def _gen_and_copy_cert(args):
    """
    Generate certs if they don't exist or if cert regen was requested with "force-new-certs"

    """
    crt_dir = "/etc/pki/rsyslog/"
    x("mkdir -p {0}".format(crt_dir))

    fqdn = "{0}.{1}".format(net.get_hostname(), config.general.get_resolv_domain())
    srv = config.general.get_log_server_hostname1()

    cert_files = [
        "{0}{1}.crt".format(crt_dir, fqdn),
        "{0}{1}.key".format(crt_dir, fqdn),
        "{0}/ca.crt".format(crt_dir)
    ]

    # Determine whether to generate and copy rsyslog certificates
    if 'force-new-certs' in args or not _all_files_exist(cert_files):
        # Generate the certs on the remote machine
        general.wait_for_server_root_login(srv)
        general.run_remote_command(srv, "/etc/pki/rsyslog/syco-gen-rsyslog-client-keys.sh {0}".format(fqdn))

        # Retrieve the certs
        general.retrieve_from_server(srv, "/etc/pki/rsyslog/ca.crt", crt_dir)
        general.retrieve_from_server(srv, "/etc/pki/rsyslog/{0}*".format(net.get_hostname()), crt_dir,
                                     verify_local=cert_files, remove_remote_files=True)

        x("restorecon -r /etc/pki/rsyslog")
        x("chmod 600 /etc/pki/rsyslog/*")
        x("chown root:root /etc/pki/rsyslog/*")
    else:
        app.print_verbose("Found all certs and force-new-certs was not specified so not updating certificates")

def install_mail_client(args):
    """
    Installs a local postfix MTA which accepts email on localhost forwards
    relays everything to mailrelay-server. Also installs mailx.
    See line comments in install_mail_server

    """

    if config.host(net.get_hostname()).has_command_re("install-postfix-server"):
        app.print_verbose("This server will later install the postfix server, abort client installation.")
        return

    version_obj = version.Version("Install-postfix-client", SCRIPT_VERSION)
    version_obj.check_executed()

    # Install required packages
    install.package("postfix")

    # Set config file parameters
    #
    general.use_original_file("/etc/postfix/main.cf")
    postfix_main_cf = scopen.scOpen("/etc/postfix/main.cf")
    postfix_main_cf.replace(
        "#myhostname = host.domain.tld",
        "myhostname = {0}.{1}".format(get_hostname(), config.general.get_resolv_domain()),
    )  # monitor.syco.com
    postfix_main_cf.replace(
        "#mydomain = domain.tld", "mydomain = {0}".format(config.general.get_resolv_domain())
    )  # syco.com
    postfix_main_cf.replace("#myorigin = $mydomain", "myorigin = $myhostname")

    # Listen only on localhost
    postfix_main_cf.replace("inet_interfaces = localhost", "inet_interfaces = localhost")
    postfix_main_cf.replace("#mynetworks = 168.100.189.0/28, 127.0.0.0/8", "mynetworks = 127.0.0.1")
    postfix_main_cf.replace(
        "mydestination = $myhostname, localhost.$mydomain, localhost", "mydestination = $myhostname, localhost"
    )

    # Relay everything not for local machine to mailrelay.
    postfix_main_cf.replace(
        "#relay_domains = $mydestination", "relay_domains = {0}".format(config.general.get_resolv_domain())
    )
    postfix_main_cf.replace(
        "#relayhost = $mydomain", "relayhost = [{0}]".format(config.general.get_mail_relay_domain_name())
    )
    postfix_main_cf.replace("#home_mailbox = Maildir/", "home_mailbox = Maildir/")
    postfix_main_cf.replace("inet_protocols = all", "inet_protocols = ipv4")

    # Install a simple mail CLI-tool
    install_mailx()

    # Tell iptables and nrpe that this server is configured as a mail-relay server.
    iptables.add_mail_relay_chain()
    iptables.save()

    # Restart postfix
    x("service postfix restart")

    # Send test mail to the syco admin
    send_test_mail((None, config.general.get_admin_email()))

    def __init__(self):
        server_front_ip = config.host(net.get_hostname()).get_front_ip()
        server_back_ip = config.host(net.get_hostname()).get_back_ip()

        server_network_front = net.get_network_cidr(server_front_ip, config.general.get_front_netmask())

        server_network_back = net.get_network_cidr(server_back_ip, config.general.get_back_netmask())

def send_test_mail(args):
  '''
  Sends a test-email either to admin email or argv email if present using mailx.

