X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=dsa-nagios-checks%2Fchecks%2Fdsa-check-config;h=ae5fa7452ebfecd53a00a76564fd2c30f666c1ae;hb=6d3540483ada4d6446d4af1aeabe7f23de7af1df;hp=0d624028ffbe68664302ee2eb496f797c13a5d2c;hpb=42e99da9d896a33803e763c746e9a103183b6b34;p=mirror%2Fdsa-nagios.git

diff --git a/dsa-nagios-checks/checks/dsa-check-config b/dsa-nagios-checks/checks/dsa-check-config
index 0d62402..ae5fa74 100755
--- a/dsa-nagios-checks/checks/dsa-check-config
+++ b/dsa-nagios-checks/checks/dsa-check-config
@@ -9,13 +9,13 @@ set -e
 err=0
 
 log() {
-	if [ "$0" == "ok" ] && [ "$err" == 0 ]; then
+	if [ "$0" = "ok" ] && [ "$err" = 0 ]; then
 		err=0
-	elif [ "$1" == "warn" ] && [ "$err" -lt 1 ]; then
+	elif [ "$1" = "warn" ] && [ "$err" -lt 1 ]; then
 		err=1
-	elif [ "$1" == "critical" ] && [ "$err" -lt 2 ]; then
+	elif [ "$1" = "critical" ] && [ "$err" -lt 2 ]; then
 		err=2
-	elif [ "$1" == "unknown" ] && [ "$err" == 0 ]; then
+	elif [ "$1" = "unknown" ] && [ "$err" = 0 ]; then
 		err=3
 	fi
 	if [ "`eval echo \\$$1`" = "" ]; then
@@ -48,7 +48,7 @@ check_ldap_conf() {
 
 	if egrep '^URI.*ldap://db.debian.org' /etc/ldap/ldap.conf > /dev/null &&
 	   egrep '^BASE.*dc=debian,dc=org' /etc/ldap/ldap.conf > /dev/null &&
-	   egrep '^TLS_CACERT.*/etc/ssl/certs/spi-cacert-2008.pem' /etc/ldap/ldap.conf > /dev/null &&
+	   egrep '^TLS_CACERT.*/etc/ssl/servicecerts/db.debian.org.crt' /etc/ldap/ldap.conf > /dev/null &&
 	   egrep '^TLS_REQCERT.*hard' /etc/ldap/ldap.conf > /dev/null ; then
 		log ok "ldap.conf configured properly"
 		return
@@ -57,8 +57,29 @@ check_ldap_conf() {
 	log warn "ldap.conf does not have URI, BASE, TLS_CACERT, TLS_REQCERT all configured correctly"
 }
 
+check_ssh_hostkeys() {
+	if [ -e /etc/ssh/ssh_host_ed25519_key ] ; then
+		if ! [ -e /etc/ssh/ssh_host_ed25519_key.pub ]; then
+			log warn "Have /etc/ssh/ssh_host_ed25519_key without .pub"
+			return
+		fi
+		if cat /etc/ssh/ssh_known_hosts | awk -v hostname=$(hostname -f) '{split($1,a,","); if (a[1] == hostname) { print } }' | grep -q -F -f /etc/ssh/ssh_host_ed25519_key.pub; then
+			log ok "ed25519 host key in known_hosts"
+			return
+		else
+			log warn "ed25519 host key missing from known_hosts"
+			return
+		fi
+	else
+		log ok "no ed25519 host key."
+		return
+	fi
+}
+
+
 check_aliases
 check_ldap_conf
+check_ssh_hostkeys
 
 [ "$critical" = "" ] || echo -n "Critical: $critical; "
 [ "$warn" = "" ] || echo -n "Warning: $warn; "