nagios-check-tor-authority-cert 2.9 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
  1. #!/bin/bash
  2. # nagios-check-tor-authority-cert - check certificate expiry time
  3. # A nagios check for Tor v3 directory authorities:
  4. # - Checks the current certificate expiry time
  5. #
  6. # Usage: nagios-check-tor-authority-cert <authority identity fingerprint>
  7. # e.g.: nagios-check-tor-authority-cert A9AC67E64B200BBF2FA26DF194AC0469E2A948C6
  8. # Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
  9. #
  10. # Permission is hereby granted, free of charge, to any person obtaining
  11. # a copy of this software and associated documentation files (the
  12. # "Software"), to deal in the Software without restriction, including
  13. # without limitation the rights to use, copy, modify, merge, publish,
  14. # distribute, sublicense, and/or sell copies of the Software, and to
  15. # permit persons to whom the Software is furnished to do so, subject to
  16. # the following conditions:
  17. #
  18. # The above copyright notice and this permission notice shall be
  19. # included in all copies or substantial portions of the Software.
  20. #
  21. # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  22. # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  23. # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  24. # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  25. # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  26. # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  27. # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  28. set -e
  29. set -u
  30. if [ -z "${1:-}" ]; then
  31. echo "Usage: $0 <authority identity fingerprint>" 2>&1
  32. exit 3
  33. fi
  34. identity="$1"
  35. DIRSERVERS=""
  36. DIRSERVERS="$DIRSERVERS 86.59.21.38:80" # tor26
  37. DIRSERVERS="$DIRSERVERS 128.31.0.34:9031" # moria1
  38. DIRSERVERS="$DIRSERVERS 216.224.124.114:9030" # ides
  39. DIRSERVERS="$DIRSERVERS 80.190.246.100:80" # gabelmoo
  40. #DIRSERVERS="$DIRSERVERS 140.247.60.64:80" # lefkada
  41. DIRSERVERS="$DIRSERVERS 194.109.206.212:80" # dizum
  42. DIRSERVERS="$DIRSERVERS 213.73.91.31:80" # dannenberg
  43. TMPFILE="`tempfile`"
  44. trap 'rm -f "$TMPFILE"' 0
  45. for dirserver in $DIRSERVERS; do
  46. wget -q -O "$TMPFILE" "http://$dirserver/tor/keys/fp/$identity"
  47. if [ "$?" = 0 ]; then
  48. break
  49. else
  50. cat /dev/null > "$TMPFILE"
  51. continue
  52. fi
  53. done
  54. if ! [ -s "$TMPFILE" ] ; then
  55. echo "UNKNOWN: Downloading certificate for $identity failed."
  56. exit 3
  57. fi
  58. expirydate="$(awk '$1=="dir-key-expires" {printf "%s %s", $2, $3}' < "$TMPFILE")"
  59. expiryunix=$(TZ=UTC date -d "$expirydate" +%s)
  60. now=$(date +%s)
  61. if [ "$now" -ge "$expiryunix" ]; then
  62. echo "CRITICAL: Certificate expired $expirydate (authority $identity)."
  63. exit 2
  64. elif [ "$(( $now + 7*24*60*60 ))" -ge "$expiryunix" ]; then
  65. echo "CRITICAL: Certificate expires $expirydate (authority $identity)."
  66. exit 2
  67. elif [ "$(( $now + 30*24*60*60 ))" -ge "$expiryunix" ]; then
  68. echo "WARNING: Certificate expires $expirydate (authority $identity)."
  69. exit 1
  70. else
  71. echo "OK: Certificate expires $expirydate (authority $identity)."
  72. exit 0
  73. fi