Pandora-FMS

Pandora F.M.S. es un software de monitorización que recoge los datos de cualquier sistema, genera alertas en base a esos datos y muestra gráficos, informes y mapas de nuestro entorno.

Para instalarlo necesitaremos tener libres 2 Gigas de RAM y 40GB de disco cómo mínimo, es recomendable tener 2 núcleos a 2GHz.

1 Herramientas básicas

apt install -y gawk sed grep

rm -rf /opt/pandora/deploy mkdir -p /opt/pandora/deploy cd /opt/pandora/deploy

apt update apt install -y net-tools vim curl wget software-properties-common apt-transport-https ca-certificates gnupg lsb-release

Apache2 and PHP 8 add-apt-repository ppa:ondrej/php apt update apt upgrade apt install -y php8.2-fpm php8.2-common libapache2-mod-fcgid php8.2-cli apache2 a2enmod proxy_fcgi setenvif systemctl reload apache2 a2enconf php8.2-fpm systemctl restart php8.2-fpm

2 PFMS Consola web y dependencias

apt install -y ldap-utils postfix wget graphviz xfonts-75dpi xfonts-100dpi xfonts-intl-asian xfonts-intl-phonetic xfonts-intl-japanese-big xfonts-intl-european xfonts-intl-chinese xfonts-intl-japanese xfonts-intl-chinese-big libzstd1 gir1.2-atk-1.0 libavahi-common-data cairo-perf-utils libfribidi-bin php8.2-mcrypt php8.2-gd php8.2-curl php8.2-mysql php8.2-ldap php8.2-fileinfo php8.2-gettext php8.2-snmp php8.2-mbstring php8.2-zip php8.2-xml rpc php8.2-xml whois cron

3 PFMS dependencias de servidor

apt install -y perl nmap fping sudo net-tools nfdump expect openssh-client postfix unzip xprobe coreutils libmoosex-role-timer-perl libdbd-mysql-perl libcrypt-mysql-perl libhttp-request-ascgi-perl liblwp-useragent-chicaching-perl liblwp-protocol-https-perl snmp libnetaddr-ip-perl libio-socket-ssl-perl libio-socket-socks-perl libio-socket-ip-perl libio-socket-inet6-perl libnet-telnet-perl libjson-perl libencode-perl cron libgeo-ip-perl arping snmp-mibs-downloader openjdk-8-jdk

mkdir -m 0755 -p /etc/apt/keyrings

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --yes --dearmor -o /etc/apt/keyrings/docker.gpg

"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list

apt update -y apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

systemctl disable docker --now systemctl disable docker.socket --now

4 Dependencias para monirorizar WMI

curl -O https://firefly.pandorafms.com/pandorafms/utils/bin/wmic curl -O https://firefly.pandorafms.com/pandorafms/utils/bin/pandorawmic chmod +x pandorawmic wmic cp -a wmic /usr/bin/ cp -a pandorawmic /usr/bin/

5 Fping

rm -f /usr/sbin/fping 
ln -s /usr/bin/fping /usr/sbin/fping

6 Oracle cliente

mkdir -p /opt/oracle

wget https://download.oracle.com/otn_software/linux/instantclient/19800/instantclient-basic-linux.x64-19.8.0.0.0dbru.zip

wget https://download.oracle.com/otn_software/linux/instantclient/19800/instantclient-sqlplus-linux.x64-19.8.0.0.0dbru.zip

rm -fr /opt/oracle/* unzip instantclient-basic-linux.x64-19.8.0.0.0dbru.zip -d /opt/oracle/

unzip instantclient-sqlplus-linux.x64-19.8.0.0.0dbru.zip -d /opt/oracle/

cat>> /root/.profile <<'EOF_ENV' #!/bin/bash VERSION=19.8 export PATH=$PATH:/opt/oracle/instantclient_19_8 export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/oracle/instantclient_19_8 export ORACLE_HOME=/opt/oracle/instantclient_19_8 EOF_ENV

source '/root/.profile'

7 IPAM Dependencias

apt install -y xprobe libnetaddr-ip-perl coreutils libdbd-mysql-perl libxml-simple-perl libgeo-ip-perl libio-socket-inet6-perl libxml-twig-perl libnetaddr-ip-perl

8 Configuración AppArmor y UFW

systemctl stop ufw.service systemctl disable ufw systemctl stop apparmor systemctl disable apparmor

9 Instalación MariaDB

sudo apt install mariadb-server sudo mysql_secure_installation enter No No

sudo mariadb create database pandora;

