Eddie's Blog

Nagios Core and NagiosQL Installation on CentOS 7

This post is to document my Nagios Core 4.4.6 and NagiosQL 3.4.1 installation on CentOS 7. They are the latest available version at the time of this writing (May 2020).

The main reason of this post is I cannot find the updated instruction to install the latest version of NagiosQL on CentOS 7. When I follow the instruction on the outdated blog posts, I run into some issues. For example, the official CentOS 7 repository only has PHP 5.4, but NagiosQL 3.4.1 requires PHP 5.5.0 or later; and MySQL is no longer in CentOS repository. Another reason is I want to install the latest version packages (e.g. PHP 7.4), instead of the older version.

Nagios Core and Nagios Plugins Installation on CentOS 7

I follow the instruction on Nagios Support Knowledgebase without any major issue. The only modification is to get the latest version of Nagios Core 4.4.6, instead of 4.4.5; and the latest version of the Nagios Plugin 2.3.3, instead of 2.2.1.

NagiosQL Installation on CentOS 7

1. Install PHP 7.4 from Remi and EPEL repositories

As I mention earlier, the official CentOS 7 repository only has PHP 5.4. This doesn’t meet the NagiosQL 3.4.1 requirement. You can check the installed PHP version by php -v.

yum install epel-release
yum install http://rpms.famillecollet.com/enterprise/remi-release-7.rpm
yum install yum-utils
### install PHP 7.4
yum-config-manager --enable remi-php74
yum install php php-mcrypt php-cli php-gd php-curl php-mysql php-ldap php-zip php-fileinfo
### verify PHP 7.4 is installed
php -v

2. Install MySQL from the community repository

I follow the instruction on this post without any issue.

wget http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm
rpm -ivh mysql-community-release-el7-5.noarch.rpm
yum update
yum install mysql-server
systemctl start mysqld
### change MySQL root password, remove anonymous user accounts, disable root logins outside of localhost, and remove test databases
mysql_secure_installation

3. Install NagiosQL required packages

yum install libssh2 libssh2-devel mysql php-mysql php-pear php-devel
### install ssh2.so version 1.2 beta that support PHP 7.4
pecl install ssh2-1.2
### add extension=ssh2.so to /etc/php.ini under Dynamic Extensions
vi /etc/php.ini

4. Download and extract NagiosQL 3.4.1 archive in Nagios document root (/usr/local/nagios/share)

cd /usr/local/nagios/share
curl -L -O https://downloads.sourceforge.net/project/nagiosql/nagiosql/NagiosQL%203.4.1/nagiosql-3.4.1-git2020-01-19.tar.gz
tar xzf nagiosql-3.4.1-git2020-01-19.tar
mv nagiosql-3.4.1 webadmin
chown -R nagios:nagios webadmin/

### create the NagiosQL configuration directory
mkdir /usr/local/nagios/nagiosql
chown -R apache:apache /usr/local/nagios/nagiosql/

5. Set up PHP Timezone and restart Apache web server

See here to get the list of timezone

### set date.timezone = 'America/Los_Angeles'
vi /etc/php.ini

systemctl restart httpd

6. Start NagiosQL web installer

Open the URL in a browser: http://nagiosserver/nagios/webadmin/install/index.php
Click Start Installation
Verify the system meets all the requirements. Here is where I found out the PHP 5.4 in CentOS 7 doesn’t meet the requirement
Click Next
On NagiosQL Installation: Setup page
- Enter NagiosQL DB password, root password (the root password is MySQL root password), and NagiosQL admin password
- Check the checkboxes
  - “Drop database if already exists?”
  - “Import Nagios sample config?” (optional)
  - “Create NagiosQL config paths?”
- set NagiosQL config path: /usr/local/nagios/nagiosql
- set Nagios config path: /usr/local/nagios/etc
Click Next
On NagiosQL Installation: Finishing Setup page, it should be all green if everything is right
Delete the NagiosQL install directory

7. Access NagiosQL web UI

Open the URL in a browser: http://nagiosserver/nagios/webadmin
login with NagiosQL admin and password

