{"id":15536,"date":"2023-03-15T20:18:01","date_gmt":"2023-03-15T17:18:01","guid":{"rendered":"https:\/\/kifarunix.com\/?p=15536"},"modified":"2024-03-10T08:29:20","modified_gmt":"2024-03-10T05:29:20","slug":"deploy-nagios-nrpe-agents-using-ansible","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/deploy-nagios-nrpe-agents-using-ansible\/","title":{"rendered":"Deploy Nagios NRPE Agents using Ansible"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to deploy Nagios NRPE Agents using Ansible. <a href=\"https:\/\/www.ansible.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">Ansible<\/a> is an open-source automation tool used for configuration management, application deployment, and task automation. It is designed to simplify IT automation by providing a way to automate tasks across a large number of computers.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#deploying-nagios-nrpe-agents-using-ansible\">Deploying Nagios NRPE Agents using Ansible<\/a><ul><li><a href=\"#example-environment\">Example Environment<\/a><\/li><li><a href=\"#deploy-nagios-server\">Deploy Nagios Server<\/a><\/li><li><a href=\"#install-ansible-on-linux\">Install Ansible on Linux<\/a><\/li><li><a href=\"#create-ansible-user-on-managed-nodes\">Create Ansible User on Managed Nodes<\/a><\/li><li><a href=\"#setup-ansible-ssh-keys\">Setup Ansible SSH Keys<\/a><\/li><li><a href=\"#copy-ansible-ssh-public-key-to-managed-nodes\">Copy Ansible SSH Public Key to Managed Nodes<\/a><\/li><li><a href=\"#create-ansible-configuration-directory\">Create Ansible Configuration Directory<\/a><\/li><li><a href=\"#create-ansible-inventory-file\">Create Ansible Inventory File<\/a><\/li><li><a href=\"#run-ansible-passphrase-protected-ssh-key-without-prompting-for-passphrase\">Run Ansible Passphrase Protected SSH Key Without Prompting for Passphrase<\/a><\/li><li><a href=\"#test-connection-to-ansible-managed-nodes\">Test Connection to Ansible Managed Nodes<\/a><\/li><li><a href=\"#create-nrpe-playbook-roles-and-tasks\">Create NRPE Playbook Roles and Tasks<\/a><ul><li><a href=\"#nagios-nrpe-agent-ansible-deployment-variables\">Nagios NRPE Agent Ansible Deployment Variables<\/a><\/li><li><a href=\"#create-ansible-task-to-install-nrpe-agent-on-linux-debian-rhel-systems\">Create Ansible Task to Install NRPE Agent on Linux (Debian\/RHEL) systems<\/a><\/li><li><a href=\"#create-main-ansible-tasks-to-install-nrpe\">Create Main Ansible tasks to install NRPE<\/a><\/li><li><a href=\"#create-main-ansible-playbook\">Create Main Ansible Playbook<\/a><\/li><\/ul><\/li><li><a href=\"#deploying-nagios-nrpe-agents-using-ansible-1\">Deploying Nagios NRPE Agents using Ansible<\/a><\/li><li><a href=\"#more-tutorials\">More Tutorials<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"deploying-nagios-nrpe-agents-using-ansible\">Deploying Nagios NRPE Agents using Ansible<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-environment\">Example Environment<\/h3>\n\n\n\n<p>To demonstrate how Ansible can be used to deploy NRPE on various Linux systems in an environment, we have four systems (<strong><code>managed nodes<\/code><\/strong>) we will deploy NRPE on using Ansible;<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><tbody><tr><td><strong>Linux Distribution<\/strong><\/td><td><strong>IP Address<\/strong><\/td><\/tr><tr><td>Oracle Linux 9<\/td><td>192.168.56.152<\/td><\/tr><tr><td>Rocky Linux 9<\/td><td>192.168.56.144<\/td><\/tr><tr><td>Debian 11<\/td><td>192.168.56.153<\/td><\/tr><tr><td>Ubuntu 22.04<\/td><td>192.168.56.124<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>We also have;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Nagios 4 server running  as a Docker container on Ubuntu 22.04, IP address 192.168.56.154<\/li>\n\n\n\n<li>Ansible Control Node running on Ubuntu 22.04, IP address 192.168.56.10.<\/li>\n<\/ul>\n\n\n\n<p>Note that we will be building NRPE agents from the source. This is because, the packages provided by the default OS repositories may not be upto-date.<\/p>\n\n\n\n<p>NRPE agents v4.1.0 is the <a href=\"https:\/\/github.com\/NagiosEnterprises\/nrpe\/releases\" target=\"_blank\" rel=\"noreferrer noopener\">current release<\/a> as of this writing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"deploy-nagios-server\">Deploy Nagios Server<\/h3>\n\n\n\n<p>You need to be having Nagios server ready before you can proceed.<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/?s=nagios+server\" target=\"_blank\" rel=\"noreferrer noopener\">Install Nagios Server on Linux<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-ansible-on-linux\">Install Ansible on Linux<\/h3>\n\n\n\n<p>You need to install Ansible on your <strong><code>control node<\/code><\/strong>. A control node is the machine where Ansible is installed and from which all the automation tasks are executed.<\/p>\n\n\n\n<p>In this guide, we use an Ubuntu 22.04 node as our Ansible control node.<\/p>\n\n\n\n<p>Thus, to install Ansible on Ubuntu 22.04, proceed as follows;<\/p>\n\n\n\n<p>Run system update;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install python3-pip -y<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>python3 -m pip install --upgrade pip<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo python3 -m pip install ansible<\/code><\/pre>\n\n\n\n<p>Enable Ansible auto-completion;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo python3 -m pip install argcomplete<\/code><\/pre>\n\n\n\n<p>Confirm the Ansible version;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ansible --version<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>ansible [core 2.14.3]\n  config file = None\n  configured module search path = ['\/home\/kifarunix\/.ansible\/plugins\/modules', '\/usr\/share\/ansible\/plugins\/modules']\n  ansible python module location = \/usr\/local\/lib\/python3.10\/dist-packages\/ansible\n  ansible collection location = \/home\/kifarunix\/.ansible\/collections:\/usr\/share\/ansible\/collections\n  executable location = \/usr\/local\/bin\/ansible\n  python version = 3.10.6 (main, Nov 14 2022, 16:10:14) [GCC 11.3.0] (\/usr\/bin\/python3)\n  jinja version = 3.0.3\n  libyaml = True\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-ansible-user-on-managed-nodes\">Create Ansible User on Managed Nodes<\/h3>\n\n\n\n<p>Ansible uses the user you are logged in on control node as to connect to all remote devices.<\/p>\n\n\n\n<p>If the user doesn&#8217;t exists on the remote hosts, you need to create the account.<\/p>\n\n\n\n<p>So, on all Ansible remotely managed hosts, create an account with sudo rights. This is the only manual task you might need to do at the beggining, -:).