tutorial

To monitor my Linux servers, I have been using icinga since its forking from the popular Nagios. Icinga has really matured over the last few years and currently at version 2.4.4, I would recommend anyone serious at network and server monitoring to check this open source project. Installation and setup of icinga2 is somewhat complex, but if you are an experienced command line sort of guy, its not that hard at all. In fact the introduction of icingaweb2 has made it possible to have an easy to use interface to setup your monitoring needs. I will not delve into the nitty gritty of install and setup. For that please take a look at the detailed documentation.

Several alerts are possible when using Icinga including e-mail, sms, XMPP, IRC, twitter etc. I wanted a way to get notified of host and service failures using telegram. Luckily, telegram provides an API to do just that.

The secret source in all of this; is to install a command line interface for telegram called telegram-cli . In order for telegram-cli to compile without any issues, ensure that all dependencies are installed

For Fedora:

sudo dnf -y install
lua-devel openssl-devel libconfig-devel readline-devel libevent-devel
jansson-devel python-devel

For Ubuntu/Debian:

sudo apt-get install
libreadline-dev libconfig-dev libssl-dev lua5.2 liblua5.2-dev
libevent-dev libjansson-dev libpython-dev make 

Now install telegram-cli

cd /usr/src && git clone –recursive https://github.com/vysheng/tg.git

Note: Make sure you add the recursive flag to git clone, otherwise make will fail

cd tg

./configure && make

The binary is under ./bin/telegram-cli. Simply create a symbolic link to it.

cd /usr/sbin && ln -s /usr/src/tg/bin/telegram-cli .

Thats it for the installation of telegram-cli. Please read the README file in the sources root folder, especially on how to use this application.

Icinga2 telegram-cli setup

First ensure that the user icinga (created during icinga install process) can send a message using telegram-cli. Remember all alerts go out under the icinga user, so you have to get this part working first, lest you spend hours troubleshooting.

Temporarily change the shell for icinga from ‘/sbin/nologin’ to ‘/bin/bash.’ Remember to change back to nologin for icinga user when testing is completed.

usermod -s /bin/bash icinga

Now change to user icinga: Assumming that you are root user, if not you will be prompted for a password, which you would setup as root.

su -l icinga

telegram-cli

Enter your phone number and SMS code sent when prompted

Then test to see if you can send a message:

telegram-cli -D -W -e "msg [PEER_NAME] 'Hello World'"

If it works, then you can proceed to configure icinga2.

Create notification script for services

cat > /etc/icinga2/scripts/notify_services_via_telegram.sh << EOF

#!/usr/bin/env bash

TELEGRAM_CMD=/usr/sbin/telegram-cli

TELEGRAM_OPTS=”-D -W”

TELEGRAM_PEER=[PEER_NAME]

TELEGRAM_MSG=$(cat <<TEMPLATE

[$HOSTALIAS] $NOTIFICATIONTYPE: $SERVICEDESC is $SERVICESTATE

TEMPLATE

)

$TELEGRAM_CMD $TELEGRAM_OPTS -e “msg $TELEGRAM_PEER ‘$TELEGRAM_MSG'”

EOF

Ensure that above script is executable:

chmod 755 /etc/icinga2/scripts/notify_services_via_telegram.sh

Proceed to configure commands, notifications, and hosts config files: Note: Am only setting up notifications for services. You can do the same for hosts information.

cat >> /etc/icinga2/conf.d/commands.conf <<EOF

/** Telegram */

object NotificationCommand “telegram-service-notification” {

import “plugin-notification-command”

command = [ SysconfDir + “/icinga2/scripts/notify_services_via_telegram.sh” ]

env = {

“NOTIFICATIONTYPE” = “$notification.type$”

“SERVICEDESC” = “$service.name$”