8. Integrate NagiosQL with Nagios

Navigate to Administration -> Administration -> Config targets
Click Modify icon next to localhost
On Configuration domain administration page
- Configuration directories section should be all set. No change is needed
- Nagios configuration files and directories section, verify the following settings
  - Nagios base directory: /usr/local/nagios/etc/
  - Import directory: /usr/local/nagios/etc/objects/
  - Picture base directory: (blank)
  - Nagios command file: /usr/local/nagios/var/rw/nagios.cmd
  - Nagios binary file: /usr/local/nagios/bin/nagios
  - Nagios process file: /run/nagios.lock
  - Nagios config file: /usr/local/nagios/etc/nagios.cfg
  - Nagios cgi file: /usr/local/nagios/etc/cgi.cfg
  - Nagios resource file: /usr/local/nagios/etc/resource.cfg
- Select 4.x in Nagios version
- Leave Access group “Unrestricted access”
- Check Active checkbox
- Click Save

Edit Nagios Core configuration file

Edit Nagios configuration file /usr/local/nagios/etc/nagios.cfg
Comment all cfg_file and cfg_dir entries
Add the following cfg_file and cfg_dir entries

cfg_file=/usr/local/nagios/nagiosql/commands.cfg
cfg_file=/usr/local/nagios/nagiosql/contactgroups.cfg
cfg_file=/usr/local/nagios/nagiosql/contacts.cfg
cfg_file=/usr/local/nagios/nagiosql/contacttemplates.cfg
cfg_file=/usr/local/nagios/nagiosql/hostdependencies.cfg
cfg_file=/usr/local/nagios/nagiosql/hostescalations.cfg
cfg_file=/usr/local/nagios/nagiosql/hostextinfo.cfg
cfg_file=/usr/local/nagios/nagiosql/hostgroups.cfg
cfg_file=/usr/local/nagios/nagiosql/hosttemplates.cfg
cfg_file=/usr/local/nagios/nagiosql/servicedependencies.cfg
cfg_file=/usr/local/nagios/nagiosql/serviceescalations.cfg
cfg_file=/usr/local/nagios/nagiosql/serviceextinfo.cfg
cfg_file=/usr/local/nagios/nagiosql/servicegroups.cfg
cfg_file=/usr/local/nagios/nagiosql/servicetemplates.cfg
cfg_file=/usr/local/nagios/nagiosql/timeperiods.cfg

cfg_dir=/usr/local/nagios/nagiosql/hosts
cfg_dir=/usr/local/nagios/nagiosql/services

9. Verify Nagios Core config files

/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

When I run the above command, I get the error message of missing command.cfg file, etc. I go back to NagiosQL web UI, in each main section Supervision, Alerting, Commands, and Specialties, click “Write config file” to generate these files. Then the command reports no error or warning.

10. Restart Nagios Core service

systemctl restart nagios

Now Nagios Core and NagiosQL are successfully set up. You can view the monitoring status in the Nagios web UI and modify the monitoring via NagiosQL web UI.

Three Ways to Split String in PowerShell

This post is to summarize three ways to split a string in PowerShell.

In the following example
$t = “1000ABC2000abc"
[regex]$rx1 = “\d+”
[regex]$rx2 = “ABC"

Using a regex object’s split method
- In this method, the regex works and the match is case-sensitive
  
  PS > $rx1.split($t)
  
  ABC
  abc
  PS > $rx2.split($t)
  1000
  2000abc
Using a string object’s split method
- In this method, the regex does not work and the match is case-sensitive
  
  PS > $t.split($rx1)
  1000ABC2000abc
  
  PS > $t.split($rx2)
  1000
  2000abc
Using a string object’s split operator
- In this method, the regex works and the match is case-insensitive
  
  PS > $t -split $rx1
  
  ABC
  abc
  PS > $t -split $rx2
  1000
  2000

Enable HTTPS with Let’s Encrypt SSL certificate on Pi-hole web interface

By default, the Pi-hole web interface runs on HTTP, including the web admin panel URL. I want to secure the Pi-hole password with HTTPS when entering in the web browser. To enable HTTPS, I need a SSL certificate. My options are creating a self-signed SSL certificate, buying a retail SSL certificate from a public CA, or using Let’s Encrypt free SSL certificate.

For the home setup, the Let’s Encrypt SSL certificate is a perfect fit. The certificate works all the major web browsers, so no security warning in the browser; and it’s free. Just need to renew it every 90 days.

Before proceeding the following instruction, make sure you meet these two perquisites.
1. You own a public domain name.
2. You have the access to modify the public DSN setting of your domain name. The instruction on how to do this varies from the DNS hosting vendor. Please consult with your DNS hosting vendor for the detail.

