Nagios通過(guò)SNMP檢查網(wǎng)卡流量
Nagios 通過(guò)SNMP檢查網(wǎng)卡流量：
google一下snmp的漏洞,避免下載到未打補(bǔ)丁的版本
Net-SNMP遠(yuǎn)程繞過(guò)認(rèn)證漏洞
受影響系統(tǒng)：
Net-SNMP net-snmp 5.4.x
Net-SNMP net-snmp 5.3.x
Net-SNMP net-snmp 5.2.x
不受影響系統(tǒng)：
Net-SNMP net-snmp 5.4.1.1
Net-SNMP net-snmp 5.3.2.1
Net-SNMP net-snmp 5.2.4.1
檢查有無(wú)安裝snmp
rpm -qa|grep snmp
下載net-snmp
安裝snmp
rpm -ivh net-snmp-*.rpm
error: Failed dependencies:
libc.so.6(GLIBC_2.4) is needed by net-snmp-5.4.2.1-1.i386
libc.so.6(GLIBC_2.7) is needed by net-snmp-5.4.2.1-1.i386
librpm-4.4.so is needed by net-snmp-5.4.2.1-1.i386
librpmio-4.4.so is needed by net-snmp-5.4.2.1-1.i386
檢查glib版本
rpm -qa | grep glibc
glibc-2.3.4-2
glibc-common-2.3.4-2
glibc-kernheaders-2.4-9.1.87
glibc-devel-2.3.4-2
glibc-headers-2.3.4-2
glibc升級(jí)風(fēng)險(xiǎn)比較大，改用soure編譯
先安裝beecrypt
wget http://downloads.sourceforge.net/beecrypt/beecrypt-4.1.2.tar.gz
tar zxvf beecrypt-4.1.2.tar.gz
cd beecrypt-4.1.2
./configure --prefix=/usr
make
_bc-py.c:8:20: Python.h: No such file or directory
rpm -qa|grep python
rpm-python-4.3.3-18_nonptl
gnome-python2-bonobo-2.6.0-3
python-2.3.4-14.2
libxml2-python-2.6.16-6
python-elementtree-1.2.6-4.2.1
python-sqlite-1.1.7-1.2
gnome-python2-2.6.0-3
gnome-python2-canvas-2.6.0-3
mod_python-3.1.3-5.1
dbus-python-0.22-12.EL.7
MySQL-python-1.0.0-1.RHEL4.1
python-urlgrabber-2.9.8-2
沒(méi)有python-devel,升級(jí)下python
http://blog.c1gstudio.com/archives/588
重新make
make
make install
更新動(dòng)態(tài)庫(kù)
ldconfig -v
ln -s /lib/libelf.so.1 /usr/lib/libelf.so
安裝net-snmp
wget http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.4.2.1.tar.gz
tar zxvf net-snmp-5.4.2.1.tar.gz
cd net-snmp-5.4.2.1
./configure -enable-mfd-rewrites -with-default-snmp-version="2" -with-sys-contact="admin" -with-sys-location="China" -with-logfile="/var/log/snmpd.log" -with-persistent-directory="/var/net-snmp"
編譯的輸出
SNMP Versions Supported: 1 2c 3
Net-SNMP Version: 5.4.2.1
Building for: linux
Network transport support: Callback Unix TCP UDP
SNMPv3 Security Modules: usm
Agent MIB code: default_modules => snmpv3mibs mibII ucd_snmp notification notification-log-mib target agent_mibs agentx disman/event disman/schedule utilities host
Embedded Perl support: enabled
SNMP Perl modules: building -- embeddable
SNMP Python modules: disabled
Authentication support: MD5 SHA1
Encryption support: DES AES
make
安裝出錯(cuò)
grep: /usr/lib/libbeecrypt.la: No such file or directory
/bin/sed: can't read /usr/lib/libbeecrypt.la: No such file or directory
libtool: link: `/usr/lib/libbeecrypt.la' is not a valid libtool archive
#請(qǐng)安裝beecrypt
/usr/bin/ld: cannot find -lelf
collect2: ld returned 1 exit status
#ln -s libelf.so.1 /usr/lib/libelf.so
make install
ldconfig -v
community string
網(wǎng)絡(luò)設(shè)備在使用SNMP中都設(shè)有community string，它類(lèi)似于簡(jiǎn)單的口令驗(yàn)證機(jī)制，用來(lái)確認(rèn)是否具有可讀或讀寫(xiě)的權(quán)限。許多用戶(hù)在購(gòu)買(mǎi)設(shè)備以來(lái)，從未修改系統(tǒng)缺省的community string，因此非授權(quán)用戶(hù)使用缺省口令就可以對(duì)重要的系統(tǒng)信息、設(shè)備的狀態(tài)等進(jìn)行修改。
將"COMMUNITY"字段改為你要設(shè)置的密碼.比如"public"或privatepass.
