repository" + + case "$OS" in + rhel) + local rhel_major=$(rpm -E %{rhel}) + + # Add SaltProject repository + print_info "Adding SaltProject repository for RHEL ${rhel_major}..." + + if [ "$SALT_VERSION" = "latest" ]; then + # Latest Salt version (3006.x LTS as of 2024) + cat > /etc/yum.repos.d/salt.repo < /etc/yum.repos.d/salt.repo < /etc/salt/minion.d/local-master.conf < /etc/salt/master.d/basic.conf < /srv/salt/top.sls <<'EOF' +# Salt State Tree (top.sls) +# This file defines which states apply to which minions + +base: + '*': + - common + +# Example targeting by OS +# 'os:RedHat': +# - match: grain +# - redhat_specific +# +# 'os:Debian': +# - match: grain +# - debian_specific +EOF + print_info "Created example top.sls" + fi + + # Create example common state + if [ ! -f /srv/salt/common.sls ]; then + cat > /srv/salt/common.sls <<'EOF' +# Common state for all minions + +# Install basic packages +common_packages: + pkg.installed: + - pkgs: + - vim + - curl + - wget + - htop + +# Ensure SSH service is running +sshd: + service.running: + - enable: True +EOF + print_info "Created example common.sls state" + fi + + print_success "Salt Master configured" +} + +# Configure firewall +configure_firewall() { + print_header "Configuring firewall" + + if command_exists firewall-cmd; then + # firewalld (RHEL-based) + # Salt Master ports: 4505 (publish), 4506 (request) + firewall-cmd --permanent --add-port=4505/tcp + firewall-cmd --permanent --add-port=4506/tcp + firewall-cmd --reload + print_success "Firewall configured (firewalld)" + elif command_exists ufw; then + # ufw (Debian-based) + ufw allow 4505/tcp + ufw allow 4506/tcp + print_success "Firewall configured (ufw)" + else + print_warning "No supported firewall found" + print_info "Manually open ports 4505/tcp and 4506/tcp if using a firewall" + fi +} + +# Start services +start_services() { + print_header "Starting services" + + # Enable and start Salt Master systemctl enable salt-master systemctl start salt-master - systemctl status salt-master - firewall-cmd --zone=public --add-port=4505/tcp --permanent - firewall-cmd --zone=public --add-port=4506/tcp --permanent + + # Enable and start Salt Minion if installed + if [ "$INSTALL_MINION" = "yes" ]; then + systemctl enable salt-minion + systemctl start salt-minion + + # Wait for minion to start + sleep 3 + + # Accept minion key + print_info "Accepting local minion key..." + local minion_id=$(hostname -s) + salt-key -y -a "$minion_id" 2>/dev/null || print_warning "Could not auto-accept minion key" + fi + + print_success "Services started" +} + +# Test Salt installation +test_salt() { + print_header "Testing Salt installation" + + # Check master status + if systemctl is-active --quiet salt-master; then + print_success "Salt Master is running" + else + print_warning "Salt Master is not running" + fi + + # Test salt command + if command_exists salt; then + local salt_version=$(salt --version | head -1) + print_info "Salt version: $salt_version" + fi + + # Test minion connectivity if installed + if [ "$INSTALL_MINION" = "yes" ]; then + sleep 2 + print_info "Testing minion connectivity..." + if salt '*' test.ping --timeout=5 2>/dev/null | grep -q "True"; then + print_success "Minion connectivity test passed" + else + print_warning "Minion connectivity test failed (may need to accept key manually)" + fi + fi +} + +# Display summary +display_summary() { + print_header "Installation Complete" + + local ip_addr=$(hostname -I | awk '{print $1}') + + print_success "Salt Master installed successfully!" + echo + + print_info "Installation Details:" + print_info " Salt Master: Installed" + [ "$INSTALL_MINION" = "yes" ] && print_info " Salt Minion: Installed" + [ "$INSTALL_SSH" = "yes" ] && print_info " Salt SSH: Installed" + [ "$INSTALL_CLOUD" = "yes" ] && print_info " Salt Cloud: Installed" + print_info " Master IP: $ip_addr" + print_info " Ports: 4505 (publish), 4506 (request)" + echo + + print_info "Configuration:" + print_info " Master config: /etc/salt/master" + print_info " Master config.d: /etc/salt/master.d/" + print_info " Salt states: /srv/salt/" + print_info " Pillar data: /srv/pillar/" + echo + + print_info "Service Management:" + print_info " systemctl status salt-master # Check master status" + print_info " systemctl restart salt-master # Restart master" + if [ "$INSTALL_MINION" = "yes" ]; then + print_info " systemctl status salt-minion # Check minion status" + fi + echo + + print_info "Common Salt Commands:" + print_info " salt-key -L # List all keys" + print_info " salt-key -A # Accept all pending keys" + print_info " salt-key -a # Accept specific key" + print_info " salt '*' test.ping # Test connectivity to all minions" + print_info " salt '*' cmd.run 'uptime' # Run command on all minions" + print_info " salt '*' state.apply # Apply states to all minions" + echo + + print_info "Configuration on Minions:" + print_info " 1. Install salt-minion on target systems" + print_info " 2. Configure master: $ip_addr in /etc/salt/minion" + print_info " 3. Start minion: systemctl start salt-minion" + print_info " 4. Accept key on master: salt-key -a " + echo + + print_info "Next Steps:" + print_info " 1. Create Salt states in /srv/salt/" + print_info " 2. Deploy minions to managed systems" + print_info " 3. Accept minion keys: salt-key -A" + print_info " 4. Test connectivity: salt '*' test.ping" + print_info " 5. Apply states: salt '*' state.apply" + echo + + print_info "Documentation:" + print_info " https://docs.saltproject.io/" + + log_success "Salt Master installation completed" } -install_saltminion() { - yum install salt-minion salt-ssh -y - systemctl enable salt-minion - systemctl start salt-minion - firewall-cmd --zone=public --add-port=4506/tcp --permanent +# Main installation flow +main() { + add_salt_repository + install_salt_master + install_salt_minion + install_salt_ssh + install_salt_cloud + configure_salt_master + configure_firewall + start_services + test_salt + display_summary } -prerequisites -install_saltmaster -install_saltminion +# Run main +main diff --git a/installation_scripts/install_salt_minion.sh b/installation_scripts/install_salt_minion.sh index 4e0a8f7..8130813 100755 --- a/installation_scripts/install_salt_minion.sh +++ b/installation_scripts/install_salt_minion.sh @@ -1,79 +1,352 @@ -#!/bin/bash +#!/usr/bin/env bash +set -euo pipefail ################################################# # # -# A shell script to install Salt Minion # -# on CentOS or Debian # +# Install Salt Minion agent # +# Multi-OS support with modern repos # # # ################################################# -# check if the current user is root -if [[ $(/usr/bin/id -u) != "0" ]]; then - echo -e "This looks like a 'non-root' user.\nPlease switch to 'root' and run the script again." - exit -fi +# Source common library +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "${SCRIPT_DIR}/../lib/common.sh" -salt_master=$1 -os_type=$(gawk -F= '/^ID=/{print $2}' /etc/os-release) +# Setup +trap cleanup_on_exit EXIT +require_root -check_master() { - if [[ $salt_master == '' ]]; then - echo -e "Usage: ./install_salt_minion.sh salt-master-ip OR \nUsage: ./install_salt_minion.sh salt-master-hostname" - exit +# Configuration +SALT_MASTER="${1:-}" +SALT_VERSION="${SALT_VERSION:-latest}" # latest, 3006, 3005, etc. +MINION_ID="${MINION_ID:-$(hostname -f)}" +INSTALL_SSH="${INSTALL_SSH:-no}" + +print_header "Salt Minion Installer" + +# Detect OS +OS=$(detect_os) +PKG_MGR=$(get_package_manager) + +print_info "Detected OS: $OS" +print_info "Package manager: $PKG_MGR" +print_info "Salt version: $SALT_VERSION" +print_info "Install salt-ssh: $INSTALL_SSH" +echo + +# Validate master parameter +validate_master() { + if [[ -z "$SALT_MASTER" ]]; then + error_exit "Usage: $0 [options] + +Examples: + $0 192.168.1.100 # Connect to master IP + $0 salt.example.com # Connect to master hostname + SALT_VERSION=3006 $0 192.168.1.100 # Specific Salt version + MINION_ID=webserver01 $0 salt.master # Custom minion ID" + fi + + # Validate master is IP or hostname + if ! validate_ip "$SALT_MASTER" && ! validate_domain "$SALT_MASTER"; then + if ! validate_hostname "$SALT_MASTER"; then + error_exit "Invalid master address: $SALT_MASTER (must be IP, hostname, or FQDN)" + fi fi + + print_info "Salt Master: $SALT_MASTER" + print_info "Minion ID: $MINION_ID" + echo } -prerequisites_centos(){ +# Validate hostname (simple