<\/p>\n\n\n\n<p>On Debian based systems;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo useradd -G sudo -s \/bin\/bash -m kifadmin<\/code><\/pre>\n\n\n\n<p>On RHEL based systems;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo useradd -G wheel -s \/bin\/bash -m kifadmin<\/code><\/pre>\n\n\n\n<p>Set the account password;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo passwd kifadmin<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"setup-ansible-ssh-keys\">Setup Ansible SSH Keys<\/h3>\n\n\n\n<p>When using Ansible, you have two options for authenticating with remote systems:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SSH keys or<\/li>\n\n\n\n<li>password authentication<\/li>\n<\/ul>\n\n\n\n<p>SSH keys authentication is more preferred as a method of connection and is considered more secure and convenient compared to password authentication.<\/p>\n\n\n\n<p>Therefore, on the Ansible control node, you need to generate a public and private key pair and then copy the public key to the remote system&#8217;s authorized keys file.<\/p>\n\n\n\n<p>Thus, as a non root user, on the control node, run the command below to generate SSH key pair. It is recommended to use SSH keys with a passphrase for increased security.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-keygen<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>Generating public\/private rsa key pair.\nEnter file in which to save the key (\/home\/kifarunix\/.ssh\/id_rsa): \/home\/kifarunix\/.ssh\/id_ansible_rsa\nEnter passphrase (empty for no passphrase): \nEnter same passphrase again: \nYour identification has been saved in \/home\/kifarunix\/.ssh\/id_ansible_rsa\nYour public key has been saved in \/home\/kifarunix\/.ssh\/id_ansible_rsa.pub\nThe key fingerprint is:\nSHA256:lXmQC0UVM1bIpMeg1t0L0tofaLRPSEW65RnO7hVGcsQ kifarunix@control-node\nThe key's randomart image is:\n+---[RSA 3072]----+\n|         o==B==. |\n|        .o.@o*.E |\n|        o.B.@.+o |\n|       . ..O @++ |\n|        S . B Oo |\n|           . =...|\n|              + .|\n|             . . |\n|              .  |\n+----[SHA256]-----+\n<\/code><\/pre>\n\n\n\n<p>Note that we already had another SSH key pair stored on the default file, <strong><code>\/home\/kifarunix\/.ssh\/id_rsa<\/code><\/strong> used for other services. Hence, why we had to create the key pair on a different file, <strong><code>\/home\/kifarunix\/.ssh\/id_ansible_rsa<\/code><\/strong>.<\/p>\n\n\n\n<p>In Ansible configuration file, you can define custom path to SSH key using the <strong><code>private_key_file<\/code><\/strong> option.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"copy-ansible-ssh-public-key-to-managed-nodes\">Copy Ansible SSH Public Key to Managed Nodes<\/h3>\n\n\n\n<p>Once you have the SSH key pair generated, proceed to copy the key to the user accounts you will use on managed nodes for Ansible deployment tasks;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>for i in 142 144 152 153; do ssh-copy-id kifadmin@192.168.56.$i; done<\/code><\/pre>\n\n\n\n<p>If you are using non default SSH key file, specify the path to the key using the <code>-i<\/code> option;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>for i in 142 144 152 153; do ssh-copy-id -i \/home\/kifarunix\/.ssh\/id_ansible_rsa kifadmin@192.168.56.$i; done<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-ansible-configuration-directory\">Create Ansible Configuration Directory<\/h3>\n\n\n\n<p>By default, <strong><code>\/etc\/ansible<\/code><\/strong> is a default Ansible directory.<\/p>\n\n\n\n<p>If you install Ansible via PIP, chances are, default configuration for Ansible is not created.<\/p>\n\n\n\n<p>Thus, to create you can create your custom configuration directory to easily control Ansible.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir $HOME\/ansible<\/code><\/pre>\n\n\n\n<p>Similarly, create your custom Ansible configuration file, <code>ansible.cfg<\/code>.<\/p>\n\n\n\n<p>This is how a default Ansible configuration looks like by default;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/ansible\/ansible.cfg<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code># config file for ansible -- https:\/\/ansible.com\/\n# ===============================================\n\n# nearly all parameters can be overridden in ansible-playbook\n# or with command line flags. ansible will read ANSIBLE_CONFIG,\n# ansible.cfg in the current working directory, .ansible.cfg in\n# the home directory or \/etc\/ansible\/ansible.cfg, whichever it\n# finds first\n\n[defaults]\n\n# some basic default values...\n\n#inventory      = \/etc\/ansible\/hosts\n#library        = \/usr\/share\/my_modules\/\n#module_utils   = \/usr\/share\/my_module_utils\/\n#remote_tmp     = ~\/.ansible\/tmp\n#local_tmp      = ~\/.ansible\/tmp\n#plugin_filters_cfg = \/etc\/ansible\/plugin_filters.yml\n#forks          = 5\n#poll_interval  = 15\n#sudo_user      = root\n#ask_sudo_pass = True\n#ask_pass      = True\n#transport      = smart\n#remote_port    = 22\n#module_lang    = C\n#module_set_locale = False\n\n# plays will gather facts by default, which contain information about\n# the remote system.\n#\n# smart - gather by default, but don't regather if already gathered\n# implicit - gather by default, turn off with gather_facts: False\n# explicit - do not gather by default, must say gather_facts: True\n#gathering = implicit\n\n# This only affects the gathering done by a play's gather_facts directive,\n# by default gathering retrieves all facts subsets\n# all - gather all subsets\n# network - gather min and network facts\n# hardware - gather hardware facts (longest facts to retrieve)\n# virtual - gather min and virtual facts\n# facter - import facts from facter\n# ohai - import facts from ohai\n# You can combine them using comma (ex: network,virtual)\n# You can negate them using ! (ex: !hardware,!facter,!ohai)\n# A minimal set of facts is always gathered.\n#gather_subset = all\n\n# some hardware related facts are collected\n# with a maximum timeout of 10 seconds. This\n# option lets you increase or decrease that\n# timeout to something more suitable for the\n# environment.\n# gather_timeout = 10\n\n# Ansible facts are available inside the ansible_facts.* dictionary\n# namespace. This setting maintains the behaviour which was the default prior\n# to 2.5, duplicating these variables into the main namespace, each with a\n# prefix of 'ansible_'.\n# This variable is set to True by default for backwards compatibility. It\n# will be changed to a default of 'False' in a future release.\n# ansible_facts.\n# inject_facts_as_vars = True\n\n# additional paths to search for roles in, colon separated\n#roles_path    = \/etc\/ansible\/roles\n\n# uncomment this to disable SSH key host checking\n#host_key_checking = False\n\n# change the default callback, you can only have one 'stdout' type  enabled at a time.\n#stdout_callback = skippy\n\n\n## Ansible ships with some plugins that require whitelisting,\n## this is done to avoid running all of a type by default.\n## These setting lists those that you want enabled for your system.\n## Custom plugins should not need this unless plugin author specifies it.\n\n# enable callback plugins, they can output to stdout but cannot be 'stdout' type.