1) Install a minimal 64-bit Debian 9 Stretch. Create a regular user "toor".
2) # Make sure CD-ROM is commented out in "/etc/apt/sources.list", and that you have configured an official Debian mirror there. Also make sure "contrib" is configured to your Debian mirror. As root:
apt-get -y update
apt-get -y upgrade
apt-get -y install net-tools openssh-server openssh-client
3) cp -p /etc/network/interfaces /etc/network/interfaces.orig
vi /etc/network/interfaces # Have the following contents. You may modify the contents if necessary.
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp3s0
#iface enp3s0 inet dhcp
iface enp3s0 inet static
address 192.168.1.160
netmask 255.255.255.0
gateway 192.168.1.1
5) shutdown -r now # After this, you may now access the Nagios machine remotely via SSH. The following steps assume that you will access the Nagios machine remotely via SSH.
6) ssh [email protected]
su -
7) cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
vi /etc/ssh/sshd_config # Make sure the following is set:
Port 1015
ListenAddress 0.0.0.0
8) systemctl restart ssh.service
exit
exit # Here, you should disconnect your SSH session.
9) ssh -p 1015 [email protected]
su -
10) apt-get -y install firewalld
# Reference: https://linode.com/docs/security/firewalls/introduction-to-firewalld-on-centos/
ifconfig -a # Determine your interface name.
systemctl status firewalld.service
firewall-cmd --get-default-zone
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all
firewall-cmd --zone=public --add-interface=enp3s0 --permanent # Substitute interface if necessary.

# Substitute the "192.168.1.161" IP address in the next command with the IP address you are using for your SSH client:
firewall-cmd --permanent --zone=public --add-rich-rule='
rule family="ipv4"
source address="192.168.1.161/32"
port protocol="tcp" port="1015" accept'

firewall-cmd --zone=public --remove-service=ssh --permanent
firewall-cmd --zone=public --remove-service=dhcpv6-client --permanent
firewall-cmd --reload
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all
11) # Reference: https://www.tecmint.com/install-nagios-core-in-ubuntu-and-debian/
apt-get -y install apache2 libapache2-mod-php7.0 php7.0
apt-get -y install wget unzip zip autoconf gcc libc6 make apache2-utils libgd-dev
useradd nagios
usermod -a -G nagios www-data
wget --no-check-certificate https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.3.4.tar.gz
tar xzf nagios-4.3.4.tar.gz
cd nagios-4.3.4/
./configure --with-httpd-conf=/etc/apache2/sites-enabled
make all
make install
make install-init
make install-commandmode
systemctl enable nagios.service
make install-config
make install-webconf
htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin # Set a password for Nagios user "nagiosadmin".
a2enmod cgi
systemctl restart apache2
systemctl start nagios
systemctl enable nagios
apt-get -y remove autoconf gcc make libgd-dev

# Substitute the "192.168.1.161" IP address in the next command with the IP address you are using for your SSH client:
firewall-cmd --permanent --zone=public --add-rich-rule='
rule family="ipv4"
source address="192.168.1.161/32"
port protocol="tcp" port="80" accept'
firewall-cmd --reload
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all

mkdir /var/www/archive
mv /var/www/html/index.html /var/www/archive
touch /var/www/html/index.html
# You should be able to load Nagios in a web browser now. Use "nagiosadmin" for the User Name, and use the password you've given above: http://IP-Address/nagios

Install Plugins (NRPE and Nagios) in Debian
#Reference: https://www.itzgeek.com/how-tos/linux/centos-how-tos/monitor-remote-linux-system-with-nagios-3.html
# BELOW IS FOR CLIENT NRPE
apt-get install -y nagios-nrpe-server nagios-plugins
cp -p /etc/nagios/nrpe.cfg /etc/nagios/nrpe.cfg.orig

vi /etc/nagios/nrpe.cfg # Configure NRPE. You may want to edit "allowed_hosts", and add check_root and check_swap.
allowed_hosts=127.0.0.1,192.168.1.160
...
command[check_root]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /
command[check_swap]=/usr/lib/nagios/plugins/check_swap -w 20% -c 10%

systemctl restart nagios-nrpe-server.service

# Substitute the "192.168.1.160" IP address in the next command with the IP address of your Nagios server.
firewall-cmd --permanent --zone=public --add-rich-rule='
rule family="ipv4"
source address="192.168.1.160/32"
port protocol="tcp" port="5666" accept'
firewall-cmd --reload
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all