  '''
  app.print_verbose("Send testmail for " + get_hostname())

  try:
    email = args[1]
  except IndexError:
    email = config.general.get_admin_email()

  x('echo "" | mail -s "Test email from {0}" {1}'.format(get_hostname(), email))

def add_haproxy_chain():
    del_haproxy_chain()

    if not os.path.exists('/etc/haproxy/haproxy.cfg'):
        return

    app.print_verbose("Add iptables chain for haproxy")

    # Create chains.
    iptables("-N haproxy_inout")
    iptables("-A syco_input -p tcp -j haproxy_inout")
    iptables("-A syco_output -p tcp -j haproxy_inout")

    iptables(
        "-A haproxy_inout -p tcp -m multiport --dports 80:84 -j allowed_tcp"
    )
    iptables(
        "-A haproxy_inout -p tcp -m multiport --dports 443 -j allowed_tcp"
    )

    custom_target_ports = config.host(net.get_hostname()).get_option("haproxy.target-ports", default_value="").\
        split(",")
    for port in custom_target_ports:
        if port:
            iptables("-A haproxy_inout -p tcp -m multiport --dports %s -j allowed_tcp" % port)

def install_mysql_replication(args):
    """
    Setup and start the database replication in master-master mode.

    This function should be executed on the secondary master, after the
    primary master has been configured.

    """
    app.print_verbose("Install mysql replication version: %d" % SCRIPT_VERSION)
    version_obj = version.Version("install-mysql-replication", SCRIPT_VERSION)
    version_obj.check_executed()

    current_host_config = config.host(net.get_hostname())
    repl_peer = current_host_config.get_option("repl_peer")

    general.wait_for_server_to_start(repl_peer, "3306")

    repl_password=general.generate_password(20)

    for ip in [current_host_config.get_front_ip(), repl_peer]:
        mysql_exec("stop slave;", True, ip)
        mysql_exec("delete from mysql.user where User = 'repl';", True, ip)
        mysql_exec("flush privileges;", True, ip)
        mysql_exec("GRANT REPLICATION SLAVE ON *.* TO 'repl'@'" + repl_peer + "' IDENTIFIED BY '" + repl_password + "';", True, ip)
        mysql_exec("GRANT REPLICATION SLAVE ON *.* TO 'repl'@'" + current_host_config.get_front_ip() + "' IDENTIFIED BY '" + repl_password + "';", True, ip)

        if ip==current_host_config.get_front_ip():
            mysql_exec("CHANGE MASTER TO MASTER_HOST='" + repl_peer + "', MASTER_USER='repl', MASTER_PASSWORD='" + repl_password + "'", True, ip)
        else:
            mysql_exec("CHANGE MASTER TO MASTER_HOST='" + current_host_config.get_front_ip() + "', MASTER_USER='repl', MASTER_PASSWORD='" + repl_password + "'", True, ip)
        mysql_exec("start slave;", True, ip)

    version_obj.mark_executed()

def _install_nrpe_plugins_dependencies():
    """Install libraries/binaries that the NRPE-plugins depend on."""
    # Dependency for check_rsyslog
    x("yum install -y MySQL-python")