\n#callback_whitelist = timer, mail\n\n# Determine whether includes in tasks and handlers are \"static\" by\n# default. As of 2.0, includes are dynamic by default. Setting these\n# values to True will make includes behave more like they did in the\n# 1.x versions.\n#task_includes_static = False\n#handler_includes_static = False\n\n# Controls if a missing handler for a notification event is an error or a warning\n#error_on_missing_handler = True\n\n# change this for alternative sudo implementations\n#sudo_exe = sudo\n\n# What flags to pass to sudo\n# WARNING: leaving out the defaults might create unexpected behaviours\n#sudo_flags = -H -S -n\n\n# SSH timeout\n#timeout = 10\n\n# default user to use for playbooks if user is not specified\n# (\/usr\/bin\/ansible will use current user as default)\n#remote_user = root\n\n# logging is off by default unless this path is defined\n# if so defined, consider logrotate\n#log_path = \/var\/log\/ansible.log\n\n# default module name for \/usr\/bin\/ansible\n#module_name = command\n\n# use this shell for commands executed under sudo\n# you may need to change this to bin\/bash in rare instances\n# if sudo is constrained\n#executable = \/bin\/sh\n\n# if inventory variables overlap, does the higher precedence one win\n# or are hash values merged together?  The default is 'replace' but\n# this can also be set to 'merge'.\n#hash_behaviour = replace\n\n# by default, variables from roles will be visible in the global variable\n# scope. To prevent this, the following option can be enabled, and only\n# tasks and handlers within the role will see the variables there\n#private_role_vars = yes\n\n# list any Jinja2 extensions to enable here:\n#jinja2_extensions = jinja2.ext.do,jinja2.ext.i18n\n\n# if set, always use this private key file for authentication, same as\n# if passing --private-key to ansible or ansible-playbook\n#private_key_file = \/path\/to\/file\n\n# If set, configures the path to the Vault password file as an alternative to\n# specifying --vault-password-file on the command line.\n#vault_password_file = \/path\/to\/vault_password_file\n\n# format of string {{ ansible_managed }} available within Jinja2\n# templates indicates to users editing templates files will be replaced.\n# replacing {file}, {host} and {uid} and strftime codes with proper values.\n#ansible_managed = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S by {uid} on {host}\n# {file}, {host}, {uid}, and the timestamp can all interfere with idempotence\n# in some situations so the default is a static string:\n#ansible_managed = Ansible managed\n\n# by default, ansible-playbook will display \"Skipping [host]\" if it determines a task\n# should not be run on a host.  Set this to \"False\" if you don't want to see these \"Skipping\"\n# messages. NOTE: the task header will still be shown regardless of whether or not the\n# task is skipped.\n#display_skipped_hosts = True\n\n# by default, if a task in a playbook does not include a name: field then\n# ansible-playbook will construct a header that includes the task's action but\n# not the task's args.  This is a security feature because ansible cannot know\n# if the *module* considers an argument to be no_log at the time that the\n# header is printed.  If your environment doesn't have a problem securing\n# stdout from ansible-playbook (or you have manually specified no_log in your\n# playbook on all of the tasks where you have secret information) then you can\n# safely set this to True to get more informative messages.\n#display_args_to_stdout = False\n\n# by default (as of 1.3), Ansible will raise errors when attempting to dereference\n# Jinja2 variables that are not set in templates or action lines. Uncomment this line\n# to revert the behavior to pre-1.3.\n#error_on_undefined_vars = False\n\n# by default (as of 1.6), Ansible may display warnings based on the configuration of the\n# system running ansible itself. This may include warnings about 3rd party packages or\n# other conditions that should be resolved if possible.\n# to disable these warnings, set the following value to False:\n#system_warnings = True\n\n# by default (as of 1.4), Ansible may display deprecation warnings for language\n# features that should no longer be used and will be removed in future versions.\n# to disable these warnings, set the following value to False:\n#deprecation_warnings = True\n\n# (as of 1.8), Ansible can optionally warn when usage of the shell and\n# command module appear to be simplified by using a default Ansible module\n# instead.  These warnings can be silenced by adjusting the following\n# setting or adding warn=yes or warn=no to the end of the command line\n# parameter string.  This will for example suggest using the git module\n# instead of shelling out to the git command.\n# command_warnings = False\n\n\n# set plugin path directories here, separate with colons\n#action_plugins     = \/usr\/share\/ansible\/plugins\/action\n#become_plugins     = \/usr\/share\/ansible\/plugins\/become\n#cache_plugins      = \/usr\/share\/ansible\/plugins\/cache\n#callback_plugins   = \/usr\/share\/ansible\/plugins\/callback\n#connection_plugins = \/usr\/share\/ansible\/plugins\/connection\n#lookup_plugins     = \/usr\/share\/ansible\/plugins\/lookup\n#inventory_plugins  = \/usr\/share\/ansible\/plugins\/inventory\n#vars_plugins       = \/usr\/share\/ansible\/plugins\/vars\n#filter_plugins     = \/usr\/share\/ansible\/plugins\/filter\n#test_plugins       = \/usr\/share\/ansible\/plugins\/test\n#terminal_plugins   = \/usr\/share\/ansible\/plugins\/terminal\n#strategy_plugins   = \/usr\/share\/ansible\/plugins\/strategy\n\n\n# by default, ansible will use the 'linear' strategy but you may want to try\n# another one\n#strategy = free\n\n# by default callbacks are not loaded for \/bin\/ansible, enable this if you\n# want, for example, a notification or logging callback to also apply to\n# \/bin\/ansible runs\n#bin_ansible_callbacks = False\n\n\n# don't like cows?  that's unfortunate.\n# set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1\n#nocows = 1\n\n# set which cowsay stencil you'd like to use by default. When set to 'random',\n# a random stencil will be selected for each task. The selection will be filtered\n# against the `cow_whitelist` option below.\n#cow_selection = default\n#cow_selection = random\n\n# when using the 'random' option for cowsay, stencils will be restricted to this list.\n# it should be formatted as a comma-separated list with no spaces between names.\n# NOTE: line continuations here are for formatting purposes only, as the INI parser\n#       in python does not support them.\n#cow_whitelist=bud-frogs,bunny,cheese,daemon,default,dragon,elephant-in-snake,elephant,eyes,\\\n#              hellokitty,kitty,luke-koala,meow,milk,moofasa,moose,ren,sheep,small,stegosaurus,\\\n#              stimpy,supermilker,three-eyes,turkey,turtle,tux,udder,vader-koala,vader,www\n\n# don't like colors either?