1. Issue Let’s Encrypt SSL certificate

Let’s Encrypt recommends the Certbot ACME client to automate the issuance and installation. Because I don’t want my Pi-hole web interface accessible on the internet. I have to run Certbot with the manual option to issue the certificate. Here is how I do that.

Login my pi-hole via SSH
Install Certbot
- $ sudo apt install certbot
Run certbot to issue a certificate for Pi-hole FQDN. In my example, the FQND is pihole.sfitpro.com.
- $ sudo certbot certonly --manual --preferred-challenges dns --cert-name pihole.sfitpro.com -d pihole.sfitpro.com
During this process, certbot will prompt to add a DNS TXT record “_acme-challenge.pihole.sfitpro.com” with the value created by certbot.
Login my domain name DNS hosting site and add a “_acme-challenge.pihole.sfitpro.com” TXT record with the provided value to verify my ownership of the domain name.
After the TXT record is added, continue with certbot to finish the certificate issuance.
The private key and issued certificate are saved in /etc/letsencrypt/live/.

2. Enable HTTPS on Pi-hole web interface

Create a file called combined.pem in the Let’s Encrypt certificate directory
- $ sudo su
- $ cd /etc/letsencrypt/live/pihole.sfitpro.com/
- $ cat privacy.pem cert.perm | tee combined.pem
Ensure the lighttpd user (www-data) can read the certificates
- $ sudo chown www-data -R /etc/letencrypt/live
Create a file called external.conf in /etc/lighttpd/ with the following content

$HTTP["host"] == "pihole.sfitpro.com" {
# Ensure the Pi-hole Block Page knows that this is not a blocked domain
setenv.add-environment = ("fqdn" => "true")

# Enable the SSL engine with a LE cert, only for this specific host
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.pemfile = "/etc/letsencrypt/live/pihole.sfitpro.com/combined.pem"
ssl.ca-file = "/etc/letsencrypt/live/pihole.sfitpro.com/fullchain.pem"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
}

# Redirect HTTP to HTTPS
$HTTP["scheme"] == "http" {
$HTTP["host"] =~ ".*" {
url.redirect = (".*" => "https://%0$0")
}
}
}

Restart the lighttpd service
- $ sudo systemctl restart lighttpd

3. Add the Pi-hole FQDN on Pi-hole

Create a file called lan.list in /etc/pihole/
Add the following to the file
- <pi-hole-ip-address> <pi-hole-fqdn>
- e.g. 192.168.1.19 pihole.sfitpro.com
Create a second dnsmasq config file called 02-lan.conf in /etc/dnsmasq.d/
Add the following to the file to reference the lan.list file created above
- addn-hosts=/etc/pihole/lan.list
Restart the DNS service on pi-hole$ sudo pihole restartdns
- $ sudo pihole restartdns

Now when entering the Pi-hole FQDN in the browser, it will be redirected to the HTTPS page with a valid SSL certificate.

Match a string ending with a dollar sign ($) and containing a variable in PowerShell

In my previous post, I can match a string ending with a dollar sign ($) using the single quote with the expression ‘\$$’. Because the single quote protects the PowerShell automatic variable $$ from being evaluated. But it brings up my next question, how about the same expression also includes other variable that should be evaluated. Like this example.

PS C:\Temp> $name = 'smith'
PS C:\Temp>
PS C:\Temp> 'contoso\john.smith$' -match "$name"
True
PS C:\Temp> 'contoso\john.smith$' -match '$name'
False

Obviously, I have to use the double quote to evaluate the variable $name before sending the expression to the regex engine. But I also need the single quote for the variable $$.

PS C:\Temp> 'contoso\john.smith$' -match '$name\$$'
False
PS C:\Temp> 'contoso\john.smith$' -match "$name\$$"
False

Here is my solution - using double quote with both the regex escape character backslash(\) and PowerShell escape character backpack(`).

PS C:\Temp> 'contoso\john.smith$' -match "$name\$`$"
True

Let me explain

Use double quote to evaluate the variable $name
Use `$ to prevent the automatic variable $$. Using the PowerShell escape character (`) because it’s the PowerShell evaluation, not regex evaluation. So do not use \$ on the second $.
After the variable evaluation, the expression becomes smith\$$. This is passed to the regex engine. As expected, this regex matches the string ending with smith$.

Match a string ending with a dollar sign ($) in PowerShell

I want to match a string ending with a dollar sign ($) (e.g. ‘contoso\john.smith$’) in PowerShell. Using the regular expression (regex) should be simple, like \$$.