    # Dependency for check_clamav
    x("yum install -y nagios-plugins-perl perl-Net-DNS-Resolver-Programmable")
    x("yum install -y perl-suidperl")

    x(
        """cat > /etc/sudoers.d/nrpe << EOF
Defaults:nrpe !requiretty
nrpe ALL=NOPASSWD:{0}check_clamav
nrpe ALL=NOPASSWD:{0}check_clamscan
nrpe ALL=NOPASSWD:{0}check_disk
nrpe ALL=NOPASSWD:{0}get_services
nrpe ALL=NOPASSWD:{0}mysql/pmp-check-mysql-deleted-files
nrpe ALL=NOPASSWD:{0}mysql/pmp-check-mysql-file-privs
EOF
""".format(
            PLG_PATH
        )
    )

    # Dependency for check_clamscan
    x("yum install -y perl-Proc-ProcessTable perl-Date-Calc")

    # Dependency for check_ldap
    x("yum install -y php-ldap php-cli")

    # Dependency for check_iostat
    x("yum install -y sysstat")

    # Dependency for hosts/firewall hardware checks
    host_config_object = config.host(net.get_hostname())
    if host_config_object.is_host() or host_config_object.is_firewall():
        install.hp_repo()
        x("yum -y install hp-health hpacucli")

        # Let nrpe run hpasmcli and hpacucli
    x(
        """cat >> /etc/sudoers.d/nrpe << EOF
nrpe ALL=NOPASSWD:/sbin/hpasmcli
nrpe ALL=NOPASSWD:{0}check_hpasm
nrpe ALL=NOPASSWD:/sbin/hpacucli
nrpe ALL=NOPASSWD:{0}check_hparray
EOF
""".format(
            PLG_PATH
        )
    )

    # Dependency for check_ulimit
    x("yum install -y lsof")

    # Set ulimit values to take affect after reboot
    x("printf '\n*\tsoft\tnofile\t8196\n*\thard\tnofile\t16392\n' >> /etc/security/limits.conf")

    # Kernel wont parse anything but read-only in sudoers. So chmod it.
    x("chmod 0440 /etc/sudoers.d/nrpe")

def rsyslog_newcerts(args):
    """
    Generate new tls certs for rsyslog server

    NOTE: This needs to be executed once a year.

    """
    x("mkdir -p /etc/pki/rsyslog")

    # Copy certs template
    template_ca = "{0}template.ca".format(get_install_dir())
    x("cp -f /opt/syco/var/rsyslog/template.ca {0}".format(template_ca))

    hostname = "{0}.{1}".format(net.get_hostname(), config.general.get_resolv_domain())
    _replace_tags(template_ca, hostname)

    # Making CA
    x("certtool --generate-privkey --outfile /etc/pki/rsyslog/ca.key")
    x("certtool --generate-self-signed --load-privkey /etc/pki/rsyslog/ca.key "+
      "--outfile /etc/pki/rsyslog/ca.crt " +
      "--template {0}".format(template_ca)
    )

    # Copy server template and cert/key generator script
    target_template = '/etc/pki/rsyslog/template.server'
    x("cp -f /opt/syco/var/rsyslog/template.server {0}".format(target_template))
    _replace_tags(target_template, fqdn)

    # New generator script used by clients directly
    generator_script = "syco-gen-rsyslog-client-keys.sh"
    x("cp -f /opt/syco/var/rsyslog/{0} /etc/pki/rsyslog/".format(generator_script))
    x("chmod 700 /etc/pki/rsyslog/{0}".format(generator_script))

def rsyslog_newcerts(args):
    '''
    Generate new tls certs for rsyslog server and all clients defined in install.cfg.

    NOTE: This needs to be executed once a year.

