Nagios 通过snmp检查网卡流量

google一下snmp的漏洞,避免下载到未打补丁的版本

Net-SNMP远程绕过认证漏洞 受影响系统： Net-SNMP net-snmp 5.4.x Net-SNMP net-snmp 5.3.x Net-SNMP net-snmp 5.2.x

不受影响系统： Net-SNMP net-snmp 5.4.1.1 Net-SNMP net-snmp 5.3.2.1 Net-SNMP net-snmp 5.2.4.1

检查有无安装snmp

rpm -qa|grep snmp

下载net-snmp http://www.net-snmp.org/download.html http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.4.2.1-1.f9.i386.rpm http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-devel-5.4.2.1-1.f9.i386.rpm http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-perlmods-5.4.2.1-1.f9.i386.rpm

安装snmp

rpm -ivh net-snmp-*.rpm

error: Failed dependencies: libc.so.6(GLIBC_2.4) is needed by net-snmp-5.4.2.1-1.i386 libc.so.6(GLIBC_2.7) is needed by net-snmp-5.4.2.1-1.i386 librpm-4.4.so is needed by net-snmp-5.4.2.1-1.i386 librpmio-4.4.so is needed by net-snmp-5.4.2.1-1.i386

检查glib版本

rpm -qa | grep glibc

glibc-2.3.4-2 glibc-common-2.3.4-2 glibc-kernheaders-2.4-9.1.87 glibc-devel-2.3.4-2 glibc-headers-2.3.4-2

glibc升级风险比较大，改用soure编译

先安装beecrypt

wget http://downloads.sourceforge.net/beecrypt/beecrypt-4.1.2.tar.gz tar zxvf beecrypt-4.1.2.tar.gz cd beecrypt-4.1.2 ./configure –prefix=/usr make

_bc-py.c:8:20: Python.h: No such file or directory

rpm -qa|grep python

rpm-python-4.3.3-18_nonptl gnome-python2-bonobo-2.6.0-3 python-2.3.4-14.2 libxml2-python-2.6.16-6 python-elementtree-1.2.6-4.2.1 python-sqlite-1.1.7-1.2 gnome-python2-2.6.0-3 gnome-python2-canvas-2.6.0-3 mod_python-3.1.3-5.1 dbus-python-0.22-12.EL.7 MySQL-python-1.0.0-1.RHEL4.1 python-urlgrabber-2.9.8-2

没有python-devel,升级下python https://blog.c1gstudio.com/archives/588

重新make make make install

更新动态库

ldconfig -v ln -s /lib/libelf.so.1 /usr/lib/libelf.so

安装net-snmp

wget http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.4.2.1.tar.gz tar zxvf net-snmp-5.4.2.1.tar.gz cd net-snmp-5.4.2.1 ./configure -enable-mfd-rewrites -with-default-snmp-version=”2″ -with-sys-contact=”admin” -with-sys-location=”China” -with-logfile=”/var/log/snmpd.log” -with-persistent-directory=”/var/net-snmp”

编译的输出

SNMP Versions Supported: 1 2c 3 Net-SNMP Version: 5.4.2.1 Building for: linux Network transport support: Callback Unix TCP UDP SNMPv3 Security Modules: usm Agent MIB code: default_modules => snmpv3mibs mibII ucd_snmp notification notification-log-mib target agent_mibs agentx disman/event disman/schedule utilities host Embedded Perl support: enabled SNMP Perl modules: building — embeddable SNMP Python modules: disabled Authentication support: MD5 SHA1 Encryption support: DES AES make

安装出错

grep: /usr/lib/libbeecrypt.la: No such file or directory /bin/sed: can’t read /usr/lib/libbeecrypt.la: No such file or directory libtool: link: `/usr/lib/libbeecrypt.la’ is not a valid libtool archive #请安装beecrypt /usr/bin/ld: cannot find -lelf collect2: ld returned 1 exit status #ln -s libelf.so.1 /usr/lib/libelf.so make install ldconfig -v

community string 网络设备在使用SNMP中都设有community string，它类似于简单的口令验证机制，用来确认是否具有可读或读写的权限。许多用户在购买设备以来，从未修改系统缺省的community string，因此非授权用户使用缺省口令就可以对重要的系统信息、设备的状态等进行修改。 将”COMMUNITY”字段改为你要设置的密码.比如”public”或privatepass. 将“localhost”改为你想哪台机器可以看到你的snmp信息,如localhost或10.10.10.10。

SNMP的版本 在SNMP协议得益于重大升级，因为在1988年推出。 不幸的是，很大比例的网络内容供应商，甚至一些网络管理系统厂商都没有利用这些改进。 许多网络元素只支持SNMPv1和SNMPv2c 。 支持SNMPv3的是最小的。 版本 描述 SNMPv1 SNMPv1 ，其中实施以社区为基础的安全 SNMPv2c SNMPv2以社区为基础的安全 SNMPv2u SNMPv2与基于用户的安全 SNMPv2 SNMPv2党为基础的安全 SNMPv3安全机制 SNMPv3安全机制，而实现基于用户的安全

配置snmp

mkdir /usr/local/etc/snmp cp EXAMPLE.conf /usr/local/etc/snmp/snmpd.conf vi usr/local/etc/snmp/snmpd.conf # sec.name source community com2sec local localhost privatepass #com2sec mynetwork NETWORK/24 public #### # Second, map the security names into group names: # sec.model sec.name #group MyRWGroup v1 local #group MyRWGroup v2c local #group MyRWGroup usm local #group MyROGroup v1 mynetwork #group MyROGroup v2c mynetwork #group MyROGroup usm mynetwork group MyROGroup v1 local group MyROGroup v2c local #### # Third, create a view for us to let the groups have rights to: # incl/excl subtree mask #view all included .1 80 view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc #### # Finally, grant the 2 groups access to the 1 view with different # write permissions: # context sec.model sec.level match read write notif access MyROGroup “” any noauth exact mib2 none none #access MyRWGroup “” any noauth exact all all none

