Nagios 通过SNMP检查网卡流量：
google一下snmp的漏洞,避免下载到未打补丁的版本
Net-SNMP远程绕过认证漏洞
受影响系统：
Net-SNMP net-snmp 5.4.x
Net-SNMP net-snmp 5.3.x
Net-SNMP net-snmp 5.2.x
不受影响系统：
Net-SNMP net-snmp 5.4.1.1
Net-SNMP net-snmp 5.3.2.1
Net-SNMP net-snmp 5.2.4.1
检查有无安装snmp
rpm -qa|grep snmp
下载net-snmp
安装snmp
rpm -ivh net-snmp-*.rpm
error: Failed dependencies:
libc.so.6(GLIBC_2.4) is needed by net-snmp-5.4.2.1-1.i386
libc.so.6(GLIBC_2.7) is needed by net-snmp-5.4.2.1-1.i386
librpm-4.4.so is needed by net-snmp-5.4.2.1-1.i386
librpmio-4.4.so is needed by net-snmp-5.4.2.1-1.i386
检查glib版本
rpm -qa | grep glibc
glibc-2.3.4-2
glibc-common-2.3.4-2
glibc-kernheaders-2.4-9.1.87
glibc-devel-2.3.4-2
glibc-headers-2.3.4-2
glibc升级风险比较大，改用soure编译
先安装beecrypt
wget http://downloads.sourceforge.net/beecrypt/beecrypt-4.1.2.tar.gz
tar zxvf beecrypt-4.1.2.tar.gz
cd beecrypt-4.1.2
./configure --prefix=/usr
make
_bc-py.c:8:20: Python.h: No such file or directory
rpm -qa|grep python
rpm-python-4.3.3-18_nonptl
gnome-python2-bonobo-2.6.0-3
python-2.3.4-14.2
libxml2-python-2.6.16-6
python-elementtree-1.2.6-4.2.1
python-sqlite-1.1.7-1.2
gnome-python2-2.6.0-3
gnome-python2-canvas-2.6.0-3
mod_python-3.1.3-5.1
dbus-python-0.22-12.EL.7
MySQL-python-1.0.0-1.RHEL4.1
python-urlgrabber-2.9.8-2
没有python-devel,升级下python
http://blog.c1gstudio.com/archives/588
重新make
make
make install
更新动态库
ldconfig -v
ln -s /lib/libelf.so.1 /usr/lib/libelf.so
安装net-snmp
wget http://nchc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.4.2.1.tar.gz
tar zxvf net-snmp-5.4.2.1.tar.gz
cd net-snmp-5.4.2.1
./configure -enable-mfd-rewrites -with-default-snmp-version="2" -with-sys-contact="admin" -with-sys-location="China" -with-logfile="/var/log/snmpd.log" -with-persistent-directory="/var/net-snmp"
编译的输出
SNMP Versions Supported: 1 2c 3
Net-SNMP Version: 5.4.2.1
Building for: linux
Network transport support: Callback Unix TCP UDP
SNMPv3 Security Modules: usm
Agent MIB code: default_modules => snmpv3mibs mibII ucd_snmp notification notification-log-mib target agent_mibs agentx disman/event disman/schedule utilities host
Embedded Perl support: enabled
SNMP Perl modules: building -- embeddable
SNMP Python modules: disabled
Authentication support: MD5 SHA1
Encryption support: DES AES
make
安装出错
grep: /usr/lib/libbeecrypt.la: No such file or directory
/bin/sed: can't read /usr/lib/libbeecrypt.la: No such file or directory
libtool: link: `/usr/lib/libbeecrypt.la' is not a valid libtool archive
#请安装beecrypt
/usr/bin/ld: cannot find -lelf
collect2: ld returned 1 exit status
#ln -s libelf.so.1 /usr/lib/libelf.so
make install
ldconfig -v
community string
网络设备在使用SNMP中都设有community string，它类似于简单的口令验证机制，用来确认是否具有可读或读写的权限。许多用户在购买设备以来，从未修改系统缺省的community string，因此非授权用户使用缺省口令就可以对重要的系统信息、设备的状态等进行修改。
将"COMMUNITY"字段改为你要设置的密码.比如"public"或privatepass.