    '''
    x("mkdir -p /etc/pki/rsyslog")

    # Copy certs template
    template_ca = "{0}template.ca".format(get_install_dir())
    x("cp -f /opt/syco/var/rsyslog/template.ca {0}".format(template_ca))

    hostname = "{0}.{1}".format(net.get_hostname(), config.general.get_resolv_domain())
    _replace_tags(template_ca, hostname)

    # Making CA
    x("certtool --generate-privkey --outfile /etc/pki/rsyslog/ca.key")
    x("certtool --generate-self-signed --load-privkey /etc/pki/rsyslog/ca.key "+
      "--outfile /etc/pki/rsyslog/ca.crt " +
      "--template {0}".format(template_ca)
    )

    #
    # Create rsyslog SERVER cert
    #
    for server in get_servers():
        _create_cert(server)

 def test_general(self):
     self.assertEqual(net.get_all_interfaces(), {'sit0': None, 'lo': '127.0.0.1', 'eth0': '10.100.100.231'})
     self.assertEqual(net.get_interface_ip("eth0"), "10.100.100.231")
     self.assertEqual(net.get_lan_ip(), "10.100.100.231")
     self.assertEqual(net.reverse_ip("1.2.3.4"), "4.3.2.1")
     self.assertEqual(net.get_ip_class_c("1.2.3.4"), "1.2.3")
     self.assertEqual(net.num_of_eth_interfaces(), 1)
     self.assertEqual(net.get_hostname(), "fo-tp-dalitst")

def send_test_mail(args, additional_emails_to_test=[]):
    """
    Sends a test-email either to admin email or argv email if present using mailx.

    """
    app.print_verbose("Send testmail for " + get_hostname())

    try:
        email = args[1]
    except IndexError:
        email = config.general.get_admin_email()

    x('echo "" | mail -s "Test email from {0}. Installation complete!" {1}'.format(get_hostname(), email))

    for email in additional_emails_to_test:
        app.print_verbose("Send additional test mail to: %s" % email)
        x('echo "" | mail -s "Test email to {0}" {0}.'.format(email))

def install_ntp_client(args):
  if config.host(net.get_hostname()).has_command_re("install-ntp-server"):
    app.print_verbose(
      "This server will later install the ntp server, abort client installation."
    )
    return
  ip = config.general.get_ntp_server_ip()
  install_ntp(ip)

def _install_nrpe_plugins_dependencies():
    """Install libraries/binaries that the NRPE-plugins depend on."""
    # Dependency for check_rsyslog
    app.print_verbose("Install required dependency for check_rsyslog")
    install_packages("MySQL-python")

    # Dependency for check_clamav
    app.print_verbose("Install required dependencies for check_clamav")
    install_packages("perl-Net-DNS-Resolver-Programmable perl-suidperl")

    x("""cat > /etc/sudoers.d/nrpe << EOF
Defaults:nrpe !requiretty
nrpe ALL=NOPASSWD:{0}check_clamav
nrpe ALL=NOPASSWD:{0}check_clamscan
nrpe ALL=NOPASSWD:{0}check_disk
nrpe ALL=NOPASSWD:{0}get_services
nrpe ALL=NOPASSWD:{0}check_file_age
nrpe ALL=NOPASSWD:{0}check_ossec-clients.sh
nrpe ALL=NOPASSWD:{0}check_haproxy_stats.pl
nrpe ALL=NOPASSWD:/usr/sbin/rabbitmqctl
nrpe ALL=NOPASSWD:{0}mysql/pmp-check-mysql-deleted-files
nrpe ALL=NOPASSWD:{0}mysql/pmp-check-mysql-file-privs
EOF
""".format(PLG_PATH))

    # Dependency for check_ldap
    app.print_verbose("Install required dependencies for check_ldap")
    install_packages("php-ldap php-cli")

    # Dependency for check_iostat
    app.print_verbose("Install required dependency for check_iostat")
    install_packages("sysstat")

    # Dependency for hosts/firewall hardware checks
    host_config_object = config.host(net.get_hostname())
    if host_config_object.is_host() or host_config_object.is_firewall():
        install.hp_repo()
        app.print_verbose("Install required dependencies for Hardware checks")
        install_packages("hp-health hpssacli")