 

#启动 /usr/local/sbin/snmpd #加入启动 echo ‘/usr/local/sbin/snmpd’ >> /etc/rc.local #查看161端口是否开启 netstat -ano|grep 161 #测试 snmpwalk -v 1 -c privatepass localhost system

SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost.localdomain 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (2612) 0:00:26.12 SNMPv2-MIB::sysContact.0 = STRING: Me SNMPv2-MIB::sysName.0 = STRING: localhost.localdomain SNMPv2-MIB::sysLocation.0 = STRING: Right here, right now. SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB SNMPv2-MIB::sysORID.5 = OID: TCP-MIB::tcpMIB SNMPv2-MIB::sysORID.6 = OID: IP-MIB::ip SNMPv2-MIB::sysORID.7 = OID: UDP-MIB::udpMIB SNMPv2-MIB::sysORID.8 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup SNMPv2-MIB::sysORDescr.1 = STRING: The SNMP Management Architecture MIB. SNMPv2-MIB::sysORDescr.2 = STRING: The MIB for Message Processing and Dispatching. SNMPv2-MIB::sysORDescr.3 = STRING: The management information definitions for the SNMP User-based Security Model. SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for SNMPv2 entities SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing TCP implementations SNMPv2-MIB::sysORDescr.6 = STRING: The MIB module for managing IP and ICMP implementations SNMPv2-MIB::sysORDescr.7 = STRING: The MIB module for managing UDP implementations SNMPv2-MIB::sysORDescr.8 = STRING: View-based Access Control Model for SNMP. SNMPv2-MIB::sysORUpTime.1 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.2 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.3 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.4 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.5 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.6 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.7 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.8 = Timeticks: (0) 0:00:00.00

snmp安装完毕

安装check_traffic脚本 下载check_traffic_v1.1.6.zip脚本 http://www.itnms.net/discuz/viewthread.php?tid=767&extra=pageD1&page=1 上传./check_traffic.sh 至/usr/local/nagios/libexec

cd /usr/local/nagios/libexec/ chown nagios:nagios ./check_traffic.sh chmod 755 ./check_traffic.sh

用 -L选项列出对应主机所有的interface，来确定你要监控的网络接口（如果能你确认接口的index值，这一步可以省略）。 通过输出，我们确认要监控的网络接口为4，对应为”Macronix MX98715-Based Ethernet Adapter (Generic) – 数据包计划程序微型端口”

./check_traffic.sh -V 2c -C privatepass -H localhost -L

List Interface for host localhost. Interface index 1 orresponding to lo Interface index 2 orresponding to eth0 Interface index 3 orresponding to eth1 Interface index 4 orresponding to sit0

按照说明，选择版本为2c（一般选择1或者2c），community为privatepass，interface为2，单位为KB/s，in流量对应warning/critical值为200/400，out流量对应warning/critical值为300/500.

sudo -u nagios ./check_traffic.sh -V 2c -C privatepass -H localhost -I 2 -w12,30 -c15,50 -K -b

Can not found data in the history data file. If it’s the first time for this plugins, that’s OK. Otherwise,please use debug mode and check the debug file.

第一次执行，因为history data file不存在，因此会由此提示，可以忽略。 如果每次执行都忽略，则要检查/var/tmp下是否有/var/tmp/checktraffic${Host}_${Interface}.hist_dat文件生成。 文件的内容是系统当前的时间，in及out当前的数值。

nagios监控本机的配置 修改/usr/local/nagios/etc/objects/commands.cfg，增下以下内容

define command{ command_name check_traffic_nv command_line $USER1$/check_traffic.sh -V 2c -C privatepass -H localhost -I $ARG1$ -w $ARG2$ -c $ARG3$ -M -b }

修改/usr/local/nagios/etc/objects/localhost.cfg，增下以下内容

define service{ use local-service,srv-pnp ; Name of service template to use host_name nagios service_description check_nv_traffic_eth0 check_command check_traffic_nv!2!12,30!15,35 notifications_enabled 0 normal_check_interval 5 ;5分钟 retry_interval 1 ;1分钟 }

  nagios监控远程机的配置

修改/usr/local/nagios/etc/objects/remotehost.cfg，增下以下内容

define service{ use local-service,srv-pnp ; Name of service template to use host_name nagios service_description check_nv_traffic_eth0 check_command check_nrpe!check_traffic_nv notifications_enabled 0 normal_check_interval 5 ;5分钟 retry_interval 1 ;1分钟 }

修改/usr/local/nagios/etc/nrpe.cfg增加以下内容

command[check_traffic_nv]=/usr/local/nagios/libexec/check_traffic_nv.sh -V 2c -C privatepass -H localhost -I 2 -w 12,30 -c 15,35 -M -b

访问http://localhost/nagios 点击Service Detail 点击check_nv_traffic_eth0服务旁的小太阳 等5分钟后就可以看到图表

which: no snmpwalk in (/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin) 如果check_nv_traffic_eth0服务报找不到snmpwalk.

ln -s /usr/local/bin/snmpwalk /usr/bin/snmpwalk

有时我作的软链接会丢失,挺奇怪的。。。

===================== 2014-09-24更新 固定网卡顺序 https://blog.c1gstudio.com/archives/1703