Package: checkpkgaudit
Source:https://github.com/jpcw/checkpkgauditBugtracker:https://github.com/jpcw/checkpkgaudit/issuesContentsusageInstallNagios|icinga like configurationtestingChangelog0.7.2 (2017-06-05)0.7.1 (2017-03-08)0.7 (2017-03-07)0.6 (2016-03-14)0.5 (2016-03-11)0.4 (2015-03-21)0.3 (2015-03-21)0.2 (2015-03-06)0.1 (2015-03-06)ContributorsusageThis check runs pkg audit over your host and its running jailssample outputs :OkCHECKPKGAUDIT OK - 0 vulnerabilities found ! | 'host.domain.tld'=0;;@1:;0 http=0;;@1:;0 masterdns=0;;@1:;0 ns0=0;;@1:;0 ns1=0;;@1:;0 ns2=0;;@1:;0 smtp=0;;@1:;0CriticalCritical state is reached with first vulnerable pkg. No warning, no configurable threasold, why waiting 2 or more vulnerabilities ?We are talking about security vulnerabilities !Of course, the plugin sum all the vulnerabilities and details each host|jail concernedCHECKPKGAUDIT CRITICAL - found 2 vulnerable(s) pkg(s) in : ns2, ns3 | 'host.domain.tld'=0;;@1:;0 http=0;;@1:;0 masterdns=0;;@1:;0 ns0=0;;@1:;0 ns1=0;;@1:;0 ns2=1;;@1:;0 ns3=1;;@1:;0 smtp=0;;@1:;0Notice that summary returns the total amount problems :found2vulnerable(s) pkg(s) in :ns2, ns3but performance data is detailled by host|jailUnknownif an error occured during pkg audit, the plugin raises a check error, which returns an UNKNOWN state.typically UNKNOWN causespkg audit -Fhas not been runned on host or a jailCHECKPKGAUDIT UNKNOWN - jailname  Try running 'pkg audit -F' first | 'host.domain.tld'=0;;@1:;0 http=0;;@1:;0 masterdns=0;;@1:;0 ns0=0;;@1:;0 ns1=0;;@1:;0 ns2=0;;@1:;0 smtp=0;;@1:;0pkg -j jailname auditrunned as a non sudoer userCHECKPKGAUDIT UNKNOWN - jailname pkg: jail_attach(jailname): Operation not permitted | 'host.domain.tld'=0;;@1:;0If you have running jails, sudo is your friend to run this plugin with an unprivileged user. A sample config hereicinga ALL = NOPASSWD: /usr/local/bin/check_pkgauditInstallcheckpkgauditcan be installed via
eithereasy_installorpip.Within or not a virtualenv:easy_install checkpkgaudit#orpip install checkpkgauditcheck_pkgauditis located at /usr/local/bin/check_pkgauditWarningSSL certificate errorIf you encountered an ssl certificate error with easy_install,
you probably need to install the Root certificate bundle
from the Mozilla Project:pkg install -y ca_root_nss
ln -s /usr/local/share/certs/ca-root-nss.crt /etc/ssl/cert.pemNagios|icinga like configurationcheck_pkgauditcould be called localy or remotely
viacheck_by_sshorNRPE.check_by_sshhere a sample definition to check remotely by sshCommand definitiondefine command{
    command_name    check_ssh_pkgaudit
    command_line    $USER1$/check_by_ssh -H $HOSTADDRESS$ -i /var/spool/icinga/.ssh/id_rsa -C "sudo /usr/local/bin/check_pkgaudit"
}the service itselfdefine service{
    use                     my-service
    host_name               hostname
    service_description     pkg audit
    check_command           check_ssh_pkgaudit!
}icinga2 commandobject CheckCommand "pkgaudit" {
import "plugin-check-command"
import "ipv4-or-ipv6"
command = [ PluginDir + "/check_by_ssh" ]
arguments = {
    "-H" = "$address$"
    "-i" = "$ssh_id$"
    "-p" = "$ssh_port$"
    "-C" = "$ssh_command$"
    }
vars.address = "$check_address$"
vars.ssh_id = "/var/spool/icinga/.ssh/id_rsa"
vars.ssh_port = "$vars.ssh_port$"
vars.ssh_command = "sudo /usr/local/bin/check_pkgaudit"
}icinga2 serviceapply Service "pkgaudit" {
    check_command = "pkgaudit"
    assign where host.name == "hostname"
}NRPEadd this line to /usr/local/etc/nrpe.cfg...
command[check_pkgaudit]=/usr/local/bin/check_pkgaudit
...nagios command definitiondefine command{
    command_name    check_nrpe_pkgaudit
    command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -c check_pkgaudit
}the service itselfdefine service{
    use                     my-service
    host_name               hostname
    service_description     pkg audit
    check_command           check_nrpe_pkgaudit
}testingpythonbootstrap-buildout.py--setuptools-version=33.1.1--buildout-version=2.5.2bin/buildout-Nbin/testChangelog0.7.2 (2017-06-05)fix python3 supporthttps://github.com/jpcw/checkpkgaudit/issues/100.7.1 (2017-03-08)README improvment – Lcaracol0.7 (2017-03-07)fix missing ip jls output with vnet jailshttps://github.com/jpcw/checkpkgaudit/issues/4– blQnremove py2.6, py32 and add py3.6 support0.6 (2016-03-14)add exclusion for hastd – voileux0.5 (2016-03-11)add support for jails with different jails and hostnames – StbX0.4 (2015-03-21)improve README with possible pypi ssl certificate problem, provide a workaround0.3 (2015-03-21)fix install README typo – Nicolas RAHIR noxadd NRPE conf sample – Nicolas RAHIR nox0.2 (2015-03-06)fix badges0.1 (2015-03-06)Jean-Philippe Camguilhem <jpcw__at__camguilhem.net>ContributorsMathias : LcaracolDamien LACOSTE : Dam64Thomas BALDAQUIN : blQnSimon RECHER : voileuxSteffen Brandemann : StbXNicolas RAHIR : noxJean-Philippe Camguilhem, Author