Official Iptables Monitoring script tuning in Nagios

There is a script available on Nagios's official website to monitor the status of Iptables, but the official script is not directly available and needs to be modified in order to be used, as is the case here, because Nagios's command mechanism is run with Nagios users, Therefore, the official web-based script is not available before the adjustment is not normal use, the official website provides the Iptables monitoring script is simple, is the use of iptables instructions to count the real-time input on the number of bars, if the number of 1 is less than 0 alarm. However, the normal user is not able to use the iptables command, if you do not make adjustments in Nagios will appear nrpe:unable to read output error, so you need to adjust in the system, You need to add a sudo-free sudo permission to Nagios using the iptables command:

[Email protected] ~]# Visudo ... A little ... nagios all= (All) nopasswd:/sbin/iptables ... Slightly...

It is important to note here that before deploying Nagios, it is important to note that the user who created Nagios is a non-logged-on useradd-s parameter, so adding sudo permissions does not have a security risk, and finally the official script can be modified:

#!/bin/bash#you must add nagios permission to iptables in / etc  / sudoersstate_ok=0state_warning=1state_criticalll=2state_unknown=3chains=$ (sudo iptables  -nvL | grep  ' Chain '  | awk  ' { print $2 } ') For chain  in  $CHAINS  ; do    if [  "$CHAIN"  !=  ' FORWARD '  ] && [  "$CHAIN"  !=  ' OUTPUT '  ] && [ $ (expr  substr  $CHAIN  1 4)  !=  "Log_"  ] ; then         cnt=$ (expr $ (sudo iptables -s  $CHAIN  | wc -l)   '-'  1 '         if [  $CNT  -eq 0 ] ;  then            output= "${OUTPUT}ERROR  $CHAIN   $CNT  rules! "             echo  $OUTPUT              exit  $STATE _criticall         else            output= "${OUTPUT}OK   $CHAIN   $CNT  rules "            echo   $OUTPUT             exit  $STATE _ok         fi    fidone

This article from "Technical essay" blog, declined reprint!

Official Iptables Monitoring script tuning in Nagios