        # Let nrpe run hpasmcli and hpssacli
        x("""cat >> /etc/sudoers.d/nrpe << EOF
nrpe ALL=NOPASSWD:/sbin/hpasmcli
nrpe ALL=NOPASSWD:{0}check_hpasm
nrpe ALL=NOPASSWD:/usr/sbin/hpssacli
nrpe ALL=NOPASSWD:{0}check_hparray
EOF
""".format(PLG_PATH))

    # Dependency for check_ulimit
    app.print_verbose("Install required dependency for check_ulimit")
    install_packages("lsof")

    # Set ulimit values to take affect after reboot
    x("printf '\n*\tsoft\tnofile\t8196\n*\thard\tnofile\t16392\n' >> /etc/security/limits.conf")

    # Kernel wont parse anything but read-only in sudoers. So chmod it.
    x("chmod 0440 /etc/sudoers.d/nrpe")

def add_rsyslog_chain(context=None):
    """
    Rsyslog IPtables rules

    Rsyslog Server
    Servers in network -> IN -> tcp -> 514 -> Rsyslog Server

    Rsyslog Client
    Rsyslog Server <- OUT <- tcp <- 514 <- Rsyslog Client

    """
    del_rsyslog_chain()

    app.print_verbose("Add iptables chain for rsyslog")
    iptables("-N rsyslog_in")
    iptables("-N rsyslog_out")
    iptables("-A syco_input  -p all -j rsyslog_in")
    iptables("-A syco_output -p all -j rsyslog_out")

    # Reference to syco.py commands
    global _commands_obj_reference

    all_rules = []
    syco_command_names = config.host(net.get_hostname()).get_syco_command_names()

    # On rsyslog server
    if "install-rsyslogd" in syco_command_names or context is "server":
        back_subnet = config.general.get_back_subnet()
        front_subnet = config.general.get_front_subnet()
        iptables(
            " -A rsyslog_in -m state --state NEW -p tcp -s %s --dport 514 -j allowed_tcp" %
            back_subnet
        )
        iptables(
            " -A rsyslog_in -m state --state NEW -p tcp -s %s --dport 514 -j allowed_tcp" %
            front_subnet
        )
        iptables(
            " -A rsyslog_in -m state --state NEW -p udp -s %s --dport 514 -j allowed_udp" %
            back_subnet
        )
        iptables(
            " -A rsyslog_in -m state --state NEW -p udp -s %s --dport 514 -j allowed_udp" %
            front_subnet
        )

    # On rsyslog client
    elif "install-rsyslogd-client" in syco_command_names or context is "client" :
        iptables(
            "-A rsyslog_out -m state --state NEW -p tcp -d %s --dport 514 -j allowed_tcp" %
            config.general.get_log_server_hostname1()
        )
        iptables(
            "-A rsyslog_out -m state --state NEW -p tcp -d %s --dport 514 -j allowed_tcp" %
            config.general.get_log_server_hostname2()
        )

def _configure_squid():
    x("rm -rf /etc/squid/*")
    x("cp %s/*.conf %s" % (SYCO_PLUGIN_PATH, SQUID_CONF_DIR))
    x("mkdir -p %s/acl" % (SQUID_CONF_DIR))
    x("mkdir -p %s/services" % (SQUID_CONF_DIR))
    x("cp %s/acl/* %sacl/" % (SYCO_PLUGIN_PATH, SQUID_CONF_DIR))
    x("cp %s/services/* %sservices/" % (SYCO_PLUGIN_PATH, SQUID_CONF_DIR))

    env_ip = config.host(net.get_hostname()).get_front_ip()
    if config.general.is_back_enabled():
        #prefer backnet if enabled
        env_ip = config.host(net.get_hostname()).get_back_ip()

    scopen.scOpen(SQUID_CONF_DIR + "squid.conf").replace("${ENV_IP}", env_ip)
    #Some setups require the front IP as well
    scopen.scOpen(SQUID_CONF_DIR + "squid.conf").replace("${FRONT_IP}", config.host(net.get_hostname()).get_front_ip())

    _chkconfig("squid", "on")
    _service("squid", "restart")

def _replace_tags():
    '''
    Replace all tags in template files with apropriate values.

