kso512/install-check_mk-server

Ansible role to install Check_MK RAW Edition

kso512

Hi there 👋

• 🔭 I’m currently working on cybersecurity.
• 🌱 I’m currently learning Python.
• 👯 I’m looking to collaborate on open source software.
• 🤔 I’m looking for help with improving the code in my repositories.
• 💬 Ask me about code I wrote over 20 years ago that's still in production.
• 📫 How to reach me:
  • Create an issue here
• 😄 Pronouns: he/him
• ⚡ Fun facts:
  • I was paid to professionally scare people at a haunted house, but the best role was "audience plant" where I would dress as a paying member of the public and interact with the other actors in ways the normal public could not. For example: being dragged over the railing and acting like I was being disemboweled. Corollary fun fact: no one ever tried to help; they all just ran away screaming!
  • I was paid to boil water for the U.S. Navy (in a nuclear submarine) but the most fun was acting in drills as a "gone crazy shipmate" - then seeing how the other sailors reacted.
  • As a volunteer, I helped hundreds of people drastically change their life by helping them get a tattoo they no longer wanted removed for very low cost. Some of the tattoos were associated with abuse and one person thought they would have to live with it forever - we were so glad to help them move past that dark part of their life and not have to be reminded of it in the mirror each day. We actually completed our mission and closed up the non-profit project!
  • While assuring the quality of medical software on handheld devices, I also designed and built a presentation system that booted up 16 virtual machines. Each virtual machine ran a virtual handheld device with our medical software and a "random-button-pusher" application used for fuzz testing named ChaosMonkey. The 16 displays were automatically tiled across 4 monitors, so the presenter would only need to connect all the cables and power on the system.
  • As an internal support technician, I helped support a large conference by developing a master "golden image" with our new software, then "flashing" it on 20+ demo systems in one go using Clonezilla.
• I often find myself in a support role, as shown in this image from long ago when I was playing Shen in League of Legends:
  • 

install-check_mk-server's Issues

CentOS 8 Support

I tried using this role against CentOS 8.0 with Ansible 2.9.2 and encountered the following issues:

DNF

For CentOS 8.0 the fact ansible_os_family will have the value dnf. Therefore the yum installation steps will be skipped.

My dirty fix was to override this fact to use yum as preferred package manager. The proper fix would be to add dnf blocks to the tasks file.

PowerTools Repo

The required package graphviz-gd was not found during installation. CentOS 7 had it in Base repository, but it was moved to the PowerTools repo. We can enable this repo with yum config-manager.

SELinux

After the installation was successful I was shown "OMD: Site Not Started" instead of the web interface. SELinux was enabled on my installation and it prevented the webserver from connecting to the CMK backend at port 5000. @kso512 warned us about SELinux.

We can resolve this with the command setsebool -P httpd_can_network_connect 1 or with Ansible, of course.

python-passlib

Package python-passlib also isn't available in CentOS default repositories. I fixed this by replacing it with python3-passlib in variable install_check_mk_server_prereqs in tasks/CentOS.yaml.

Playbook with fixes

---

- hosts: satellites
  pre_tasks:
    - name: Apply EL8 fixes
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version >= 8
      block:
        - name: Use yum as preferred package manager
          set_fact: ansible_pkg_mgr=yum
        - name: Enable PowerTools repository
          shell: |
            dnf config-manager --set-enabled PowerTools
        - name: Set httpd_can_network_connect flag on and keep it persistent across reboots
          seboolean:
            name: httpd_can_network_connect
            state: yes
            persistent: yes
  roles:
    - role: geerlingguy.repo-epel
    - role: install-check_mk-server

URL Update

Hi!
I notice you that the URL for downlading rpm is changed.
You need to update defaults vars to new one:

install_check_mk_server_source_url: https://checkmk.com/support//{{ install_check_mk_server_version }}/{{ install_check_mk_server_source }}

Site admin password

Hello, I just found your role and having a play. It looks like when the omd site is created, default behavior is to echo the cmkadmin password. After installing with your role, I was able to get the password from the omd-create.log but not really ideal if I want to do further automation after the install role is finished.

In the log it says you can change the admin password by running 'htpasswd -m ~/etc/htpasswd cmkadmin' as the site user, perhaps a task that runs that with a var to change to a password you specify? Unfortunately it prompts you for the new password and confirmation so I am not sure how to do that. Do you have any ideas?

Install on CentOS7 minimal install fails

I took a minimal install of CentOS and tried to install.
It failed so I modified the playbook accordingly but I suspect this needs updating to include the 'if yum' logic

Needs 'epel-release' and 'perl-Net-SNMP'

$ cat playbooks/install-check_mk-server.yaml

• name: Playbook to configure Check_MK servers
  hosts: mycheckmkserver
  become: true
  pre_tasks:
  • name: Install prerequisite packages
    package:
    name: epel-release
    state: present
    roles:
  • role: ../roles/install-check_mk-server
    install_check_mk_server_site: mysite
    install_check_mk_server_prereqs:
    • perl-Net-SNMP