#3298 - SSL monitoring script for icinga

check_ssl_cert.sh

 #!/bin/sh
 
-# Icinga plugin that checks how many days are left until SSL certificate expires
-# Usage: <PluginDir>/check_ssl_cert -H <HOSTNAME> -P <PORT> -c <CRITICAL> -w <WARNING>
+# Icinga plugin that checks how many days are left
+# until SSL certificate expires.
+# Usage:
+# $PLUGIN_DIR/check_ssl_cert.sh -H $HOST -P $PORT -c $CRITICAL -w $WARNING
 
-PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
-export PATH
-PROGNAME=`basename $0`

[mathias, 2018/05/30 08:12:00]

What if $0 contains white-space characters?

-PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`

[mathias, 2018/05/30 08:12:00]

Isn't there a regular POSIX or Linux command for that? It should not require a
regular expression in the script just to get the directory name.

-
-#. $PROGPATH/utils.sh

[mathias, 2018/05/30 08:12:00]

Please avoid "commented-out" lines that do no serve a purpose, e.g. in
documentation.

+get_ssl_expiry_date() {
+  openssl s_client -connect "$1:$2" </dev/null 2>/dev/null \
+  | openssl x509 -noout -enddate 2>/dev/null
+}
 
 CURRENT_DATE=`date +%y%m%d`
-HOST=$2
-PORT=$4
-CRITICAL=$6
-WARNING=$8

[mathias, 2018/05/30 08:12:00]

What if any of $2, $4, $6, $8 contain white-space characters?

+HOST="$2"
+PORT="$4"
+CRITICAL="$6"
+WARNING="$8"
+STATE_OK=0
+STATE_WARNING=1
+STATE_CRITICAL=2
+STATE_UNKNOWN=3
+OUTPUT=`get_ssl_expiry_date "$HOST" "$PORT"`
 
-DAY=`echo | openssl s_client -connect "$HOST":$PORT 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | awk '{print $2}'`

[mathias, 2018/05/30 08:12:00]

There should be a better way to send non-input to the `openssl` command other
than pipe-lining an `echo`. You could use input redirection from /dev/null, for
example. See https://www.tutorialspoint.com/unix/unix-io-redirections.htm for an
introduction.

-
-if [ ! $DAY ]

[mathias, 2018/05/30 08:11:59]

Since you `-connect` to `$HOST:$PORT` multiple times during the script, why do
you have error handling logic only for the first attempt?

+if [ -z "$OUTPUT" ]
 then
   echo "UNKNOWN - Could not connect to $HOST via port $PORT"
-  exit $STATE_UNKNOWN
+  exit "$STATE_UNKNOWN"
 fi
 
-MONTH=`echo | openssl s_client -connect "$HOST":$PORT 2>/dev/null | openssl x509 -noout -enddate | awk '{print $1}' | cut -c 10-`
-YEAR=`echo | openssl s_client -connect "$HOST":$PORT 2>/dev/null | openssl x509 -noout -enddate | awk '{print $4}'`
+DAY=`echo "$OUTPUT" | awk '{printf "02d", $2}'`
+MONTH=`echo "$OUTPUT" | awk '{print $1}' | cut -c 10-`
+YEAR=`echo "$OUTPUT" | awk '{print $4}'`
 
-case $MONTH in
+case "$MONTH" in
 
   "Jan")
     MONTH="01"
     ;;
   "Feb")
     MONTH="02"
     ;;
   "Mar")
     MONTH="03"
     ;;
@@ skipping 23 matching lines @@
     ;;
   "Dec")
     MONTH="12"
     ;;
   "*")
     echo "An error occured"
     exit 1
     ;;
 esac
 
-EXPIRY_DATE_IN_SEC=`date -d $YEAR$MONTH$DAY +%s`
-CURRENT_DATE_IN_SEC=`date -d $CURRENT_DATE +%s`
-DIFF=`expr $EXPIRY_DATE_IN_SEC - $CURRENT_DATE_IN_SEC`
-DIFF=`expr $DIFF / 86400`
+EXPIRY_DATE_IN_SEC=`date -d "${YEAR}${MONTH}${DAY}" +%s`
+CURRENT_DATE_IN_SEC=`date -d "$CURRENT_DATE" +%s`
+DIFFERENCE=`expr \( "$EXPIRY_DATE_IN_SEC" - "$CURRENT_DATE_IN_SEC" \) / 86400`
 
-if [ $DIFF -le $CRITICAL ]
+if [ "$DIFFERENCE" -le "$CRITICAL" ]
 then
   echo "CRITICAL - $HOST: SSL certificate has been expired!"
-  exit $STATE_CRITICAL

[mathias, 2018/05/30 08:11:59]

Where are the $STATE_{CRITICAL,WARNING,OK,UNKNOWN} variables defined?

-elif [ $DIFF -le $WARNING ] && [ $DIFF -gt $CRITICAL ]

[mathias, 2018/05/30 08:12:00]

You already know at this point that $DIFF is greater than $CRITICAL because you
already determined above that $DIFF is not less than or equal $CRITICAL.

+  exit "$STATE_CRITICAL"
+elif [ "$DIFFERENCE" -le "$WARNING" ]
 then
-  echo "WARNING - $HOST: SSL certificate will be expired in $DIFF days!"
-  exit $STATE_WARNING
-elif [ $DIFF -gt $WARNING ]
+  echo "WARNING - $HOST: SSL certificate will be expired in $DIFFERENCE days!"
+  exit "$STATE_WARNING"
+elif [ "$DIFFERENCE" -gt "$WARNING" ]
 then
-  echo "OK - $HOST: SSL certificate will be expired in $DIFF days"
-  exit $STATE_OK
+  echo "OK - $HOST: SSL certificate will be expired in $DIFFERENCE days"
+  exit "$STATE_OK"
 else
   echo "UNKNOWN - $HOST: Could not retrieve data"
-  exit $STATE_UNKNOWN
+  exit "$STATE_UNKNOWN"
 fi