    '''
    sc = scOpen("/etc/rsyslog.conf")
    sc.replace('${MASTER}', config.general.get_log_server_hostname1())
    sc.replace('${SLAVE}',  config.general.get_log_server_hostname2())
    sc.replace('${DOMAIN}', config.general.get_resolv_domain())

    fqdn = "{0}.{1}".format(net.get_hostname(), config.general.get_resolv_domain())
    sc.replace('${SERVERNAME}', fqdn)

    def __init__(self):

        netmasks = {}

        # Add localhost IP/netmask
        local_ip = "127.0.0.1"
        self.server_ips.append(local_ip)
        netmasks[local_ip] = "255.0.0.0"

        # Add IPs for front/back net if they exist.
        front_ip = config.host(net.get_hostname()).get_front_ip()
        if front_ip:
            self.server_ips.append(front_ip)
            netmasks[front_ip] = config.general.get_front_netmask()
        back_ip = config.host(net.get_hostname()).get_back_ip()
        if config.general.is_back_enabled() and back_ip:
            self.server_ips.append(back_ip)
            netmasks[back_ip] = config.general.get_back_netmask()

        if len(self.server_ips) < 2:
            app.print_error("Didn't find any valid IP addresses from front or back net. Exiting")
            sys.exit(1)

        for ip in self.server_ips:
            self.server_networks.append(net.get_network_cidr(ip, netmasks[ip]))

        self.virtual_alias_domains = config.general.get_option("mailrelay.virtual_alias_domains", "")

        for alias_row in config.general.get_option("mailrelay.virtual_aliases", "").split(";"):
            if len(alias_row.strip()) == 0:
                # Don't process empty rows
                break
            split_row = alias_row.split(" ", 1)
            if len(split_row) != 2:
                app.print_error(
                    "Expected mailrelay.virtual_alias to be two words separated by space, several entries "
                    'separated by semicolon. Found "%s"' % alias_row
                )
                sys.exit(1)
            self.virtual_aliases[split_row[0]] = split_row[1]

def _install_nrpe_plugins():
    """Install NRPE-plugins (to be executed remoteley) and SELinux-rules."""
    # Install packages and their dependencies.
    _install_nrpe_plugins_dependencies()
    x("cp -p {0}lib/nagios/plugins_nrpe/* {1}".format(constant.SYCO_PATH, PLG_PATH))
    for plugin_path in app.get_syco_plugin_paths("/var/icinga/plugins/"):
        x("cp -p {0}* {1}".format(plugin_path, PLG_PATH))

    # Set the sssd password
    nrpe_config = scopen.scOpen("/etc/nagios/nrpe.d/common.cfg")
    nrpe_config.replace("$(LDAPPASSWORD)", app.get_ldap_sssd_password())
    nrpe_config.replace("$(LDAPURL)", config.general.get_ldap_hostname())
    nrpe_config.replace("$(SQLPASS)", app.get_mysql_monitor_password().replace("&","\&").replace("/","\/"))

    # Set name of main disk
    host_config = config.host(net.get_hostname())
    if host_config.is_guest():
        nrpe_config.replace("${MAINDISK}", "vda")
    elif host_config.is_firewall() or host_config.is_host():
        nrpe_config.replace("${MAINDISK}", "sda")

    # Change ownership of plugins to nrpe (from icinga/nagios)
    x("chmod -R 550 /usr/lib64/nagios/plugins/")
    x("chown -R nrpe:nrpe /usr/lib64/nagios/plugins/")

    # Set SELinux roles to allow NRPE execution of binaries such as python/perl.
    # Corresponding .te-files summarize rule content
    x("mkdir -p /var/lib/syco_selinux_modules")
    rule_path_list = list_plugin_files("/var/nagios/selinux_rules")
    for path in rule_path_list:
        x("cp {0}/*.pp /var/lib/syco_selinux_modules/".format(path))
    x("semodule -i /var/lib/syco_selinux_modules/*.pp")