將“l(fā)ocalhost”改為你想哪臺(tái)機(jī)器可以看到你的snmp信息,如localhost或10.10.10.10。
SNMP的版本
在SNMP協(xié)議得益于重大升級(jí)，因?yàn)樵?988年推出。
不幸的是，很大比例的網(wǎng)絡(luò)內(nèi)容供應(yīng)商，甚至一些網(wǎng)絡(luò)管理系統(tǒng)廠商都沒(méi)有利用這些改進(jìn)。
許多網(wǎng)絡(luò)元素只支持SNMPv1和SNMPv2c 。 支持SNMPv3的是最小的。
版本描述
SNMPv1 SNMPv1 ，其中實(shí)施以社區(qū)為基礎(chǔ)的安全
SNMPv2c SNMPv2以社區(qū)為基礎(chǔ)的安全
SNMPv2u SNMPv2與基于用戶(hù)的安全
SNMPv2 SNMPv2黨為基礎(chǔ)的安全
SNMPv3安全機(jī)制 SNMPv3安全機(jī)制，而實(shí)現(xiàn)基于用戶(hù)的安全
配置snmp
- mkdir /usr/local/etc/snmp
- cp EXAMPLE.conf /usr/local/etc/snmp/snmpd.conf
- vi usr/local/etc/snmp/snmpd.conf
- # sec.name source community
- com2sec local localhost privatepass
- #com2sec mynetwork NETWORK/24 public
- ####
- # Second, map the security names into group names:
- # sec.model sec.name
- #group MyRWGroup v1 local
- #group MyRWGroup v2c local
- #group MyRWGroup usm local
- #group MyROGroup v1 mynetwork
- #group MyROGroup v2c mynetwork
- #group MyROGroup usm mynetwork
- group MyROGroup v1 local
- group MyROGroup v2c local
- ####
- # Third, create a view for us to let the groups have rights to:
- # incl/excl subtree mask
- #view all included .1 80
- view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc
- ####
- # Finally, grant the 2 groups access to the 1 view with different
- # write permissions:
- # context sec.model sec.level match read write notif
- access MyROGroup "" any noauth exact mib2 none none
- #access MyRWGroup "" any noauth exact all all none
- #啟動(dòng)
- /usr/local/sbin/snmpd
- #加入啟動(dòng)
- echo '/usr/local/sbin/snmpd' >> /etc/rc.local
- #查看161端口是否開(kāi)啟
- netstat -ano|grep 161
- #測(cè)試
- snmpwalk -v 1 -c privatepass localhost system
- SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost.localdomain 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686
- SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
- DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (2612) 0:00:26.12
- SNMPv2-MIB::sysContact.0 = STRING: Me
- SNMPv2-MIB::sysName.0 = STRING: localhost.localdomain
- SNMPv2-MIB::sysLocation.0 = STRING: Right here, right now.
- SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
- SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance
- SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
- SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB
- SNMPv2-MIB::sysORID.5 = OID: TCP-MIB::tcpMIB
- SNMPv2-MIB::sysORID.6 = OID: IP-MIB::ip
- SNMPv2-MIB::sysORID.7 = OID: UDP-MIB::udpMIB
- SNMPv2-MIB::sysORID.8 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
- SNMPv2-MIB::sysORDescr.1 = STRING: The SNMP Management Architecture MIB.
- SNMPv2-MIB::sysORDescr.2 = STRING: The MIB for Message Processing and Dispatching.
- SNMPv2-MIB::sysORDescr.3 = STRING: The management information definitions for the SNMP User-based Security Model.
- SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for SNMPv2 entities
- SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing TCP implementations
- SNMPv2-MIB::sysORDescr.6 = STRING: The MIB module for managing IP and ICMP implementations
- SNMPv2-MIB::sysORDescr.7 = STRING: The MIB module for managing UDP implementations
- SNMPv2-MIB::sysORDescr.8 = STRING: View-based Access Control Model for SNMP.