check) +validate_hostname() { + local hostname="$1" + [[ "$hostname" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$ ]] +} + +# Add Salt repository +add_salt_repository() { + print_header "Adding Salt repository" + + case "$OS" in + rhel) + local rhel_major=$(rpm -E %{rhel}) + + # Add SaltProject repository + print_info "Adding SaltProject repository for RHEL ${rhel_major}..." - cat > /etc/yum.repos.d/saltstack.repo << saltrepo -[saltstack-repo] -name=SaltStack repo for Red Hat Enterprise Linux \$releasever -baseurl=https://repo.saltstack.com/yum/redhat/\$releasever/\$basearch/latest + if [ "$SALT_VERSION" = "latest" ]; then + # Latest Salt version + cat > /etc/yum.repos.d/salt.repo < /etc/yum.repos.d/salt.repo < /etc/apt/sources.list.d/saltstack.list - - apt-get upgrade -y - apt-get update -y - apt-get install systemd firewalld python-systemd -y +# Install Salt Minion +install_salt_minion() { + print_header "Installing Salt Minion" + + case "$OS" in + rhel) + $PKG_MGR install -y salt-minion + ;; + debian) + apt-get install -y salt-minion + ;; + esac + + print_success "Salt Minion installed" } -install_saltminion_centos() { - yum install salt-common salt-minion salt-ssh -y +# Install Salt SSH (optional) +install_salt_ssh() { + if [ "$INSTALL_SSH" != "yes" ]; then + print_info "Skipping Salt SSH installation" + return 0 + fi + + print_header "Installing Salt SSH" + + case "$OS" in + rhel) + $PKG_MGR install -y salt-ssh + ;; + debian) + apt-get install -y salt-ssh + ;; + esac + + print_success "Salt SSH installed" } -install_saltminion_debian() { - apt-get install salt-common salt-minion salt-ssh -y +# Configure Salt Minion +configure_salt_minion() { + print_header "Configuring Salt Minion" + + # Create minion.d directory + mkdir -p /etc/salt/minion.d + + # Create master configuration + cat > /etc/salt/minion.d/master.conf < /etc/salt/minion.d/minion_id.conf < /etc/salt/minion.d/basic.conf </dev/null; then + print_success "Minion authenticated with master" + else + print_info "Waiting for master to accept minion key" + print_info "On the master, run: salt-key -a $MINION_ID" + fi + fi +} + +# Display summary +display_summary() { + print_header "Installation Complete" + + print_success "Salt Minion installed successfully!" + echo + + print_info "Configuration:" + print_info " Minion ID: $MINION_ID" + print_info " Salt Master: $SALT_MASTER" + print_info " Minion config: /etc/salt/minion" + print_info " Minion config.d: /etc/salt/minion.d/" + print_info " Log file: /var/log/salt/minion" + echo + + print_info "Service Management:" + print_info " systemctl status salt-minion # Check service status" + print_info " systemctl restart salt-minion # Restart service" + print_info " systemctl stop salt-minion # Stop service" + echo + + print_info "View Logs:" + print_info " tail -f /var/log/salt/minion" + print_info " journalctl -u salt-minion -f" + echo + + print_info "On Salt Master ($SALT_MASTER):" + print_info " salt-key -L # List all minion keys" + print_info " salt-key -a $MINION_ID # Accept this minion's key" + print_info " salt-key -A # Accept all pending keys" + print_info " salt '$MINION_ID' test.ping # Test connectivity" + print_info " salt '$MINION_ID' state.apply # Apply states" + echo + + print_info "Troubleshooting:" + print_info " 1. Ensure master is reachable: ping $SALT_MASTER" + print_info " 2. Check firewall allows ports 4505 and 4506" + print_info " 3. Verify minion key on master: salt-key -L" + print_info " 4. Check minion logs: tail -f /var/log/salt/minion" + echo + + print_info "Next Steps:" + print_info " 1. Accept this minion's key on the master" + print_info " 2. Test connectivity: salt '$MINION_ID' test.ping" + print_info " 3. Apply states from master" + + log_success "Salt Minion installation completed" +} + +# Main installation flow +main() { + validate_master + add_salt_repository + install_salt_minion + install_salt_ssh + configure_salt_minion + configure_firewall + start_service + test_minion + display_summary +} -configure_saltminion +# Run main +main diff --git a/installation_scripts/install_squid.sh b/installation_scripts/install_squid.sh index 954be05..2e27577 100755 --- a/installation_scripts/install_squid.sh +++ b/installation_scripts/install_squid.sh @@ -1,45 +1,470 @@ -#!