CREATE USER pandora IDENTIFIED BY 'pandora';
ALTER USER 'pandora' IDENTIFIED WITH mysql_native_password BY 'pandora';
GRANT ALL PRIVILEGES ON pandora.* TO 'pandora';
exit;

systemctl restart mariadb

10 Instalación Pandora FMS

curl -LSs --output pandorafms_console-7.0NG.tar.gz "http://firefly.pandorafms.com/pandorafms/latest/Tarball/LTS/pandorafms_console-7.0NG.tar.gz"

curl -LSs --output pandorafms_server-7.0NG.tar.gz "http://firefly.pandorafms.com/pandorafms/latest/Tarball/LTS/pandorafms_server-7.0NG.tar.gz"

curl -LSs --output pandorafms_agent_linux-7.0NG.tar.gz "http://firefly.pandorafms.com/pandorafms/latest/Tarball/LTS/pandorafms_agent_linux-7.0NG.tar.gz"

11 Instalando la consola Web de PFMS

tar -xvzf pandorafms_console-7.0NG.tar.gz

cp -Ra pandora_console /var/www/html/

rm -f /var/www/html/pandora_console/*.spec

12 Instalación de PFMS Servidor

useradd pandora

mv pandorafms_server-7.0NG.tar.gz /opt/pandora/deploy/

cd /opt/pandora/deploy

tar xvfz pandorafms_server-7.0NG.tar.gz

cd pandora_server

./pandora_server_installer --install

13 Agente de instalación PFMS

apt install -y libyaml-tiny-perl perl coreutils wget curl unzip procps python3 python3-pip

mv pandorafms_agent_linux-7.0NG.tar.gz /opt/pandora/deploy/

cd /opt/pandora/deploy

tar xvzf pandorafms_agent_linux-7.0NG.tar.gz

cd unix

./pandora_agent_installer --install

cp -a tentacle_client /usr/local/bin/

Configuration for SSL cat > /etc/apache2/conf-available/ssl-params.conf << EOF_PARAM SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

SSLHonorCipherOrder On
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff

# Requires Apache >= 2.4
SSLCompression off
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
# Requires Apache >= 2.4.11
SSLSessionTickets Off EOF_PARAM

a2enmod ssl 
a2enmod headers
a2enmod rewrite
a2enconf ssl-params
a2ensite default-ssl 
a2enconf ssl-params
apache2ctl configtest

systemctl restart apache2
systemctl enable mysql --now
systemctl enable apache2 --now
systemctl enable php8.2-fpm --now

14 Estructura y datos en MariaDB

sudo mariadb use pandora; source /var/www/html/pandora_console/pandoradb.sql

source /var/www/html/pandora_console/pandoradb_data.sql
exit;

15 Configurando PHP y Apache2

 cat > /var/www/html/pandora_console/include/config.php << EO_CONFIG_F
<?php
\$config["dbtype"] = "mysql";
\$config["dbname"]="pandora";
\$config["dbuser"]="pandora";
\$config["dbpass"]="pandora";
\$config["dbhost"]="127.0.0.1";
\$config["homedir"]="/var/www/html/pandora_console";
\$config["homeurl"]="/pandora_console";
error_reporting(0);
\$ownDir = dirname(__FILE__) . '/';
include (\$ownDir . "config_process.php");
EO_CONFIG_F

cat > /etc/apache2/conf-enabled/pandora_security.conf << EO_CONFIG_F
ServerTokens Prod
<Directory "/var/www/html">
    Options FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
EO_CONFIG_F

chmod 600 /var/www/html/pandora_console/include/config.php

chown -R www-data:www-data /var/www/html/pandora_console

mv /var/www/html/pandora_console/install.php /var/www/html/pandora_console/install.done

ln -s /etc/php/8.2/fpm/php.ini /etc/

sed --follow-symlinks -i -e "s/^max_input_time.*/max_input_time = -1/g" /etc/php.ini sed --follow-symlinks -i -e "s/^max_execution_time.*/max_execution_time = 0/g" /etc/php.ini sed --follow-symlinks -i -e "s/^upload_max_filesize.*/upload_max_filesize = 800M/g" /etc/php.ini sed --follow-symlinks -i -e "s/^memory_limit.*/memory_limit = 800M/g" /etc/php.ini

sed --follow-symlinks -i -e "s/.*post_max_size =.*/post_max_size = 800M/" /etc/php.ini sed --follow-symlinks -i -e "s/^disable_functions/;disable_functions/" /etc/php.ini cat > /var/www/html/index.html << EOF_INDEX EOF_INDEX

