contrib/nagios-check-tor-authority-cert

   1 #!/bin/bash
   2
   3 # nagios-check-tor-authority-cert - check certificate expiry time
   4
   5 # A nagios check for Tor v3 directory authorities:
   6 # - Checks the current certificate expiry time
   7 #
   8 # Usage: nagios-check-tor-authority-cert <authority identity fingerprint>
   9 # e.g.: nagios-check-tor-authority-cert A9AC67E64B200BBF2FA26DF194AC0469E2A948C6
  10
  11 # $Id$
  12
  13 # Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
  14 #
  15 # Permission is hereby granted, free of charge, to any person obtaining
  16 # a copy of this software and associated documentation files (the
  17 # "Software"), to deal in the Software without restriction, including
  18 # without limitation the rights to use, copy, modify, merge, publish,
  19 # distribute, sublicense, and/or sell copies of the Software, and to
  20 # permit persons to whom the Software is furnished to do so, subject to
  21 # the following conditions:
  22 #
  23 # The above copyright notice and this permission notice shall be
  24 # included in all copies or substantial portions of the Software.
  25 #
  26 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  27 # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  28 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  29 # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  30 # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  31 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  32 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  33
  34
  35 set -e
  36 set -u
  37
  38 if [ -z "${1:-}" ]; then
  39         echo "Usage: $0 <authority identity fingerprint>" 2>&1
  40         exit 3
  41 fi
  42
  43 identity="$1"
  44
  45 DIRSERVERS=""
  46 DIRSERVERS="$DIRSERVERS 86.59.21.38:80"         # tor26
  47 DIRSERVERS="$DIRSERVERS 128.31.0.34:9031"       # moria1
  48 DIRSERVERS="$DIRSERVERS 216.224.124.114:9030"   # ides
  49 DIRSERVERS="$DIRSERVERS 80.190.246.100:80"      # gabelmoo
  50 #DIRSERVERS="$DIRSERVERS 140.247.60.64:80"      # lefkada
  51 DIRSERVERS="$DIRSERVERS 194.109.206.212:80"     # dizum
  52 DIRSERVERS="$DIRSERVERS 213.73.91.31:80"        # dannenberg
  53
  54 TMPFILE="`tempfile`"
  55 trap 'rm -f "$TMPFILE"' 0
  56
  57 for dirserver in $DIRSERVERS; do
  58         wget -q -O "$TMPFILE" "http://$dirserver/tor/keys/fp/$identity"
  59         if [ "$?" = 0 ]; then
  60                 break
  61         else
  62                 cat /dev/null > "$TMPFILE"
  63                 continue
  64         fi
  65 done
  66
  67 if ! [ -s "$TMPFILE" ] ; then
  68         echo "UNKNOWN: Downloading certificate for $identity failed."
  69         exit 3
  70 fi
  71
  72 expirydate="$(awk '$1=="dir-key-expires" {printf "%s %s", $2, $3}' < "$TMPFILE")"
  73 expiryunix=$(TZ=UTC date -d "$expirydate" +%s)
  74 now=$(date +%s)
  75
  76 if [ "$now" -ge "$expiryunix" ]; then
  77         echo "CRITICAL: Certificate expired $expirydate (authority $identity)."
  78         exit 2
  79 elif [ "$(( $now + 7*24*60*60 ))" -ge "$expiryunix" ]; then
  80         echo "CRITICAL: Certificate expires $expirydate (authority $identity)."
  81         exit 2
  82 elif [ "$(( $now + 30*24*60*60 ))" -ge "$expiryunix" ]; then
  83         echo "WARNING: Certificate expires $expirydate (authority $identity)."
  84         exit 1
  85 else
  86         echo "OK: Certificate expires $expirydate (authority $identity)."
  87         exit 0
  88 fi