In this short article I would like to show\nhow a small project developed by the ITS User Services could gain popularity\nand attract several developers which are now improving it and keeping it alive.<\/p>\n\n\n\n\n\n\n\n
Year 2007, the ITS Hosting group used Nagios<\/a> to proactively check our servers (e.g., memory, CPU usage, disk usage, network traffic). In the same year it became clear that the SSL protocol was not perfect and that several configurations could be a simple vector for several attacks (denial of service, information disclosure and even remote access).<\/p>\n\n\n\n After the publication of CVE-2007-1858<\/a> about the default ciphers of the Tomcat Server, we felt the need to check all our machines and keep the check running regularly in case an update would change the SSL\/TLS settings.<\/p>\n\n\n\n Another important check was the validity of\nthe certificate, we wanted to be warned early if a certificate was about to\nexpire.<\/p>\n\n\n\n I then wrote a simple Nagios plugin to\ncheck the security settings and validity of the certificate of an HTTPS server.<\/p>\n\n\n\n The API of Nagios is straightforward:<\/p>\n\n\n\n This simple API allows a quick\nimplementation of a prototype.<\/p>\n\n\n\n As I did not want to reinvent the wheel, I\nchoose to use the OpenSSL command line utilities to perform the checks and\npacked everything in a shell script (calling command line utilities form Perl\nor C seemed, at the time, an overkill).<\/p>\n\n\n\n Looking at this choice now, it was probably\nthe wrong one: the plugin has now around 3\u00e2\u20ac\u2122000 lines of code and shell\nscripting is not really the most comfortable language for large projects. However,\nat the time, I did not expect that so many checks and features would then be\nadded.<\/p>\n\n\n\n Having a Mac with a BSD system and\ndeploying the plugin on a GNU system, (BSD does not have GNU utilities per\ndefault) I also choose to make the plugin POSIX compliant. A good choice for a\nsuccessful open-source project but a choice that costed many headaches and\ndifficulties (people using bash on a GNU system do not usually realize how much\nis not standard). In the end, I managed to learn a lot about the different\nshells.<\/p>\n\n\n\n As the first versions of the plugin were\ndoing a good job, I then decided to release the code as open source. This step\nrequired a lot of work but after 12 years the work that the community put in\nthis project confirms, that the effort was worth the investment.<\/p>\n\n\n\n To attract people, you need to make your project easy to understand, easy to use and install and easy to access. The project needs a web page, a bug tracking system and a lot of documentation. I also had to choose a licence, and looking at other Nagios plugins, I decided to go for the GNU General Public License v3<\/a> (given the strong restrictions, especially with the distribution on macOS systems I would have rather chosen the Apache one).<\/p>\n\n\n\n Another good choice was to follow Eric Raymond\u00e2\u20ac\u2122s hints in The Cathedral and the Bazaar<\/a><\/em>: Release early, release often<\/a>. Since 2007 the tool was released with new features and bug fixes more than 100 times, often several times in the same month.<\/p>\n\n\n\n Important is also\nto listen to the community, to their needs and wishes and to acknowledge the\nwork of co-authors: the authors list<\/a> has now reached 72 persons, which helped\nwith patches and corrections.<\/p>\n\n\n\n The development of open-source software at the ETH is possible but has to be coordinated with the school with a Software Disclosure agreement with ETH transfer<\/a>. After leaving the Software Services in 2013, the ETH decided not to continue with the project, which was left to the community.<\/p>\n\n\n\n It was moved to GitHub, and I am now\nmaintaining in as a hobby. By the time we already released 31 versions and the\ncommunity was big enough to keep the project living.<\/p>\n\n\n\n After more than 10 years, the plugin\nattracted a solid community and was developed far beyond what I expected and\nwhat were the original goals. It has tons of advanced features and is widely\nused.<\/p>\n\n\n\n With this short article, I want to advocate\nfor open sourcing your projects: it requires some work at the beginning but eventually,\nyou will get back more than what you had to invest.<\/p>\n\n\n\nImplementation<\/h2>\n\n\n\n
Open sourcing<\/h2>\n\n\n\n
Legal aspects at ETH Z\u00fcrich<\/h2>\n\n\n\n
Conclusions<\/h2>\n\n\n\n
Contact & Text<\/h2>\n\n\n\n