\n# set to 1 if you don't want colors, or export ANSIBLE_NOCOLOR=1\n#nocolor = 1\n\n# if set to a persistent type (not 'memory', for example 'redis') fact values\n# from previous runs in Ansible will be stored.  This may be useful when\n# wanting to use, for example, IP information from one group of servers\n# without having to talk to them in the same playbook run to get their\n# current IP information.\n#fact_caching = memory\n\n#This option tells Ansible where to cache facts. The value is plugin dependent.\n#For the jsonfile plugin, it should be a path to a local directory.\n#For the redis plugin, the value is a host:port:database triplet: fact_caching_connection = localhost:6379:0\n\n#fact_caching_connection=\/tmp\n\n\n\n# retry files\n# When a playbook fails a .retry file can be created that will be placed in ~\/\n# You can enable this feature by setting retry_files_enabled to True\n# and you can change the location of the files by setting retry_files_save_path\n\n#retry_files_enabled = False\n#retry_files_save_path = ~\/.ansible-retry\n\n# squash actions\n# Ansible can optimise actions that call modules with list parameters\n# when looping. Instead of calling the module once per with_ item, the\n# module is called once with all items at once. Currently this only works\n# under limited circumstances, and only with parameters named 'name'.\n#squash_actions = apk,apt,dnf,homebrew,pacman,pkgng,yum,zypper\n\n# prevents logging of task data, off by default\n#no_log = False\n\n# prevents logging of tasks, but only on the targets, data is still logged on the master\/controller\n#no_target_syslog = False\n\n# controls whether Ansible will raise an error or warning if a task has no\n# choice but to create world readable temporary files to execute a module on\n# the remote machine.  This option is False by default for security.  Users may\n# turn this on to have behaviour more like Ansible prior to 2.1.x.  See\n# https:\/\/docs.ansible.com\/ansible\/become.html#becoming-an-unprivileged-user\n# for more secure ways to fix this than enabling this option.\n#allow_world_readable_tmpfiles = False\n\n# controls the compression level of variables sent to\n# worker processes. At the default of 0, no compression\n# is used. This value must be an integer from 0 to 9.\n#var_compression_level = 9\n\n# controls what compression method is used for new-style ansible modules when\n# they are sent to the remote system.  The compression types depend on having\n# support compiled into both the controller's python and the client's python.\n# The names should match with the python Zipfile compression types:\n# * ZIP_STORED (no compression. available everywhere)\n# * ZIP_DEFLATED (uses zlib, the default)\n# These values may be set per host via the ansible_module_compression inventory\n# variable\n#module_compression = 'ZIP_DEFLATED'\n\n# This controls the cutoff point (in bytes) on --diff for files\n# set to 0 for unlimited (RAM may suffer!).\n#max_diff_size = 1048576\n\n# This controls how ansible handles multiple --tags and --skip-tags arguments\n# on the CLI.  If this is True then multiple arguments are merged together.  If\n# it is False, then the last specified argument is used and the others are ignored.\n# This option will be removed in 2.8.\n#merge_multiple_cli_flags = True\n\n# Controls showing custom stats at the end, off by default\n#show_custom_stats = True\n\n# Controls which files to ignore when using a directory as inventory with\n# possibly multiple sources (both static and dynamic)\n#inventory_ignore_extensions = ~, .orig, .bak, .ini, .cfg, .retry, .pyc, .pyo\n\n# This family of modules use an alternative execution path optimized for network appliances\n# only update this setting if you know how this works, otherwise it can break module execution\n#network_group_modules=eos, nxos, ios, iosxr, junos, vyos\n\n# When enabled, this option allows lookups (via variables like {{lookup('foo')}} or when used as\n# a loop with `with_foo`) to return data that is not marked \"unsafe\". This means the data may contain\n# jinja2 templating language which will be run through the templating engine.\n# ENABLING THIS COULD BE A SECURITY RISK\n#allow_unsafe_lookups = False\n\n# set default errors for all plays\n#any_errors_fatal = False\n\n[inventory]\n# enable inventory plugins, default: 'host_list', 'script', 'auto', 'yaml', 'ini', 'toml'\n#enable_plugins = host_list, virtualbox, yaml, constructed\n\n# ignore these extensions when parsing a directory as inventory source\n#ignore_extensions = .pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, ~, .orig, .ini, .cfg, .retry\n\n# ignore files matching these patterns when parsing a directory as inventory source\n#ignore_patterns=\n\n# If 'true' unparsed inventory sources become fatal errors, they are warnings otherwise.\n#unparsed_is_failed=False\n\n[privilege_escalation]\n#become=True\n#become_method=sudo\n#become_user=root\n#become_ask_pass=False\n\n[paramiko_connection]\n\n# uncomment this line to cause the paramiko connection plugin to not record new host\n# keys encountered.  Increases performance on new host additions.  Setting works independently of the\n# host key checking setting above.\n#record_host_keys=False\n\n# by default, Ansible requests a pseudo-terminal for commands executed under sudo. Uncomment this\n# line to disable this behaviour.\n#pty=False\n\n# paramiko will default to looking for SSH keys initially when trying to\n# authenticate to remote devices.  This is a problem for some network devices\n# that close the connection after a key failure.  Uncomment this line to\n# disable the Paramiko look for keys function\n#look_for_keys = False\n\n# When using persistent connections with Paramiko, the connection runs in a\n# background process.  If the host doesn't already have a valid SSH key, by\n# default Ansible will prompt to add the host key.  This will cause connections\n# running in background processes to fail.  Uncomment this line to have\n# Paramiko automatically add host keys.\n#host_key_auto_add = True\n\n[ssh_connection]\n\n# ssh arguments to use\n# Leaving off ControlPersist will result in poor performance, so use\n# paramiko on older platforms rather than removing it, -C controls compression use\n#ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s\n\n# The base directory for the ControlPath sockets.\n# This is the \"%(directory)s\" in the control_path option\n#\n# Example:\n# control_path_dir = \/tmp\/.ansible\/cp\n#control_path_dir = ~\/.ansible\/cp\n\n# The path to use for the ControlPath sockets. This defaults to a hashed string of the hostname,\n# port and username (empty string in the config). The hash mitigates a common problem users\n# found with long hostnames and the conventional %(directory)s\/ansible-ssh-%%h-%%p-%%r format.\n# In those cases, a \"too long for Unix domain socket\" ssh error would occur.