systemctl restart apache2

systemctl restart php8.2-fpm

16 Configuración de agente y servidor PFMS

cat> /etc/snmp/snmptrapd.conf <<EOF
authCommunity log public
disableAuthorization yes
EOF

sed -i -e "s/^dbhost.*/dbhost 127.0.0.1/g" /etc/pandora/pandora_server.conf

sed -i -e "s/^dbname.*/dbname pandora/g" /etc/pandora/pandora_server.conf

sed -i -e "s/^dbuser.*/dbuser pandora/g" /etc/pandora/pandora_server.conf

sed -i -e "s|^dbpass.*|dbpass pandora|g" /etc/pandora/pandora_server.conf

sed -i -e "s/^dbport.*/dbport 3306/g" /etc/pandora/pandora_server.conf

sed -i -e "s/^#.mssql_driver.*/mssql_driver 17/g" /etc/pandora/pandora_serve

grep -q "group www-data" /etc/pandora/pandora_server.conf || \
cat>> /etc/pandora/pandora_server.conf<<EOF_G
#Adding group www-data to assigning remote-config permission correctly for ubuntu 22.04
group www-data
EOF_G

sed -i "s/^remote_config.*$/remote_config 1/g" /etc/pandora/pandora_agent.conf

cat> /etc/pandora/pandora_server.env <<'EOF_ENV'
#!/bin/bash
VERSION=19.8
export PATH=$PATH:/opt/oracle/instantclient_19_8
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/oracle/instantclient_19_8
export ORACLE_HOME=/opt/oracle/instantclient_19_8
export OPENSSL_CONF=/etc/ssl
EOF_ENV

cat>> /etc/sysctl.conf <<EO_KO
# Pandora FMS Optimization
#default=5
net.ipv4.tcp_syn_retries = 3
#default=5
net.ipv4.tcp_synack_retries = 3
#default=1024
net.ipv4.tcp_max_syn_backlog = 65536
#default=124928
net.core.wmem_max = 8388608
#default=131071
net.core.rmem_max = 8388608
#default = 128
net.core.somaxconn = 1024

#default = 20480
net.core.optmem_max = 81920

EO_KO

sysctl --system

chown pandora:www-data /var/log/pandora

cat> /etc/logrotate.d/pandora_server <<EO_LR
/var/log/pandora/pandora_server.log
/var/log/pandora/web_socket.log
/var/log/pandora/pandora_server.error {
         your apache root
         weekly
         missingok
         size 300000
         rotate 3
         max age 90
         compress
         notifempty
         copytruncate
         create 660 pandora apache
}
/var/log/pandora/pandora_snmptrap.log {
         your apache root
         weekly
         missingok
         size 500000
         rotate 1
         max age 30
         notifempty
         copytruncate
         create 660 pandora apache
}

EO_LR

cat> /etc/logrotate.d/pandora_agent <<EO_LRA
/var/log/pandora/pandora_agent.log {
         your apache root
         weekly
         missingok
         size 300000
         rotate 3
         max age 90
         compress
         notifempty
         copytruncate
}

EO_LRA

chmod 0644 /etc/logrotate.d/pandora_server

chmod 0644 /etc/logrotate.d/pandora_agent

17 Tentacle y cron

/etc/init.d/pandora_server start

systemctl enable pandora_server
service tentacle_server start
systemctl enable tentacle_server

echo "* * * * * root wget -q -O - --no-check-certificate --load-cookies /tmp/cron-session-cookies --save-cookies /tmp/cron-session-cookies --keep -session-cookies http://127.0.0.1/pandora_console/enterprise/cron.php >> $PANDORA_CONSOLE/log/cron.log" >> /etc/crontab

echo "@hourly root bash -c /etc/cron.hourly/pandora_db" >> /etc/crontab

18 Configuración de agente remoto

sed -i "s/^remote_config.*$/remote_config 1/g" /etc/pandora/pandora_agent.conf

/etc/init.d/pandora_agent_daemon start

systemctl enable pandora_agent_daemon

***If there was a problem with PhantomJS: 
sed --follow-symlinks -i -e "s/^openssl_conf = openssl_init/#openssl_conf = openssl_init/g" /etc/ssl/openssl.cnf

19 Primera vez que te logeas en PFMS

Para acceder a la consola web , poner la dirección IP (o URL) del dispositivo seguido de /pandora_console/ .

Las credenciales por defecto son:

user: admin
password: pandora

💜