Nagios通過SNMP檢查網卡流量
Nagios 通過SNMP檢查網卡流量：
google一下snmp的漏洞,避免下載到未打補丁的版本
Net-SNMP遠程繞過認證漏洞
受影響系統：
Net-SNMP net-snmp 5.4.x
Net-SNMP net-snmp 5.3.x
Net-SNMP net-snmp 5.2.x
不受影響系統：
Net-SNMP net-snmp 5.4.1.1
Net-SNMP net-snmp 5.3.2.1
Net-SNMP net-snmp 5.2.4.1
檢查有無安裝snmp
rpm -qa|grep snmp
下載net-snmp
安裝snmp
rpm -ivh net-snmp-*.rpm
error: Failed dependencies:
libc.so.6(GLIBC_2.4) is needed by net-snmp-5.4.2.1-1.i386
libc.so.6(GLIBC_2.7) is needed by net-snmp-5.4.2.1-1.i386
librpm-4.4.so is needed by net-snmp-5.4.2.1-1.i386
librpmio-4.4.so is needed by net-snmp-5.4.2.1-1.i386
檢查glib版本
rpm -qa | grep glibc
glibc-2.3.4-2
glibc-common-2.3.4-2
glibc-kernheaders-2.4-9.1.87
glibc-devel-2.3.4-2
glibc-headers-2.3.4-2
glibc升級風險比較大，改用soure編譯
先安裝beecrypt
wget http://downloads.sourceforge.net/beecrypt/beecrypt-4.1.2.tar.gz
tar zxvf beecrypt-4.1.2.tar.gz
cd beecrypt-4.1.2
./configure --prefix=/usr
make
_bc-py.c:8:20: Python.h: No such file or directory
rpm -qa|grep python
rpm-python-4.3.3-18_nonptl
gnome-python2-bonobo-2.6.0-3
python-2.3.4-14.2
libxml2-python-2.6.16-6
python-elementtree-1.2.6-4.2.1
python-sqlite-1.1.7-1.2
gnome-python2-2.6.0-3
gnome-python2-canvas-2.6.0-3
mod_python-3.1.3-5.1
dbus-python-0.22-12.EL.7
MySQL-python-1.0.0-1.RHEL4.1
python-urlgrabber-2.9.8-2
沒有python-devel,升級下python
http://blog.c1gstudio.com/archives/588
重新make
make
make install
更新動態庫
ldconfig -v
ln -s /lib/libelf.so.1 /usr/lib/libelf.so
安裝net-snmp
wget http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.4.2.1.tar.gz
tar zxvf net-snmp-5.4.2.1.tar.gz
cd net-snmp-5.4.2.1
./configure -enable-mfd-rewrites -with-default-snmp-version="2" -with-sys-contact="admin" -with-sys-location="China" -with-logfile="/var/log/snmpd.log" -with-persistent-directory="/var/net-snmp"
編譯的輸出
SNMP Versions Supported: 1 2c 3
Net-SNMP Version: 5.4.2.1
Building for: linux
Network transport support: Callback Unix TCP UDP
SNMPv3 Security Modules: usm
Agent MIB code: default_modules => snmpv3mibs mibII ucd_snmp notification notification-log-mib target agent_mibs agentx disman/event disman/schedule utilities host
Embedded Perl support: enabled
SNMP Perl modules: building -- embeddable
SNMP Python modules: disabled
Authentication support: MD5 SHA1
Encryption support: DES AES
make
安裝出錯
grep: /usr/lib/libbeecrypt.la: No such file or directory
/bin/sed: can't read /usr/lib/libbeecrypt.la: No such file or directory
libtool: link: `/usr/lib/libbeecrypt.la' is not a valid libtool archive
#請安裝beecrypt
/usr/bin/ld: cannot find -lelf
collect2: ld returned 1 exit status
#ln -s libelf.so.1 /usr/lib/libelf.so
make install
ldconfig -v
community string
網絡設備在使用SNMP中都設有community string，它類似于簡單的口令驗證機制，用來確認是否具有可讀或讀寫的權限。許多用戶在購買設備以來，從未修改系統缺省的community string，因此非授權用戶使用缺省口令就可以對重要的系統信息、設備的狀態等進行修改。
將"COMMUNITY"字段改為你要設置的密碼.比如"public"或privatepass.
將“localhost”改為你想哪臺機器可以看到你的snmp信息,如localhost或10.10.10.10。
SNMP的版本
在SNMP協議得益于重大升級，因為在1988年推出。
不幸的是，很大比例的網絡內容供應商，甚至一些網絡管理系統廠商都沒有利用這些改進。
許多網絡元素只支持SNMPv1和SNMPv2c 。 支持SNMPv3的是最小的。
版本描述
SNMPv1 SNMPv1 ，其中實施以社區為基礎的安全
SNMPv2c SNMPv2以社區為基礎的安全
SNMPv2u SNMPv2與基于用戶的安全
SNMPv2 SNMPv2黨為基礎的安全
SNMPv3安全機制 SNMPv3安全機制，而實現基于用戶的安全
配置snmp
- mkdir /usr/local/etc/snmp
- cp EXAMPLE.conf /usr/local/etc/snmp/snmpd.conf
- vi usr/local/etc/snmp/snmpd.conf
- # sec.name source community
- com2sec local localhost privatepass
- #com2sec mynetwork NETWORK/24 public
- ####
- # Second, map the security names into group names:
- # sec.model sec.name
- #group MyRWGroup v1 local
- #group MyRWGroup v2c local
- #group MyRWGroup usm local
- #group MyROGroup v1 mynetwork
- #group MyROGroup v2c mynetwork
- #group MyROGroup usm mynetwork
- group MyROGroup v1 local
- group MyROGroup v2c local
- ####
- # Third, create a view for us to let the groups have rights to:
- # incl/excl subtree mask
- #view all included .1 80
- view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc
- ####
- # Finally, grant the 2 groups access to the 1 view with different
- # write permissions:
- # context sec.model sec.level match read write notif
- access MyROGroup "" any noauth exact mib2 none none
- #access MyRWGroup "" any noauth exact all all none
- #啟動
- /usr/local/sbin/snmpd
- #加入啟動
- echo '/usr/local/sbin/snmpd' >> /etc/rc.local
- #查看161端口是否開啟
- netstat -ano|grep 161
- #測試
- snmpwalk -v 1 -c privatepass localhost system
- SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost.localdomain 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686
- SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
- DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (2612) 0:00:26.12
- SNMPv2-MIB::sysContact.0 = STRING: Me
- SNMPv2-MIB::sysName.0 = STRING: localhost.localdomain
- SNMPv2-MIB::sysLocation.0 = STRING: Right here, right now.
- SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
- SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance
- SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
- SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB
- SNMPv2-MIB::sysORID.5 = OID: TCP-MIB::tcpMIB
- SNMPv2-MIB::sysORID.6 = OID: IP-MIB::ip
- SNMPv2-MIB::sysORID.7 = OID: UDP-MIB::udpMIB
- SNMPv2-MIB::sysORID.8 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
- SNMPv2-MIB::sysORDescr.1 = STRING: The SNMP Management Architecture MIB.
- SNMPv2-MIB::sysORDescr.2 = STRING: The MIB for Message Processing and Dispatching.
- SNMPv2-MIB::sysORDescr.3 = STRING: The management information definitions for the SNMP User-based Security Model.
- SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for SNMPv2 entities
- SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing TCP implementations
- SNMPv2-MIB::sysORDescr.6 = STRING: The MIB module for managing IP and ICMP implementations
- SNMPv2-MIB::sysORDescr.7 = STRING: The MIB module for managing UDP implementations
- SNMPv2-MIB::sysORDescr.8 = STRING: View-based Access Control Model for SNMP.
- SNMPv2-MIB::sysORUpTime.1 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.2 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.3 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.4 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.5 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.6 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.7 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.8 = Timeticks: (0) 0:00:00.00
snmp安裝完畢
安裝check_traffic腳本
下載check_traffic_v1.1.6.zip腳本
上傳./check_traffic.sh 至/usr/local/nagios/libexec
cd /usr/local/nagios/libexec/
chown nagios:nagios ./check_traffic.sh
chmod 755 ./check_traffic.sh
用 -L選項列出對應主機所有的interface，來確定你要監控的網絡接口(如果能你確認接口的index值，這一步可以省略)。
通過輸出，我們確認要監控的網絡接口為4，對應為"Macronix MX98715-Based Ethernet Adapter (Generic) - 數據包計劃程序微型端口"
./check_traffic.sh -V 2c -C privatepass -H localhost -L
List Interface for host localhost.
Interface index 1 orresponding to lo
Interface index 2 orresponding to eth0
Interface index 3 orresponding to eth1
Interface index 4 orresponding to sit0
按照說明，選擇版本為2c(一般選擇1或者2c)，community為privatepass，interface為2，單位為KB/s，in流量對應warning/critical值為200/400，out流量對應warning/critical值為300/500.
sudo -u nagios ./check_traffic.sh -V 2c -C privatepass -H localhost -I 2 -w12,30 -c15,50 -K -b
Can not found data in the history data file.
If it's the first time for this plugins, that's OK.
Otherwise,please use debug mode and check the debug file.
第一次執行，因為history data file不存在，因此會由此提示，可以忽略。
如果每次執行都忽略，則要檢查/var/tmp下是否有/var/tmp/check_traffic_${Host}_${Interface}.hist_dat文件生成。
文件的內容是系統當前的時間，in及out當前的數值。
nagios監控本機的配置
修改/usr/local/nagios/etc/objects/commands.cfg，增下以下內容
- define command{
- command_name check_traffic_nv
- command_line $USER1$/check_traffic.sh -V 2c -C privatepass -H localhost -I $ARG1$ -w $ARG2$ -c $ARG3$ -M -b
- }
修改/usr/local/nagios/etc/objects/localhost.cfg，增下以下內容
- define service{
- use local-service,srv-pnp ; Name of service template to use
- host_name nagios
- service_description check_nv_traffic_eth0
- check_command check_traffic_nv!2!12,30!15,35
- notifications_enabled 0
- normal_check_interval 5 ;5分鐘
- retry_interval 1 ;1分鐘
- }
nagios監控遠程機的配置
修改/usr/local/nagios/etc/objects/remotehost.cfg，增下以下內容
- define service{
- use local-service,srv-pnp ; Name of service template to use
- host_name nagios
- service_description check_nv_traffic_eth0
- check_command check_nrpe!check_traffic_nv
- notifications_enabled 0
- normal_check_interval 5 ;5分鐘
- retry_interval 1 ;1分鐘
- }
修改/usr/local/nagios/etc/nrpe.cfg增加以下內容
- command[check_traffic_nv]=/usr/local/nagios/libexec/check_traffic_nv.sh -V 2c -C privatepass -H localhost -I 2 -w 12,30 -c 15,35 -M -b
訪問http://localhost/nagios
點擊Service Detail
點擊check_nv_traffic_eth0服務旁的小太陽
等5分鐘后就可以看到圖表
which: no snmpwalk in (/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin)
如果check_nv_traffic_eth0服務報找不到snmpwalk.
ln -s /usr/local/bin/snmpwalk /usr/bin/snmpwalk
有時我作的軟鏈接會丟失,挺奇怪的...
【編輯推薦】