\n#\n# Example:\n# control_path = %(directory)s\/%%h-%%r\n#control_path =\n\n# Enabling pipelining reduces the number of SSH operations required to\n# execute a module on the remote server. This can result in a significant\n# performance improvement when enabled, however when using \"sudo:\" you must\n# first disable 'requiretty' in \/etc\/sudoers\n#\n# By default, this option is disabled to preserve compatibility with\n# sudoers configurations that have requiretty (the default on many distros).\n#\n#pipelining = False\n\n# Control the mechanism for transferring files (old)\n#   * smart = try sftp and then try scp [default]\n#   * True = use scp only\n#   * False = use sftp only\n#scp_if_ssh = smart\n\n# Control the mechanism for transferring files (new)\n# If set, this will override the scp_if_ssh option\n#   * sftp  = use sftp to transfer files\n#   * scp   = use scp to transfer files\n#   * piped = use 'dd' over SSH to transfer files\n#   * smart = try sftp, scp, and piped, in that order [default]\n#transfer_method = smart\n\n# if False, sftp will not use batch mode to transfer files. This may cause some\n# types of file transfer failures impossible to catch however, and should\n# only be disabled if your sftp version has problems with batch mode\n#sftp_batch_mode = False\n\n# The -tt argument is passed to ssh when pipelining is not enabled because sudo \n# requires a tty by default. \n#usetty = True\n\n# Number of times to retry an SSH connection to a host, in case of UNREACHABLE.\n# For each retry attempt, there is an exponential backoff,\n# so after the first attempt there is 1s wait, then 2s, 4s etc. up to 30s (max).\n#retries = 3\n\n[persistent_connection]\n\n# Configures the persistent connection timeout value in seconds.  This value is\n# how long the persistent connection will remain idle before it is destroyed.\n# If the connection doesn't receive a request before the timeout value\n# expires, the connection is shutdown. The default value is 30 seconds.\n#connect_timeout = 30\n\n# The command timeout value defines the amount of time to wait for a command\n# or RPC call before timing out. The value for the command timeout must\n# be less than the value of the persistent connection idle timeout (connect_timeout)\n# The default value is 30 second.\n#command_timeout = 30\n\n[accelerate]\n#accelerate_port = 5099\n#accelerate_timeout = 30\n#accelerate_connect_timeout = 5.0\n\n# The daemon timeout is measured in minutes. This time is measured\n# from the last activity to the accelerate daemon.\n#accelerate_daemon_timeout = 30\n\n# If set to yes, accelerate_multi_key will allow multiple\n# private keys to be uploaded to it, though each user must\n# have access to the system via SSH to add a new key. The default\n# is \"no\".\n#accelerate_multi_key = yes\n\n[selinux]\n# file systems that require special treatment when dealing with security context\n# the default behaviour that copies the existing context or uses the user default\n# needs to be changed to use the file system dependent context.\n#special_context_filesystems=nfs,vboxsf,fuse,ramfs,9p,vfat\n\n# Set this to yes to allow libvirt_lxc connections to work without SELinux.\n#libvirt_lxc_noseclabel = yes\n\n[colors]\n#highlight = white\n#verbose = blue\n#warn = bright purple\n#error = red\n#debug = dark gray\n#deprecate = purple\n#skip = cyan\n#unreachable = red\n#ok = green\n#changed = yellow\n#diff_add = green\n#diff_remove = red\n#diff_lines = cyan\n\n\n[diff]\n# Always print diff when running ( same as always running with -D\/--diff )\n# always = no\n\n# Set how many context lines to show in diff\n# context = 3\n<\/code><\/pre>\n\n\n\n<p>Based on the default config, we will create our own configuration file;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim $HOME\/ansible\/ansible.cfg<\/code><\/pre>\n\n\n\n<p>In the configuration file, we will define some basic values;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>[defaults]\ninventory       = \/home\/kifarunix\/ansible\/hosts\nroles_path      = \/home\/kifarunix\/ansible\/roles\nprivate_key_file        = \/home\/kifarunix\/.ssh\/id_ansible_rsa\ninterpreter_python      = \/usr\/bin\/python3\n...\n<\/code><\/pre>\n\n\n\n<p>Whenever you use a custom Ansible configuration directory, you can specify it using <code><strong>ANSIBLE_CONFIG<\/strong><\/code> environment variable or <strong><code>-c<\/code><\/strong> command-line option;<\/p>\n\n\n\n<p>Let&#8217;s set the environment variable to make it easy;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"export ANSIBLE_CONFIG=$HOME\/ansible\/ansible.cfg\" &gt;&gt; $HOME\/.bashrc<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>source $HOME\/.bashrc<\/code><\/pre>\n\n\n\n<p>With this, you wont have to specify the path to Ansible configuration or path to any path that is defined on the custom configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-ansible-inventory-file\">Create Ansible Inventory File<\/h3>\n\n\n\n<p>The inventory file contains a list of hosts and groups of hosts that are managed by Ansible. By default, inventory file is set to <strong><code>\/etc\/ansible\/hosts<\/code><\/strong>. You can specify a different inventory file using the -i option or using the <strong><code>inventory<\/code><\/strong> option in the configuration file. We set out inventory file to <code><strong>\/home\/kifarunix\/ansible\/hosts<\/strong><\/code> in the configuration above;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim \/home\/kifarunix\/ansible\/hosts<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;linux_agents]\n192.168.56.152\n192.168.56.153\n192.168.56.144\n192.168.56.124<\/code><\/pre>\n\n\n\n<p>Save and exit the file.<\/p>\n\n\n\n<p>There are different formats of the hosts file configuration. That is just an example.<\/p>\n\n\n\n<p>See below a sample hosts file!<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/ansible\/hosts<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code># This is the default ansible 'hosts' file.\n#\n# It should live in \/etc\/ansible\/hosts\n#\n#   - Comments begin with the '#' character\n#   - Blank lines are ignored\n#   - Groups of hosts are delimited by [header] elements\n#   - You can enter hostnames or ip addresses\n#   - A hostname\/ip can be a member of multiple groups\n\n# Ex 1: Ungrouped hosts, specify before any group headers.\n\n#green.example.com\n#blue.example.com\n#192.168.100.1\n#192.168.100.10\n\n# Ex 2: A collection of hosts belonging to the 'webservers' group\n\n#[webservers]\n#alpha.example.org\n#beta.example.org\n#192.168.1.100\n#192.168.1.110\n\n# If you have multiple hosts following a pattern you can specify\n# them like this:\n\n#www[001:006].example.com\n\n# Ex 3: A collection of database servers in the 'dbservers' group\n\n#[dbservers]\n#\n#db01.intranet.mydomain.net\n#db02.intranet.mydomain.net\n#10.25.1.56\n#10.25.1.57\n\n# Here's another example of host ranges, this time there are no\n# leading 0s:\n\n#db-[99:101]-node.example.com\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"run-ansible-passphrase-protected-ssh-key-without-prompting-for-passphrase\">Run Ansible Passphrase Protected SSH Key Without Prompting for Passphrase<\/h3>\n\n\n\n<p>We are trying to automate tasks here. However, if you setup passphrase protected SSH key, you will be prompted to enter the phrase for every single command to be ran against a managed node.