    # Fix some SELinux rules on custom plugins.
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_disk")
    _fix_selinux("nagios_services_plugin_exec_t",   "check_ldap.php")
    _fix_selinux("nagios_services_plugin_exec_t",   "check_iptables.py")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_clam*")
    # TODO??
    #_fix_selinux("nagios_unconfined_plugin_exec_t", "pmp-check-mysql*")
    #_fix_selinux("nagios_unconfined_plugin_exec_t", "farpayment_stats.py")
    #_fix_selinux("nagios_unconfined_plugin_exec_t", "rentalfront_stats.py")
    #_fix_selinux("nagios_unconfined_plugin_exec_t", "checkMySQLProcesslist.sh")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_connections.pl")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_procs.sh")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_ulimit.py")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_hpasm")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_hparray")
    _fix_selinux("nagios_unconfined_plugin_exec_t", "check_ifutil.pl")

    # New in centos 6.7
    x("setsebool -P nagios_run_sudo 1")

def _copy_cert():
    '''
    Coping certs for tls from rsyslog server

    '''
    crt_dir ="/etc/pki/rsyslog"
    x("mkdir -p {0}".format(crt_dir))
    srv = config.general.get_log_server_hostname1()
    scp_from(srv, "/etc/pki/rsyslog/{0}*".format(net.get_hostname()), crt_dir)
    scp_from(srv, "/etc/pki/rsyslog/ca.crt", crt_dir)
    x("restorecon -r /etc/pki/rsyslog")
    x("chmod 600 /etc/pki/rsyslog/*")
    x("chown root:root /etc/pki/rsyslog/*")

def _install_nrpe_plugins_dependencies():
    '''
    Install libraries/binaries that the NRPE-plugins depend on.

    '''
    # Dependency for check_rsyslog
    x("yum install -y MySQL-python")

    # Dependency for check_clamav
    x("yum install -y nagios-plugins-perl perl-Net-DNS-Resolver-Programmable sudo yum install perl-suidperl")

    nrpe_sudoers_file = scopen.scOpen("/etc/sudoers.d/nrpe")
    nrpe_sudoers_file.add("Defaults:nrpe !requiretty")
    nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}check_clamav".format(PLG_PATH))
    nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}check_clamscan".format(PLG_PATH))
    nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}check_disk".format(PLG_PATH))
    nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}get_services".format(PLG_PATH))
    nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}mysql/pmp-check-mysql-deleted-files".format(PLG_PATH))
    nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}mysql/pmp-check-mysql-file-privs".format(PLG_PATH))
    
    # Dependency for check_clamscan
    x("yum install -y perl-Proc-ProcessTable perl-Date-Calc")

    # Dependency for check_ldap
    x("yum install -y php-ldap php-cli")

    # Dependency for hosts/firewall hardware checks
    host_config_object = config.host(net.get_hostname())
    if host_config_object.is_host() or host_config_object.is_firewall():

        # Create an installname and filenames
        install_dir = general.get_install_dir()

        # Download and install HP health monitoring package
        general.download_file(
            HP_HEALTH_URL, HP_HEALTH_FILENAME, md5=HP_HEALTH_MD5
        )
        x("yum install {0} -y".format(HP_HEALTH_FILENAME))

        # Remove their evil crontab
        x("rm -f /etc/cron.d/hp-health")

        # Let nrpe run hpasmcli
        nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:/sbin/hpasmcli")
        nrpe_sudoers_file.add("nrpe ALL=NOPASSWD:{0}check_hpasm".format(PLG_PATH))

        x("service hp-health start")


    # Kernel wont parse anything but read-only in sudoers. So chmod it.
    x("chmod 0440 /etc/sudoers.d/nrpe")