“HOSTALIAS” = “$host.display_name$”,

“HOSTADDRESS” = “$address$”,

“SERVICESTATE” = “$service.state$”,

“LONGDATETIME” = “$icinga.long_date_time$”,

“SERVICEOUTPUT” = “$service.output$”,

“NOTIFICATIONAUTHORNAME” = “$notification.author$”,

“NOTIFICATIONCOMMENT” = “$notification.comment$”,

“HOSTDISPLAYNAME” = “$host.display_name$”,

“SERVICEDISPLAYNAME” = “$service.display_name$”,

“USEREMAIL” = “$user.email$”

}

}

EOF

cat >> /etc/icinga2/conf.d/notifications.conf <<EOF

/** Telegram */

apply Notification “telegram-icingaadmin” to Service {

import “telegram-service-notification”

user_groups = host.vars.notification.telegram.groups

users = host.vars.notification.telegram.users

assign where host.vars.notification.telegram

}

EOF

To get alerts on services for a host, add the following stanza to the host configuration in /etc/icinga2/conf.d/hosts.conf

/* Telegram */

vars.notification[“telegram”] = {

groups = [ “icingaadmins” ]

}

Finally, check your config files

icinga2 daemon -C

Restart icinga if all is OK. You will now be notified via telegram when services fail for the above configured host.

The purpose of this article is to demonstrate how you can turn a Linux based computer or laptop into a wireless hotspot where users can be authenticated via a captive portal page. For this task, the primary controller software will be CoovaChilli. This software is an ideal hotspot management solution for hotels, restaurants, supermarkets, parks, and any place offering WiFi Internet. Read more

This is the second part of my Nginx tutorial. The first part covered the installation process. In this post, I will show you how to modify the default configuration and get your server ready to serve CMS based websites like WordPress, Drupal, Joomla, Gallery etc

Before delving into the configuration of nginx, it is important to ensure that all the prerequisite software is installed and properly configured. Like all of my tutorials, I am using Linux and specifically Fedora 20.

PHP

Install the following php and related modules:

yum install php php-fpm php-pecl-apcu php-pdo php-mcrypt php-common php-mysqlnd php-process php-gd php-pear php-pear-DB php-pgsql php-xml php-cli php-xmlrpc php-mbstring php-pecl-igbinary php-pecl-memcache php-pecl-memcached php-pecl-mongo php-pecl-jsonc

Edit the php configuration file:

vim /etc/php.ini

I recommend setting the following parameters in php.ini:

short_open_tag = On
date.timezone = Africa/Kampala (or your time zone)

Edit the php-fpm configuration file:

vim /etc/php-fpm.d/www.conf

Change the following options in www.conf:

[www]
listen = 127.0.0.1:9000
;listen.allowed_clients = 127.0.0.1
user = nginx
group = nginx

Change permissions of the php sessions directory:

chown nginx:nginx /var/lib/php

Now enable and start php-fpm service:

systemctl enable php-fpm.service && systemctl start php-fpm.service

OPENSSL

Install openssl if you plan on securing your server; which you should!

yum install openssl openssl-libs openssl-devel

Add ssl directory where certificate and key will be stored:

mkdir /etc/nginx/ssl

Generate self-signed SSL certificate and key for your webserver:

openssl req -new -x509 -out /etc/nginx/ssl/cert.pem -key /etc/nginx/ssl/cert.key -days 365

SPAWN-FCGI

Install spawn-fcgi, a simple program for spawning FastCGI processes:

yum install spawn-fcgi

Edit the environment file for spawn-fcgi:

vim /etc/sysconfig/spawn-fcgi

Make the following changes:

FCGI_SOCKET=/var/run/fcgiwrap.socket
FCGI_PROGRAM=/usr/sbin/fcgiwrap
FCGI_USER=nginx
FCGI_GROUP=nginx
FCGI_EXTRA_OPTIONS="-M 0700"
OPTIONS="-u $FCGI_USER -g $FCGI_GROUP -s $FCGI_SOCKET -S $FCGI_EXTRA_OPTIONS -F 1 -P /var/run/spawn-fcgi.pid -- $FCGI_PROGRAM"