<\/p>\n\n\n\n<p>As a work around for this, you can use <code>ssh-agent<\/code> to cache your passphrase, so that you only need to enter it once per session as follows;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eval \"$(ssh-agent -s)\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-add \/home\/kifarunix\/.ssh\/id_ansible_rsa<\/code><\/pre>\n\n\n\n<p>You will be prompted to enter your passphrase.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"test-connection-to-ansible-managed-nodes\">Test Connection to Ansible Managed Nodes<\/h3>\n\n\n\n<p>Now that you have setup SSH key authentication and an inventory of the managed hosts, run Ansible ping module to check hosts connection and aliveness;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ansible all -m ping -u kifadmin<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>192.168.56.153 | SUCCESS =&gt; {\n    \"changed\": false,\n    \"ping\": \"pong\"\n}\n192.168.56.124 | SUCCESS =&gt; {\n    \"changed\": false,\n    \"ping\": \"pong\"\n}\n192.168.56.144 | SUCCESS =&gt; {\n    \"changed\": false,\n    \"ping\": \"pong\"\n}\n192.168.56.152 | SUCCESS =&gt; {\n    \"changed\": false,\n    \"ping\": \"pong\"\n}\n<\/code><\/pre>\n\n\n\n<p>That confirms that you are ready to deploy Nagios NRPE agents on your remote Linux nodes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-nrpe-playbook-roles-and-tasks\">Create NRPE Playbook Roles and Tasks<\/h3>\n\n\n\n<p>Ansible Playbooks define a set of tasks that needs to be executed on each managed host. Ansible roles consists of a collection of tasks.<\/p>\n\n\n\n<p>This is our Ansible directory structure;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tree ~\/ansible\/<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>ansible\/\n\u251c\u2500\u2500 ansible.cfg\n\u251c\u2500\u2500 hosts\n\u251c\u2500\u2500 main.yml\n\u251c\u2500\u2500 nrpe-configs\n\u2502&nbsp;&nbsp; \u2514\u2500\u2500 nrpe.cfg\n\u2514\u2500\u2500 roles\n    \u2514\u2500\u2500 nrpe\n        \u251c\u2500\u2500 tasks\n        \u2502&nbsp;&nbsp; \u251c\u2500\u2500 linux.yml\n        \u2502&nbsp;&nbsp; \u2514\u2500\u2500 main.yml\n        \u2514\u2500\u2500 vars\n            \u2514\u2500\u2500 main.yml\n\n5 directories, 7 files\n<\/code><\/pre>\n\n\n\n<p>In this example setup, we will create a role by the name <strong>nrpe<\/strong>. As mentioned, a roles is made of various tasks.<\/p>\n\n\n\n<p>Thus, let&#8217;s create a directory to work from.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p ~\/ansible\/roles\/nrpe\/tasks<\/code><\/pre>\n\n\n\n<p>Also, create a directory to store custom nrpe configurations.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir ~\/ansible\/nrpe-configs\/<\/code><\/pre>\n\n\n\n<p>Within this directory, we have a custom NRPE.CFG configuration file;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim ~\/ansible\/nrpe-configs\/nrpe.cfg<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nlog_facility=daemon\ndebug=0\npid_file=\/usr\/local\/nagios\/var\/nrpe.pid\nserver_port=5666\nnrpe_user=nagios\nnrpe_group=nagios\nallowed_hosts=127.0.0.1,<strong>NAGIOS_SERVER_IP<\/strong>\ndont_blame_nrpe=0\nallow_bash_command_substitution=0\ncommand_timeout=60\nconnection_timeout=300\ndisable_syslog=0\ncommand[check_users]=\/usr\/local\/nagios\/libexec\/check_users -w 5 -c 10\ncommand[check_load]=\/usr\/local\/nagios\/libexec\/check_load -r -w .15,.10,.05 -c .30,.25,.20\ncommand[check_disk]=\/usr\/local\/nagios\/libexec\/check_disk -w 20% -c 10% -p \/dev\/sda1\ncommand[check_zombie_procs]=\/usr\/local\/nagios\/libexec\/check_procs -w 5 -c 10 -s Z\ncommand[check_total_procs]=\/usr\/local\/nagios\/libexec\/check_procs -w 150 -c 200\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"nagios-nrpe-agent-ansible-deployment-variables\">Nagios NRPE Agent Ansible Deployment Variables<\/h4>\n\n\n\n<p>We have defined some variables under the <code>~\/ansible\/roles\/nrpe\/vars\/<\/code> directory;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim ~\/ansible\/roles\/nrpe\/vars\/main.yml<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>NRPE_VERSION: \"4.1.0\"\nPLUGINS_VER: \"2.4.3\"\ntcp_port: \"5666\"\nNAGIOS_SERVER_IP: \"192.168.56.154\"<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"create-ansible-task-to-install-nrpe-agent-on-linux-debian-rhel-systems\">Create Ansible Task to Install NRPE Agent on Linux (Debian\/RHEL) systems<\/h4>\n\n\n\n<p>So what tasks do we have in our NRPE deployment?<\/p>\n\n\n\n<p>We have a task to install NRPE agent on Linux systems;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>install NRPE on Debian\/Ubuntu systems<\/li>\n\n\n\n<li>install NRPE on RHEL based systems (Rocky Linux\/Oracle Linux)<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>vim ~\/ansible\/roles\/nrpe\/tasks\/linux.yml<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n---\n- name: Install Required Build Packages on Debian\n  apt:\n    name:\n      - autoconf\n      - automake\n      - gcc\n      - libc6\n      - libmcrypt-dev\n      - make\n      - libssl-dev\n      - wget\n    state: present\n    update_cache: yes\n  when: ansible_distribution in ['Debian', 'Ubuntu']\n\n- name: Install Required Build Packages\/Tools on RHEL\n  yum:\n    name:\n      - gcc\n      - glibc\n      - glibc-common\n      - openssl\n      - openssl-devel\n    state: present\n  when: ansible_os_family == \"RedHat\"\n\n- name: Download NRPE Source File\n  get_url:\n    url: https:\/\/github.com\/NagiosEnterprises\/nrpe\/releases\/download\/nrpe-{{ NRPE_VERSION }}\/nrpe-{{ NRPE_VERSION }}.tar.gz\n    dest: \/tmp\/\n\n- name: Extract NRPE Source File \n  unarchive:\n    src: \/tmp\/nrpe-{{ NRPE_VERSION }}.tar.gz\n    dest: \/tmp\n    remote_src: yes\n\n- name: Download NRPE Plugins Archive File\n  get_url:\n    url: https:\/\/github.com\/nagios-plugins\/nagios-plugins\/releases\/download\/release-{{ PLUGINS_VER }}\/nagios-plugins-{{ PLUGINS_VER }}.tar.gz \n    dest: \/tmp\/\n\n- name: Extract NRPE Source File \n  unarchive:\n    src: \/tmp\/nrpe-{{ NRPE_VERSION }}.tar.gz\n    dest: \/tmp\n    remote_src: yes\n\n- name: Extract NRPE Plugins Source File \n  unarchive:\n    src: \/tmp\/nagios-plugins-{{ PLUGINS_VER }}.tar.gz\n    dest: \/tmp\n    remote_src: yes\n\n- name: Build and Install Nagios NRPE Agent\n  shell: |\n    .\/configure --enable-command-args --with-nrpe-user=nagios --with-nrpe-group=nagios\n    make install-groups-users\n    make all\n    make install\n    make install-config\n    make install-init\n  args:\n    chdir: \/tmp\/nrpe-{{ NRPE_VERSION }}\n\n- name: Build and Install Nagios NRPE Plugins\n  shell: |\n    .