# BELOW IS FOR SERVER NRPE
apt-get -y install nagios-nrpe-plugin nagios-plugins
mv /usr/local/nagios/libexec /usr/local/nagios/libexec.orig
ln -sf /usr/lib/nagios/plugins /usr/local/nagios/libexec
cp -p /usr/local/nagios/etc/nagios.cfg /usr/local/nagios/etc/nagios.cfg.orig

vi /usr/local/nagios/etc/nagios.cfg #Uncomment the following line:
cfg_dir=/usr/local/nagios/etc/servers

mkdir /usr/local/nagios/etc/servers
cp -p /usr/local/nagios/etc/objects/commands.cfg /usr/local/nagios/etc/objects/commands.cfg.orig
vi /usr/local/nagios/etc/objects/commands.cfg #Append the following Nagios command definition to the file.
# .check_nrpe. command definition
define command{
command_name check_nrpe
command_line /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -t 30 -c $ARG1$
}

# Add a Linux host to Nagios server:
vi /usr/local/nagios/etc/servers/testhost.cfg
define host{
use linux-server
host_name host.domain
alias host.domain
address 192.168.1.20
}

define hostgroup{
hostgroup_name linux-server
alias Linux Servers
members host.domain
}

define service{
use local-service
host_name host.domain
service_description SWAP Uasge
check_command check_nrpe!check_swap
}

define service{
use local-service
host_name host.domain
service_description Root / Partition
check_command check_nrpe!check_root
}

define service{
use local-service
host_name host.domain
service_description Current Users
check_command check_nrpe!check_users
}

define service{
use local-service
host_name host.domain
service_description Total Processes
check_command check_nrpe!check_total_procs
}

define service{
use local-service
host_name host.domain
service_description Current Load
check_command check_nrpe!check_load
}

/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg # Verify configuration for errors.
systemctl restart nagios.service

To Enable Apache HTTPS
# Reference: https://www.tecmint.com/install-nagios-core-in-ubuntu-and-debian/
1) a2enmod ssl
a2ensite default-ssl.conf
a2enmod rewrite
systemctl restart apache2.service
cp -p /etc/apache2/sites-enabled/000-default.conf /etc/apache2/sites-enabled/000-default.conf.orig

vi /etc/apache2/sites-enabled/000-default.conf #add the following block of code after DocumentRoot
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{HTTP_HOST}/$1

systemctl restart apache2.service

# Substitute the "192.168.1.161" IP address in the next command with the IP address you are using for your SSH client:
firewall-cmd --permanent --zone=public --add-rich-rule='
rule family="ipv4"
source address="192.168.1.161/32"
port protocol="tcp" port="443" accept'
firewall-cmd --reload
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all

For SMS notifications:
# Reference: https://beebazz.wordpress.com/2014/03/14/implementation-sms-gateway-send-sms-alerts-nagios-core/
1) # Execute the following steps in the Nagios server.
2) apt-get -y install gammu sudo
gammu-detect # This is to check if Gammu can see your SMS modem/device.
gammu-config # Configure your Gammu SMS modem/device. I use a Huawei E220. "Port" for this is "/dev/ttyUSB0". I use "at115200" for "Connection". I use "at" for "Model". I use "/var/log/gammu.log" for "Log file". I use "textalldate" for "Log format". I use" "yes" for "Use locking".
gammu identify # This is for checking your configuration.
echo "test sms to admin" | gammu sendsms text +6285747015*** # Send a test SMS. Substitute a desired destination phone number for your SMS.
3) cp -p /usr/local/nagios/etc/objects/commands.cfg /usr/local/nagios/etc/objects/commands.cfg.orig
vi /usr/local/nagios/etc/objects/commands.cfg # Define following commands:
define command {
command_name notify-host-by-sms
command_line /usr/bin/printf "%b" "Nagios host alert: $HOSTNAME$ is $HOSTSTATE$" | sudo /usr/bin/gammu sendsms TEXT $CONTACTPAGER$
}
define command {
command_name notify-service-by-sms
command_line /usr/bin/printf "%b" "Nagios service alert: $SERVICEDESC$ on $HOSTNAME$ is $SERVICESTATE$" | sudo /usr/bin/gammu sendsms TEXT $CONTACTPAGER$
}