Enable and start spawn-fcgi.service:

systemctl enable spawn-fcgi.service && systemctl start spawn-fcgi.service

FCGIWRAP

Install fcgiwrap, a simple FastCGI wrapper for CGI scripts:

cd /usr/src

Download fcgiwrap sources:

git clone https://github.com/gnosek/fcgiwrap.git
cd /usr/src/fcgiwrap
autoreconf -i
./configure --prefix=/usr
make && make install

CONFIGURATION

Nginx’s configuration files are located under /etc/nginx. And as specified by the installation configure command in the previous post, the main configuration file is: /etc/nginx/nginx.conf. This is where I will make most of my changes.

vim nginx.conf

Add the following to nginx.conf and save it:

user nginx;
worker_processes 1;
#
events {
worker_connections 1024;
}
#
http {
include mime.types;
include conf.d/*.conf;
include sites-enabled/*;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
sendfile on;
keepalive_timeout 65;
#
server {
listen 80;
server_name localhost;
root html;
index index.html index.htm index.php;
autoindex on;
access_log /var/log/nginx/localhost.access.log main;
#
location / {
}
#
error_page 500 502 503 504 /50x.html;
#
location = /50x.html {
}
#
location ~ \.php$ {
include includes/php_params;
}
#
location ~* \.(cgi|chi)$ {
include includes/cgi_params;
}
# Add xmlrpc scgi support
#
location ~ ^/RPC2$ {
scgi_pass localhost:5000;
include scgi_params;
}
}
#
# HTTPS server
#
server {
listen 443 ssl;
server_name localhost;
root html;
index index.html index.htm index.php;
#
ssl_certificate ssl/cert.pem;
ssl_certificate_key ssl/cert.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
#
location / {
}
#
location ~ \.php$ {
include includes/php_params;
}
#
location ~* \.(cgi|chi)$ {
include includes/cgi_params;
}
}
}

To get details on what these directives exactly mean and the syntax used above, visit the Nginx documentation

NOTES:

Nginx is pretty picky when it comes to Syntax, so:

– The location directive is placed within a server directive.
– Also, all directives must end with a semicolon.

Like other similar programs in UNIX, you can split the configuration file into several files using the parameter: include as shown in the above file. This makes maintenance and packaging of these files easier.

Create other configuration directories:

mkdir /etc/nginx/{conf.d,includes,sites-enabled}

Add the following files to the includes directory:

vim /etc/nginx/includes/php_params

gzip off;
fastcgi_pass unix:/var/run/fcgiwrap.socket;
fastcgi_index index.cgi;
#
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
#
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param HTTPS $https if_not_empty;
#
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
#
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
#
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
vim /etc/nginx/includes/cgi_params

fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
#
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
#
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param HTTPS $https if_not_empty;
#
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
#
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
#
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;

VIRTUAL HOSTS

Now let’s configure a virtual host. In this tutorial, I use example.com as the domain name.

vim /etc/nginx/sites-enabled/example.com

server {
listen 80;
#
server_name zikusooka.com www.zikusooka.com;
root html/vhost.example;
index index.html index.htm index.php;
#
location / {
}
#
location ~ \.php$ {
include includes/php_params;
}
#
location ~* \.(cgi|chi)$ {
include includes/cgi_params;
}
}

WEB CONTENT

Add an index file to the main server’s root directory, for example:

vim /usr/share/nginx/html/index.html

Add the following and save (This is just for testing, any HTML web page should work):

<HTML>
<B>Hello World. Welcome to my Nginx web server!</B>
<HTML>


Create the document root directory for your virtual host:

mkdir /usr/share/nginx/html/example.com

Add your document root in the above created directory. For Example create a file named index.php.

vim /usr/share/nginx/html/example.com/index.php

Add the following and save (This is just to test php, so any simple php page should work):

<?
phpinfo();
?>

TESTING

Finally, restart nginx web server:

systemctl start nginx

If all goes well, you should now be able to browse html, php, and cgi pages on your server. You can then proceed to installing your WordPress or other content management system.