将“localhost”改为你想哪台机器可以看到你的snmp信息,如localhost或10.10.10.10。
SNMP的版本
在SNMP协议得益于重大升级，因为在1988年推出。
不幸的是，很大比例的网络内容供应商，甚至一些网络管理系统厂商都没有利用这些改进。
许多网络元素只支持SNMPv1和SNMPv2c 。 支持SNMPv3的是最小的。
版本描述
SNMPv1 SNMPv1 ，其中实施以社区为基础的安全
SNMPv2c SNMPv2以社区为基础的安全
SNMPv2u SNMPv2与基于用户的安全
SNMPv2 SNMPv2党为基础的安全
SNMPv3安全机制 SNMPv3安全机制，而实现基于用户的安全
配置snmp
- mkdir /usr/local/etc/snmp
- cp EXAMPLE.conf /usr/local/etc/snmp/snmpd.conf
- vi usr/local/etc/snmp/snmpd.conf
- # sec.name source community
- com2sec local localhost privatepass
- #com2sec mynetwork NETWORK/24 public
- ####
- # Second, map the security names into group names:
- # sec.model sec.name
- #group MyRWGroup v1 local
- #group MyRWGroup v2c local
- #group MyRWGroup usm local
- #group MyROGroup v1 mynetwork
- #group MyROGroup v2c mynetwork
- #group MyROGroup usm mynetwork
- group MyROGroup v1 local
- group MyROGroup v2c local
- ####
- # Third, create a view for us to let the groups have rights to:
- # incl/excl subtree mask
- #view all included .1 80
- view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc
- ####
- # Finally, grant the 2 groups access to the 1 view with different
- # write permissions:
- # context sec.model sec.level match read write notif
- access MyROGroup "" any noauth exact mib2 none none
- #access MyRWGroup "" any noauth exact all all none
- #启动
- /usr/local/sbin/snmpd
- #加入启动
- echo '/usr/local/sbin/snmpd' >> /etc/rc.local
- #查看161端口是否开启
- netstat -ano|grep 161
- #测试
- snmpwalk -v 1 -c privatepass localhost system
- SNMPv2-MIB::sysDescr.0 = STRING: Linux localhost.localdomain 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686
- SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
- DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (2612) 0:00:26.12
- SNMPv2-MIB::sysContact.0 = STRING: Me
- SNMPv2-MIB::sysName.0 = STRING: localhost.localdomain
- SNMPv2-MIB::sysLocation.0 = STRING: Right here, right now.
- SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORID.1 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
- SNMPv2-MIB::sysORID.2 = OID: SNMP-MPD-MIB::snmpMPDCompliance
- SNMPv2-MIB::sysORID.3 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
- SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB
- SNMPv2-MIB::sysORID.5 = OID: TCP-MIB::tcpMIB
- SNMPv2-MIB::sysORID.6 = OID: IP-MIB::ip
- SNMPv2-MIB::sysORID.7 = OID: UDP-MIB::udpMIB
- SNMPv2-MIB::sysORID.8 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
- SNMPv2-MIB::sysORDescr.1 = STRING: The SNMP Management Architecture MIB.
- SNMPv2-MIB::sysORDescr.2 = STRING: The MIB for Message Processing and Dispatching.
- SNMPv2-MIB::sysORDescr.3 = STRING: The management information definitions for the SNMP User-based Security Model.
- SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for SNMPv2 entities
- SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing TCP implementations
- SNMPv2-MIB::sysORDescr.6 = STRING: The MIB module for managing IP and ICMP implementations
- SNMPv2-MIB::sysORDescr.7 = STRING: The MIB module for managing UDP implementations
- SNMPv2-MIB::sysORDescr.8 = STRING: View-based Access Control Model for SNMP.
