contrib/nagios-check-tor-authority-cert

   1 #!/bin/bash
   2
   3 # nagios-check-tor-authority-cert - check certificate expiry time
   4
   5 # A nagios check for Tor v3 directory authorities:
   6 # - Checks the current certificate expiry time
   7 #
   8 # Usage: nagios-check-tor-authority-cert <authority identity fingerprint>
   9 # e.g.: nagios-check-tor-authority-cert A9AC67E64B200BBF2FA26DF194AC0469E2A948C6
  10
  11 # Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
  12 #
  13 # Permission is hereby granted, free of charge, to any person obtaining
  14 # a copy of this software and associated documentation files (the
  15 # "Software"), to deal in the Software without restriction, including
  16 # without limitation the rights to use, copy, modify, merge, publish,
  17 # distribute, sublicense, and/or sell copies of the Software, and to
  18 # permit persons to whom the Software is furnished to do so, subject to
  19 # the following conditions:
  20 #
  21 # The above copyright notice and this permission notice shall be
  22 # included in all copies or substantial portions of the Software.
  23 #
  24 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  25 # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  26 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  27 # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  28 # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  29 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  30 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  31
  32
  33 set -e
  34 set -u
  35
  36 if [ -z "${1:-}" ]; then
  37         echo "Usage: $0 <authority identity fingerprint>" 2>&1
  38         exit 3
  39 fi
  40
  41 identity="$1"
  42
  43 DIRSERVERS=""
  44 DIRSERVERS="$DIRSERVERS 86.59.21.38:80"         # tor26
  45 DIRSERVERS="$DIRSERVERS 128.31.0.34:9031"       # moria1
  46 DIRSERVERS="$DIRSERVERS 216.224.124.114:9030"   # ides
  47 DIRSERVERS="$DIRSERVERS 80.190.246.100:80"      # gabelmoo
  48 #DIRSERVERS="$DIRSERVERS 140.247.60.64:80"      # lefkada
  49 DIRSERVERS="$DIRSERVERS 194.109.206.212:80"     # dizum
  50 DIRSERVERS="$DIRSERVERS 213.73.91.31:80"        # dannenberg
  51
  52 TMPFILE="`tempfile`"
  53 trap 'rm -f "$TMPFILE"' 0
  54
  55 for dirserver in $DIRSERVERS; do
  56         wget -q -O "$TMPFILE" "http://$dirserver/tor/keys/fp/$identity"
  57         if [ "$?" = 0 ]; then
  58                 break
  59         else
  60                 cat /dev/null > "$TMPFILE"
  61                 continue
  62         fi
  63 done
  64
  65 if ! [ -s "$TMPFILE" ] ; then
  66         echo "UNKNOWN: Downloading certificate for $identity failed."
  67         exit 3
  68 fi
  69
  70 expirydate="$(awk '$1=="dir-key-expires" {printf "%s %s", $2, $3}' < "$TMPFILE")"
  71 expiryunix=$(TZ=UTC date -d "$expirydate" +%s)
  72 now=$(date +%s)
  73
  74 if [ "$now" -ge "$expiryunix" ]; then
  75         echo "CRITICAL: Certificate expired $expirydate (authority $identity)."
  76         exit 2
  77 elif [ "$(( $now + 7*24*60*60 ))" -ge "$expiryunix" ]; then
  78         echo "CRITICAL: Certificate expires $expirydate (authority $identity)."
  79         exit 2
  80 elif [ "$(( $now + 30*24*60*60 ))" -ge "$expiryunix" ]; then
  81         echo "WARNING: Certificate expires $expirydate (authority $identity)."
  82         exit 1
  83 else
  84         echo "OK: Certificate expires $expirydate (authority $identity)."
  85         exit 0
  86 fi