From 1f5131aeb7406b5c880c5a70a4269d3e2ded6b23 Mon Sep 17 00:00:00 2001
From: Daniel STAN <daniel.stan@crans.org>
Date: Thu, 14 Feb 2013 03:06:36 +0100
Subject: [PATCH] =?UTF-8?q?[check=5Fcert]=20v=C3=A9rification=20des=20date?=
 =?UTF-8?q?s=20des=20certifs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

En faisant une connexion directe tcp. Du coup, ça ne marche pas
pour tous les services utilisants SSL:
 * freeradius (key pour le wifi) utilise de l'UDP donc est hors jeu.
 * xmpp : le protocole du serveur n'a pas l'air reconnu

Il faudrait aussi regrouper tout ça sous un groupe commun.
---
 Bundler/check_cert.xml       |  4 ++++
 Metadata/groups.xml          | 16 ++++++++++++++++
 Python/etc/cron.d/check_cert | 23 +++++++++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 Bundler/check_cert.xml
 create mode 100644 Python/etc/cron.d/check_cert

diff --git a/Bundler/check_cert.xml b/Bundler/check_cert.xml
new file mode 100644
index 0000000..d8833bd
--- /dev/null
+++ b/Bundler/check_cert.xml
@@ -0,0 +1,4 @@
+<Bundle name="check_eux">
+  <Package name="python-m2crypto" />
+  <Python name="/etc/cron.d/check_cert" />
+</Bundle>
diff --git a/Metadata/groups.xml b/Metadata/groups.xml
index 75416aa..d3f176a 100644
--- a/Metadata/groups.xml
+++ b/Metadata/groups.xml
@@ -235,11 +235,14 @@
     <Group name="crans-squeeze-domu"/>
     <Group name="http-server"/>
     <Group name="home-permanent"/>
+    <Bundle name="check_cert" />
+    <Group name="https_cert" />
   </Group>
 
   <Group name="asterisk"
          profile="true">
     <Group name="crans-squeeze-domu"/>
+    <Bundle name="check_cert" />
   </Group>
 
   <Group name="canard"
@@ -280,12 +283,17 @@
     <Group name="http-server"/>
     <Group name="news-search"/>
     <Group name="crans-squeeze-domu"/>
+
+    <Bundle name="check_cert" />
+    <Group name="https_cert" />
   </Group>
 
   <Group name="o2"
          profile="true">
     <Group name="crans-squeeze-domu"/>
     <Group name="nginx" comment="Pour l'intranet"/>
+    <Bundle name="check_cert" />
+    <Group name="https_cert" />
   </Group>
 
   <Group name="munin"
@@ -354,6 +362,8 @@
         profile="true">
     <Group name="nginx" comment="Proxy web pour SOGo"/>
     <Group name="crans-squeeze-domu"/>
+    <Bundle name="check_cert" />
+    <Group name="https_cert" />
   </Group>
 
   <Group name="dhcp"
@@ -438,6 +448,10 @@
     <Bundle name="molly-guard"/>
     <Bundle name="vlock"/>
     <Bundle name="nagios"/>
+
+    <Bundle name="check_cert" />
+    <Group name="https_cert" />
+
     <Bundle name="python-netifaces"/>
     <Bundle name="sshfingerprint"/>
   </Group>
@@ -697,6 +711,7 @@
   <Group name="https-server"
      comment="un serveur HTTPS (port 443) de l'association">
     <Group name="https-server-backend"/>
+    <Bundle name="check_cert" />
   </Group>
 
   <Group name="intranet-server"
@@ -1134,6 +1149,7 @@
 
   <Group name="bcfg2-server">
     <Bundle name="bcfg2"/>
+    <Bundle name="check_cert" />
   </Group>
 
   <Group name="apt-mirror"
diff --git a/Python/etc/cron.d/check_cert b/Python/etc/cron.d/check_cert
new file mode 100644
index 0000000..b057fd6
--- /dev/null
+++ b/Python/etc/cron.d/check_cert
@@ -0,0 +1,23 @@
+# -*- coding: utf-8; mode: python -*-
+
+info["owner"] = "root"
+info["group"] = "root"
+info["perms"] = 0644
+
+header("Check SSL certificates")
+
+def check_cert(host='localhost', port=443, user="www-data"):
+    print "42 7 * * * %(user)s /usr/scripts/utils/check_cert.py %(host)s %(port)s" %\
+        { 'host': host,
+          'port': port,
+          'user': user,
+        }
+
+if has('https-server') or has('https_cert'):
+    check_cert('localhost', 443, 'www-data')
+
+if has('bcfg2-server'):
+    check_cert('localhost', 6789)
+
+if has('asterisk'):
+    check_cert('localhost', 5061)