ICMP Latency For Prometheus With One Capability

smokeping-prober

smokeping_prober from the upstream release (sha256-verified), as a hardened system service with its metrics on loopback, pinging the targets you list and exporting latency histograms, TTLs and loss for Prometheus. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no smokeping_prober; SuperQ ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by smokeping_prober_version.

A service account, a hardened unit, a loopback listener. smokeping is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:9374 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

One capability, and only that one. A raw ICMP socket needs CAP_NET_RAW. The unit grants it as an ambient capability to the unprivileged service account and narrows the bounding set to it, so the process holds that capability and no other. Measured in the lane before the role was written: without it, privileged mode is refused ("operation not permitted"); the unprivileged ICMP mode is refused too wherever net.ipv4.ping_group_range excludes the service's group (podman's containers default to 0 0). EL 10 hosts get 0 2147483647 from systemd, where unprivileged mode would work - the role uses the one-capability mode because it works whatever that sysctl says. The live test therefore runs with --cap-add=NET_RAW, which podman's default set does not include.

It tells reachable from unreachable. With the capability, the prober answered 5 of 7 pings to 127.0.0.1 with TTL 64 and 0 of 7 to 192.0.2.1 (TEST-NET-1) in the probe that preceded this role; the live test asserts the loopback half against the role's own default target: at least three answered pings, TTL 64, no receive errors. Note the switch is --[no-]privileged: written as --privileged=false, the word false becomes a host to ping.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.