Packaging clean-up + SSL warning in http_check

[alq666]

Fixes #768, fixes #769 and fixes #770.

1. dd-agent user does not need a shell anymore.
2. dd-agent user is deleted when the package is uninstalled.
3. SSL certificate validation for http_check is left to False (in which case it issues a warning). It can be set to True in `http_check; it acts as a control. The default is to keep certificate validation disabled to remain compatible with previous versions.
4. Creates a Vagrant testbed (debian + redhat) that I used for validation.

Tested on Debian 7.1 and CentOS 6.5.

[alq666]

@amitto this pertains to security tweaks to our agent per our conversation in Burlingame.

[alq666]

Also fixes #771

[remh]

Can you remove that file from your PR ?

[alq666]

I can but bear in mind that this is caused by vagrant init.

[remh]

By the way,
Why are we creating a user with a home directory on centos/rhel and not on debian/ubuntu ?

Can't we use a system account instead without home directory ?
http://unix.stackexchange.com/questions/22275/how-to-create-an-unprivileged-user-in-centos

[remh]

To be clearer it would mean creating the user using:

useradd -r -M -g dd-agent -d /dev/null -s /bin/false \

[alq666]

Makes sense. The least amount of changes we apply, the easier it is.
On Dec 31, 2013 10:48 AM, "Remi Hakim" notifications@github.com wrote:

In packaging/datadog-agent-rpm/preinst:

@@ -3,7 +3,7 @@

getent group dd-agent >/dev/null || groupadd -r dd-agent
getent passwd dd-agent >/dev/null || \

• useradd -r -M -g dd-agent -d /tmp -s /bin/sh \
• useradd -r -M -g dd-agent -d /tmp -s /bin/false \

To be clearer it would mean creating the user using:

useradd -r -M -g dd-agent -d /dev/null -s /bin/false \

—
Reply to this email directly or view it on GitHubhttps://github.com//pull/778/files#r8599675
.

[remh]

I'm not even sure we need -d /dev/null as according to the documentation

-r creates a system account with a UID less than 500 and without a home directory

http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-users-add.html

[alq666]

Turns out -r still populates the home directory field in /etc/passwd so we
can set it to /usr/share/datadog/agent.

On Tue, Dec 31, 2013 at 11:16 AM, Remi Hakim notifications@github.comwrote:

In packaging/datadog-agent-rpm/preinst:

@@ -3,7 +3,7 @@

getent group dd-agent >/dev/null || groupadd -r dd-agent
getent passwd dd-agent >/dev/null || \

• useradd -r -M -g dd-agent -d /tmp -s /bin/sh \
• useradd -r -M -g dd-agent -d /tmp -s /bin/false \

I'm not even sure we need -d /dev/null as according to the documentation

-r creates a system account with a UID less than 500 and without a home
directory

http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-users-add.html

—
Reply to this email directly or view it on GitHubhttps://github.com//pull/778/files#r8599975
.

[alq666]

@remh should be good for final review now.

[alq666]

Point to an existing directory, but disable logins.

[remh]

@alq666 Looks fine to me.
Feel free to merge to master, it will be part of 4.1