However, I run into some problem in PowerShell. I posted my question in Reddit for help. With the comments from the community, I think I finally understand how to handle this issue. This blog post is to summarize my understanding.

-match operator uses the regular expression syntax.
The scape character in regex is the backslash(\). Normally the regular PowerShell escape character, the backtick(`), should not use in the regex expression. See my next post on using both scape characters (\ and `) in one expression.
To match a string ending with a dollar sign ($), the regex should be \$$. The first $ is for the literal $, so it is escaped by \. The second $ is an anchor which matches the end of a string, so it is not escaped by \.
However $$ is an automatic variable in PowerShell.
When the expression(\$$) is doubled-quoted, PowerShell evaluates the variable $$ first before sending to the regex engine. “\$$” becomes “\{value of $$}” when being parsed by the regex engine. So it returns False.

PS C:\Temp> 'contoso\john.smith$' -match "\$$"
False

When the expression(\$$) is single-quoted, PowerShell does not evaluate any variable. The expression \$$ is parsed by the regex engine. So it returns True.

PS C:\Temp> 'contoso\john.smith$' -match '\$$'
True

In the case, I can match a string ending with $ by using the single quote with the expression '\$$'. However, this will not work if the expression includes other variable that should be evaluated. I will post my solution in the next post.

My Pi-hole blocklists

After setting up the Pi-hole on the Raspberry Pi, I start looking for additional blocklists to block as much as unnecessary traffic on my home network.

Searching on the Pi-hole Userspace, I found many discussions about the blocklists. I want to share my blocklists on this post, so you can save time.

My goals are to use the blocklists that

Are from the reliable source
Are updated regularly
Provide additional filter categories that are safe for family
Are free of charge

As mentioned in my “Select Upstream DNS server for Pi-hole” post, I may be able to use OpenDNS or CleanBrowsing DNS as my upstream DNS server to achieve the same goals without using the blocklists. But these blocklists become necessary after I set up DoH with Cloudflare DNS because Cloudflare DNS doesn’t provide content filtering.

The following are the blocklists in my Pi-hole. You can copy and paste them under Pi-hole’s admin page, Settings, Blocklists, and click “Save and Update”.

At the time of this writing, these lists block over 3,900,000 unique domains. I have to admit some legit domains also being blocked, e.g. the Target.com's Weekly Ad. But they can be fairly easy to identify and add to the whitelist. I will share in a future post.

Please provide your feedback if you have a better list or issue with my list. I will keep the list up-to-date.

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://blocklist.site/app/dl/ads
https://blocklist.site/app/dl/crypto
https://blocklist.site/app/dl/drugs
https://blocklist.site/app/dl/fraud
https://blocklist.site/app/dl/fakenews
https://blocklist.site/app/dl/gambling
https://blocklist.site/app/dl/malware
https://blocklist.site/app/dl/phishing
https://blocklist.site/app/dl/piracy
https://blocklist.site/app/dl/porn
https://blocklist.site/app/dl/proxy
https://blocklist.site/app/dl/ransomware
https://blocklist.site/app/dl/redirect
https://blocklist.site/app/dl/scam
https://blocklist.site/app/dl/spam
https://blocklist.site/app/dl/tracking
https://dbl.oisd.nl/

Set up Cloudfared DoH for Pi-hole

I would prefer using DNS over HTTPS (DoH) to increase privacy and security. Mozilla Firefox is the first web browser implementing DoH, and many other browsers follow. But how can I utilize DoH for the non-browser DNS request or enable DoH on each device that connects to my home network?

Pi-hole has a document to configure DNS-Over-HTTPS. To automate the install and configure Cloudfared on a Raspberry Pi running Raspbian, I create a bash script. I also add the steps to lock down the cloudfared account.

Here are how set up Cloudfared DoH using the script.

Make sure the Pi-hole is set up on your Raspberry Pi. See my post “Set up Pi-hole on a Raspberry Pi”.
Download the script from my Github on your Raspberry Pi
- curl -O https://raw.githubusercontent.com/sfitpro/pi-hole/master/setup.cloudflared.doh.for.pi-hole.sh
Grant the execution permission to the script
- chmod +x setup.cloudflared.doh.for.pi-hole.sh
Run the script
- sudo ./setup.cloudflared.doh.for.pi-hole.sh
Configure the Pi-hole to use custom Upstream DNS server 127.0.0.1#5053

If all the setup is correct, you will notice the DNS queries on Pi-hole are answered by localhost.