- SNMPv2-MIB::sysORUpTime.1 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.2 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.3 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.4 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.5 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.6 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.7 = Timeticks: (0) 0:00:00.00
- SNMPv2-MIB::sysORUpTime.8 = Timeticks: (0) 0:00:00.00
snmp安装完毕
安装check_traffic脚本
下载check_traffic_v1.1.6.zip脚本
上传./check_traffic.sh 至/usr/local/nagios/libexec
cd /usr/local/nagios/libexec/
chown nagios:nagios ./check_traffic.sh
chmod 755 ./check_traffic.sh
用 -L选项列出对应主机所有的interface，来确定你要监控的网络接口(如果能你确认接口的index值，这一步可以省略)。
通过输出，我们确认要监控的网络接口为4，对应为"Macronix MX98715-Based Ethernet Adapter (Generic) - 数据包计划程序微型端口"
./check_traffic.sh -V 2c -C privatepass -H localhost -L
List Interface for host localhost.
Interface index 1 orresponding to lo
Interface index 2 orresponding to eth0
Interface index 3 orresponding to eth1
Interface index 4 orresponding to sit0
按照说明，选择版本为2c(一般选择1或者2c)，community为privatepass，interface为2，单位为KB/s，in流量对应warning/critical值为200/400，out流量对应warning/critical值为300/500.
sudo -u nagios ./check_traffic.sh -V 2c -C privatepass -H localhost -I 2 -w12,30 -c15,50 -K -b
Can not found data in the history data file.
If it's the first time for this plugins, that's OK.
Otherwise,please use debug mode and check the debug file.
第一次执行，因为history data file不存在，因此会由此提示，可以忽略。
如果每次执行都忽略，则要检查/var/tmp下是否有/var/tmp/check_traffic_${Host}_${Interface}.hist_dat文件生成。
文件的内容是系统当前的时间，in及out当前的数值。
nagios监控本机的配置
修改/usr/local/nagios/etc/objects/commands.cfg，增下以下内容
- define command{
- command_name check_traffic_nv
- command_line $USER1$/check_traffic.sh -V 2c -C privatepass -H localhost -I $ARG1$ -w $ARG2$ -c $ARG3$ -M -b
- }
修改/usr/local/nagios/etc/objects/localhost.cfg，增下以下内容
- define service{
- use local-service,srv-pnp ; Name of service template to use
- host_name nagios
- service_description check_nv_traffic_eth0
- check_command check_traffic_nv!2!12,30!15,35
- notifications_enabled 0
- normal_check_interval 5 ;5分钟
- retry_interval 1 ;1分钟
- }
nagios监控远程机的配置
修改/usr/local/nagios/etc/objects/remotehost.cfg，增下以下内容
- define service{
- use local-service,srv-pnp ; Name of service template to use
- host_name nagios
- service_description check_nv_traffic_eth0
- check_command check_nrpe!check_traffic_nv
- notifications_enabled 0
- normal_check_interval 5 ;5分钟
- retry_interval 1 ;1分钟
- }
修改/usr/local/nagios/etc/nrpe.cfg增加以下内容
- command[check_traffic_nv]=/usr/local/nagios/libexec/check_traffic_nv.sh -V 2c -C privatepass -H localhost -I 2 -w 12,30 -c 15,35 -M -b
访问http://localhost/nagios
点击Service Detail
点击check_nv_traffic_eth0服务旁的小太阳
等5分钟后就可以看到图表
which: no snmpwalk in (/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin)
如果check_nv_traffic_eth0服务报找不到snmpwalk.
ln -s /usr/local/bin/snmpwalk /usr/bin/snmpwalk
有时我作的软链接会丢失,挺奇怪的...
【编辑推荐】