4) cp -p /usr/local/nagios/etc/objects/contacts.cfg /usr/local/nagios/etc/objects/contacts.cfg.orig
vi /usr/local/nagios/etc/objects/contacts.cfg # Add "pager" to contacts. For example:
define contact {
contact_name nagiosadmin
use generic-contact
alias Nagios Admin
email [email protected]
pager +628574791241
}

5) cp -p templates.cfg templates.cfg.orig
vi /usr/local/nagios/etc/objects/templates.cfg # Modify contact to something like the following:

define contact{
name generic-contact ; The name of this contact template
service_notification_period 24x7 ; service notifications can be sent anytime
host_notification_period 24x7 ; host notifications can be sent anytime
service_notification_options w,u,c,r,f,s ; send notifications for all service states, flapping events, and scheduled downtime events
host_notification_options d,u,r,f,s ; send notifications for all host states, flapping events, and scheduled downtime events
service_notification_commands notify-service-by-email, notify-service-by-sms ; send service notifications via email
host_notification_commands notify-host-by-email, notify-host-by-sms ; send host notifications via email
register 0 ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL CONTACT, JUST A TEMPLATE!
}

6) visudo # Have the following added:
# nagios
nagios ALL=(root) NOPASSWD: /usr/bin/gammu

For E-mail notifications with Google Mail:
apt-get -y install heirloom-mailx
To test: echo "This is the message body and contains the message" | heirloom-mailx -v -r "[email protected]" -s "This is the subject" -S smtp="mail.example.com:587" -S smtp-use-starttls -S smtp-auth=login -S smtp-auth-user="[email protected]" -S smtp-auth-password="abc123" -S ssl-verify=ignore [email protected]
To test Gmail: echo "This is the message body and contains the message" | heirloom-mailx -v -r "[email protected]" -s "This is the subject" -S smtp="smtp.gmail.com:587" -S smtp-use-starttls -S smtp-auth=login -S smtp-auth-user="[email protected]" -S smtp-auth-password="substitute-your-gmail-password-here" -S ssl-verify=ignore [email protected]
vi /usr/local/nagios/etc/objects/commands.cfg
# Modify command_line of notify-host-by-email to something like the following:
/usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" | /usr/bin/heirloom-mailx -s "** $NOTIFICATIONTYPE$ Host Alert: $HOSTNAME$ is $HOSTSTATE$ **" -S smtp="smtp.gmail.com:587" -S smtp-use-starttls -S smtp-auth=login -S smtp-auth-user="[email protected]" -S smtp-auth-password="substitute-your-gmail-password-here" -S ssl-verify=ignore $CONTACTEMAIL$
# Modify command_line of notify-service-by-email to something like the following:
/usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $HOSTALIAS$\nAddress: $HOSTADDRESS$\nState: $SERVICESTATE$\n\nDate/Time: $LONGDATETIME$\n\nAdditional Info:\n\n$SERVICEOUTPUT$\n" | /usr/bin/heirloom-mailx -s "** $NOTIFICATIONTYPE$ Service Alert: $HOSTALIAS$/$SERVICEDESC$ is $SERVICESTATE$ **" -S smtp="smtp.gmail.com:587" -S smtp-use-starttls -S smtp-auth=login -S smtp-auth-user="[email protected]" -S smtp-auth-password="substitute-your-gmail-password-here" -S ssl-verify=ignore $CONTACTEMAIL$
systemctl restart nagios.service

To disable flap detection:
vi /usr/local/nagios/etc/nagios.cfg # Make sure the following is defined:
enable_flap_detection=0