\/configure\n    make\n    make install\n  args:\n    chdir: \/tmp\/nagios-plugins-{{ PLUGINS_VER }}\n\n- name: Update services file with NRPE Service Name, Port and Protocol\n  lineinfile:\n    path: \/etc\/services\n    line: \"nrpe            5666\/tcp                # NRPE Service\"\n\n- name: Configure NRPE agent\n  copy:\n    src: \/home\/kifarunix\/ansible\/nrpe-configs\/nrpe.cfg\n    dest: \/usr\/local\/nagios\/etc\/nrpe.cfg\n      \n- name: Update Nagios Server IP in NRPE config file\n  replace:\n    path: \/usr\/local\/nagios\/etc\/nrpe.cfg\n    regexp: 'NAGIOS_SERVER_IP$'\n    replace: '{{ NAGIOS_SERVER_IP }}'\n\n name: Disable SSL when running NRPE Agent on RHEL Systems\n replace:\n   path: \/usr\/lib\/systemd\/system\/nrpe.service\n   regexp: '-f$'\n   replace: '-f -n'\n when: ansible_os_family == \"RedHat\"\n\n name: Disable SSL when running NRPE Agent on Debian Systems\n replace:\n   path: \/lib\/systemd\/system\/nrpe.service\n   regexp: '-f$'\n   replace: '-f -n'\n when: ansible_distribution in ['Debian', 'Ubuntu']\n\n name: Start and Enable NRPE to run on System boot\n systemd:\n   name: nrpe\n   daemon_reload: yes\n   state: restarted\n   enabled: true\n\n- name: Check if firewalld is running\n  shell: systemctl status firewalld\n  register: firewalld_status\n  changed_when: false\n  failed_when: false\n\n- name: Open NRPE agent port on firewall (Firewalld)\n  firewalld:\n    rich_rule: 'rule family=\"ipv4\" source address=\"{{ NAGIOS_SERVER_IP }}\" port port=\"{{ tcp_port }}\" protocol=\"tcp\" accept'\n    permanent: yes\n    immediate: yes\n    state: enabled\n  when: \"'Active: active' in firewalld_status.stdout\"\n\n- name: Check if UFW is running\n  shell: ufw status\n  register: ufw_status\n  changed_when: false\n  failed_when: false\n\n- name: Open NRPE agent port on firewall (UFW)\n  ufw:\n    rule: allow\n    port: \"{{ tcp_port }}\"\n    proto: tcp\n    src: \"{{ NAGIOS_SERVER_IP }}\"\n  when: \"'Status: active' in ufw_status.stdout\"\n\n- name: Check if iptables is running\n  shell: systemctl status iptables\n  register: iptables_status\n  changed_when: false\n  failed_when: false\n\n- name: Open NRPE agent port on firewall (iptables)\n  iptables:\n    chain: INPUT\n    protocol: tcp\n    destination_port: \"{{ tcp_port }}\"\n    source: \"{{ NAGIOS_SERVER_IP }}\"\n    jump: ACCEPT  \n  when: \"'Active: active' in iptables_status.stdout\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"create-main-ansible-tasks-to-install-nrpe\">Create Main Ansible tasks to install NRPE<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>vim ~\/ansible\/roles\/nrpe\/tasks\/main.yml<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>---\n- name: Deploy NRPE Agents\n  include_tasks: \"linux.yml\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"create-main-ansible-playbook\">Create Main Ansible Playbook<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>vim ~\/ansible\/main.yml<\/code><\/pre>\n\n\n\n<p>Here, we define group of hosts to run the installation of NRPE agents on, variables applied to the play, roles required to execute, user to run the roles with&#8230;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>---\n- hosts: all\n  gather_facts: True\n  remote_user: kifadmin\n  become: yes\n  roles:\n    - nrpe\n<\/code><\/pre>\n\n\n\n<p>We also updated hosts file with respective OS family variables;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/ansible\/hosts<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>[linux_agents]\n192.168.56.152\n192.168.56.153\n192.168.56.144\n192.168.56.124\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"deploying-nagios-nrpe-agents-using-ansible-1\">Deploying Nagios NRPE Agents using Ansible<\/h3>\n\n\n\n<p>First of all, let&#8217;s ensure we are not prompted for SSH key passphrase<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eval \"$(ssh-agent -s)\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-add \/home\/kifarunix\/.ssh\/id_ansible_rsa<\/code><\/pre>\n\n\n\n<p>Next, run a dry run of your Ansible playbooks to check what would happen and fix and would be issue;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ansible-playbook ~\/ansible\/main.yml -C --ask-become-pass<\/code><\/pre>\n\n\n\n<p>If you have confirmed all is good, then proceed.<\/p>\n\n\n\n<p>Let&#8217;s now run the playbook to deploy Nagios NRPE Agents with Ansible by omitting option <strong><code>-C<\/code><\/strong> in the command above.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ansible-playbook ~\/ansible\/main.yml --ask-become-pass<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>BECOME password: \n\nPLAY [all] *****************************************************************************************************************************************************************\n\nTASK [Gathering Facts] *****************************************************************************************************************************************************\nok: [192.168.56.153]\nok: [192.168.56.124]\nok: [192.168.56.152]\nok: [192.168.56.144]\n\nTASK [nrpe : Deploy NRPE Agents] *******************************************************************************************************************************************\nincluded: \/home\/kifarunix\/ansible\/roles\/nrpe\/tasks\/linux.yml for 192.168.56.152, 192.168.56.153, 192.168.56.144, 192.168.56.124\n\nTASK [nrpe : Install Required Build Packages on Debian] ********************************************************************************************************************\nskipping: [192.168.56.152]\nskipping: [192.168.56.144]\nok: [192.168.56.153]\nok: [192.168.56.124]\n\nTASK [nrpe : Install Required Build Packages\/Tools on RHEL] ****************************************************************************************************************\nskipping: [192.168.56.153]\nskipping: [192.168.56.124]\nok: [192.168.56.152]\nok: [192.168.56.144]\n\nTASK [nrpe : Download NRPE Source File] ************************************************************************************************************************************\nchanged: [192.168.56.144]\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Extract NRPE Source File] *************************************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Download NRPE Plugins Archive File] ***************************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Extract NRPE Source File] *************************************************************************************************************************************\nok: [192.168.56.153]\nok: [192.168.56.124]\nok: [192.168.56.144]\nok: [192.168.56.152]\n\nTASK [nrpe : Extract NRPE Plugins Source File] *****************************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Build and Install Nagios NRPE