/bin/bash +#!/usr/bin/env bash +set -euo pipefail + ################################################# # # -# A shell script to install Squid on CentOS # +# Install Squid caching proxy server # +# Multi-OS support with configuration # # # ################################################# -# check if the current user is root -if [[ $(/usr/bin/id -u) != "0" ]]; then - echo -e "This looks like a 'non-root' user.\nPlease switch to 'root' and run the script again." - exit -fi +# Source common library +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "${SCRIPT_DIR}/../lib/common.sh" + +# Setup +trap cleanup_on_exit EXIT +require_root + +# Configuration +SQUID_PORT="${SQUID_PORT:-3128}" +SQUID_MODE="${SQUID_MODE:-forward}" # forward, transparent, or reverse +ALLOWED_NETWORK="${ALLOWED_NETWORK:-}" # e.g., 192.168.1.0/24 +ENABLE_CACHE="${ENABLE_CACHE:-yes}" +CACHE_SIZE="${CACHE_SIZE:-1024}" # MB + +print_header "Squid Proxy Server Installer" +# Detect OS +OS=$(detect_os) +PKG_MGR=$(get_package_manager) + +print_info "Detected OS: $OS" +print_info "Package manager: $PKG_MGR" +print_info "Squid port: $SQUID_PORT" +print_info "Proxy mode: $SQUID_MODE" +print_info "Enable cache: $ENABLE_CACHE" +[ "$ENABLE_CACHE" = "yes" ] && print_info "Cache size: ${CACHE_SIZE}MB" +echo + +# Install Squid install_squid() { - yum update -y - yum install epel-release -y - yum install squid -y + print_header "Installing Squid" + + case "$OS" in + rhel) + case "$PKG_MGR" in + dnf) + # EPEL not always needed on RHEL 9+, but include for safety + dnf install -y epel-release 2>/dev/null || true + dnf install -y squid + ;; + yum) + yum install -y epel-release + yum install -y squid + ;; + esac + ;; + debian) + apt-get update + apt-get install -y squid + ;; + *) + error_exit "Unsupported OS: $OS" + ;; + esac + + print_success "Squid installed" +} + +# Backup original configuration +backup_configuration() { + print_header "Backing up Squid configuration" + + local config_file="/etc/squid/squid.conf" + + if [ -f "$config_file" ]; then + cp "$config_file" "${config_file}.bak-$(date +%Y%m%d-%H%M%S)" + print_success "Configuration backed up" + fi } +# Configure Squid +configure_squid() { + print_header "Configuring Squid" + + local config_file="/etc/squid/squid.conf" + + # Create configuration based on mode + case "$SQUID_MODE" in + forward) + configure_forward_proxy + ;; + transparent) + configure_transparent_proxy + ;; + reverse) + configure_reverse_proxy + ;; + *) + error_exit "Invalid proxy mode: $SQUID_MODE (must be: forward, transparent, or reverse)" + ;; + esac + + # Create blocked sites file + touch /etc/squid/blocked_sites + print_info "Created /etc/squid/blocked_sites for site blocking" + + print_success "Squid configured" +} + +# Configure forward proxy +configure_forward_proxy() { + print_info "Configuring forward proxy..." + + local config_file="/etc/squid/squid.conf" + + cat > "$config_file" <> "$config_file" <> "$config_file" <> "$config_file" <> "$config_file" <> "$config_file" <> "$config_file" < "$config_file" <> "$config_file" <> "$config_file" <> "$config_file" < "$config_file" <> /etc/squid/blocked_sites" + print_info " systemctl reload squid" + echo + + case "$SQUID_MODE" in + forward) + print_info "Client Configuration (Forward Proxy):" + print_info " HTTP Proxy: ${ip_addr}:${SQUID_PORT}" + print_info " Set this in browser or system proxy settings" + ;; + transparent) + print_info "Transparent Proxy Setup:" + print_info " Configure iptables to redirect port 80 to ${SQUID_PORT}:" + print_info " iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port ${SQUID_PORT}" + ;; + reverse) + print_info "Reverse Proxy:" + print_info " Squid forwards requests to backend server" + print_info " Clients connect to: ${ip_addr}:${SQUID_PORT}" + ;; + esac + + log_success "Squid installation completed" } -initial_conf() { - touch /etc/squid/blocked_sites +# Main installation flow +main() { + install_squid + backup_configuration + configure_squid + initialize_cache + configure_firewall + start_squid + display_summary } -install_squid -start_squid -backup_conf -initial_conf -restart_squid +# Run main +main