- SNMPv2-MIB::sysORUpTime.1 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.2 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.3 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.4 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.5 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.6 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.7 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.8 = Timeticks: (0) 0:00:00.00
snmp安裝完畢
安裝check_traffic腳本
下載check_traffic_v1.1.6.zip腳本
上傳./check_traffic.sh 至/usr/local/nagios/libexec
cd /usr/local/nagios/libexec/
chown nagios:nagios ./check_traffic.sh
chmod 755 ./check_traffic.sh
用 -L選項(xiàng)列出對(duì)應(yīng)主機(jī)所有的interface，來(lái)確定你要監(jiān)控的網(wǎng)絡(luò)接口(如果能你確認(rèn)接口的index值，這一步可以省略)。
通過(guò)輸出，我們確認(rèn)要監(jiān)控的網(wǎng)絡(luò)接口為4，對(duì)應(yīng)為"Macronix MX98715-Based Ethernet Adapter (Generic) - 數(shù)據(jù)包計(jì)劃程序微型端口"
./check_traffic.sh -V 2c -C privatepass -H localhost -L
List Interface for host localhost.
Interface index 1 orresponding to lo
Interface index 2 orresponding to eth0
Interface index 3 orresponding to eth1
Interface index 4 orresponding to sit0
按照說(shuō)明，選擇版本為2c(一般選擇1或者2c)，community為privatepass，interface為2，單位為KB/s，in流量對(duì)應(yīng)warning/critical值為200/400，out流量對(duì)應(yīng)warning/critical值為300/500.
sudo -u nagios ./check_traffic.sh -V 2c -C privatepass -H localhost -I 2 -w12,30 -c15,50 -K -b
Can not found data in the history data file.
If it's the first time for this plugins, that's OK.
Otherwise,please use debug mode and check the debug file.
第一次執(zhí)行，因?yàn)閔istory data file不存在，因此會(huì)由此提示，可以忽略。
如果每次執(zhí)行都忽略，則要檢查/var/tmp下是否有/var/tmp/check_traffic_${Host}_${Interface}.hist_dat文件生成。
文件的內(nèi)容是系統(tǒng)當(dāng)前的時(shí)間，in及out當(dāng)前的數(shù)值。
nagios監(jiān)控本機(jī)的配置
修改/usr/local/nagios/etc/objects/commands.cfg，增下以下內(nèi)容
- define command{
- command_name check_traffic_nv
- command_line $USER1$/check_traffic.sh -V 2c -C privatepass -H localhost -I $ARG1$ -w $ARG2$ -c $ARG3$ -M -b
- }
修改/usr/local/nagios/etc/objects/localhost.cfg，增下以下內(nèi)容
- define service{
- use local-service,srv-pnp ; Name of service template to use
- host_name nagios
- service_description check_nv_traffic_eth0
- check_command check_traffic_nv!2!12,30!15,35
- notifications_enabled 0
- normal_check_interval 5 ;5分鐘
- retry_interval 1 ;1分鐘
- }
nagios監(jiān)控遠(yuǎn)程機(jī)的配置
修改/usr/local/nagios/etc/objects/remotehost.cfg，增下以下內(nèi)容
- define service{
- use local-service,srv-pnp ; Name of service template to use
- host_name nagios
- service_description check_nv_traffic_eth0
- check_command check_nrpe!check_traffic_nv
- notifications_enabled 0
- normal_check_interval 5 ;5分鐘
- retry_interval 1 ;1分鐘
- }
修改/usr/local/nagios/etc/nrpe.cfg增加以下內(nèi)容
- command[check_traffic_nv]=/usr/local/nagios/libexec/check_traffic_nv.sh -V 2c -C privatepass -H localhost -I 2 -w 12,30 -c 15,35 -M -b
訪問(wèn)http://localhost/nagios
點(diǎn)擊Service Detail
點(diǎn)擊check_nv_traffic_eth0服務(wù)旁的小太陽(yáng)
等5分鐘后就可以看到圖表
which: no snmpwalk in (/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin)
如果check_nv_traffic_eth0服務(wù)報(bào)找不到snmpwalk.
ln -s /usr/local/bin/snmpwalk /usr/bin/snmpwalk
有時(shí)我作的軟鏈接會(huì)丟失,挺奇怪的...
【編輯推薦】