Agent] **************************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Build and Install Nagios NRPE Plugins] ************************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.152]\nchanged: [192.168.56.144]\nchanged: [192.168.56.124]\n\nTASK [nrpe : Update services file with NRPE Service Name, Port and Protocol] ***********************************************************************************************\nok: [192.168.56.153]\nok: [192.168.56.124]\nok: [192.168.56.152]\nok: [192.168.56.144]\n\nTASK [nrpe : Configure NRPE agent] *****************************************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Update Nagios Server IP in NRPE config file] ******************************************************************************************************************\nchanged: [192.168.56.124]\nchanged: [192.168.56.153]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Disable SSL when running NRPE Agent on RHEL Systems] **********************************************************************************************************\nskipping: [192.168.56.153]\nskipping: [192.168.56.124]\nchanged: [192.168.56.144]\nchanged: [192.168.56.152]\n\nTASK [nrpe : Disable SSL when running NRPE Agent on Debian Systems] ********************************************************************************************************\nskipping: [192.168.56.152]\nskipping: [192.168.56.144]\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\n\nTASK [nrpe : Start and Enable NRPE to run on System boot] ******************************************************************************************************************\nchanged: [192.168.56.153]\nchanged: [192.168.56.124]\nchanged: [192.168.56.152]\nchanged: [192.168.56.144]\n\nTASK [nrpe : Check if firewalld is running] ********************************************************************************************************************************\nok: [192.168.56.153]\nok: [192.168.56.124]\nok: [192.168.56.152]\nok: [192.168.56.144]\n\nTASK [nrpe : Open NRPE agent port on firewall (Firewalld)] *****************************************************************************************************************\nskipping: [192.168.56.153]\nskipping: [192.168.56.144]\nskipping: [192.168.56.124]\nok: [192.168.56.152]\n\nTASK [nrpe : Check if UFW is running] **************************************************************************************************************************************\nok: [192.168.56.153]\nok: [192.168.56.144]\nok: [192.168.56.124]\nok: [192.168.56.152]\n\nTASK [nrpe : Open NRPE agent port on firewall (UFW)] ***********************************************************************************************************************\nskipping: [192.168.56.152]\nskipping: [192.168.56.153]\nskipping: [192.168.56.144]\nok: [192.168.56.124]\n\nTASK [nrpe : Check if iptables is running] *********************************************************************************************************************************\nok: [192.168.56.153]\nok: [192.168.56.144]\nok: [192.168.56.124]\nok: [192.168.56.152]\n\nTASK [nrpe : Open NRPE agent port on firewall (iptables)] ******************************************************************************************************************\nskipping: [192.168.56.152]\nskipping: [192.168.56.124]\nok: [192.168.56.153]\nok: [192.168.56.144]\n\nPLAY RECAP *****************************************************************************************************************************************************************\n192.168.56.124             : ok=18   changed=9    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0   \n192.168.56.144             : ok=18   changed=9    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0   \n192.168.56.152             : ok=18   changed=9    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0   \n192.168.56.153             : ok=18   changed=9    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0 \n<\/code><\/pre>\n\n\n\n<p>NRPE should now be installed and running on all the nodes;<\/p>\n\n\n\n<p>Confirm if status of nrpe;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ansible -m shell -a \"systemctl status nrpe\" --ask-become-pass -u kifadmin all<\/code><\/pre>\n\n\n\n<p>You can now add your agents into Nagios server for monitoring.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/03\/deploy-nrpe-using-ansible.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1880\" height=\"629\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/03\/deploy-nrpe-using-ansible.png\" alt=\"Deploy Nagios NRPE Agents using Ansible\" class=\"wp-image-15749\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/03\/deploy-nrpe-using-ansible.png?v=1678899507 1880w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/03\/deploy-nrpe-using-ansible-768x257.png?v=1678899507 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/03\/deploy-nrpe-using-ansible-1536x514.png?v=1678899507 1536w\" sizes=\"(max-width: 1880px) 100vw, 1880px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>And that is how you can use Ansible to deploy Nagios NRPE Agents. Feel free to modify the playbooks as you so wish.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"more-tutorials\">More Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-deploy-filebeat-using-ansible\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Deploy Filebeat using Ansible<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/deploy-all-in-one-openstack-with-kolla-ansible-on-ubuntu-18-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">Deploy All-In-One OpenStack with Kolla-Ansible on Ubuntu 18.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to deploy Nagios NRPE Agents using Ansible. Ansible is an open-source automation tool used for configuration management, application<\/p>\n","protected":false},"author":10,"featured_media":15751,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,1884,992,72,73],"tags":[6449,6451,6448,6450,6447],"class_list":["post-15536","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-ansible","category-automation","category-monitoring","category-nagios","tag-ansbile-nrpe-agents","tag-ansible-automation","tag-install-nagios-agent-using-ansible","tag-install-nrpe-with-ansible","tag-nagios-agent-install-using-ansible","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15536"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=15536"}],"version-history":[{"count":21,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15536\/revisions"}],"predecessor-version":[{"id":20705,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15536\/revisions\/20705"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/15751"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=15536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=15536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=15536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}