js#vista.png msort nsort
js#vista.png msort nsort
check_ipsec2 v1.0rc1 (nagios-plugins 1.4.15) The nagios plugins come with ABSOLUTELY NO WARRANTY. You may redistribute copies of the plugins under the terms of the GNU General Public License. For more information about these matters, see the file named COPYING.
sudoers entry:
nagios ALL=(root) NOPASSWD: /usr/lib/nagios/plugins/check_ipsec2
nrpe_local.cfg entry:
command[check_ipsec2]=sudo /usr/lib/nagios/plugins/check_ipsec2 $ARG1$
/etc/nagios/ipsec_gateways.txt entry:
CON-192.168.48.0 192.168.48.1
Service definition:
define service { use generic-service host_name vpngw.domain.tld service_description Check CON-192.168.48.0 check_command check_ipsec2!"-c CON-192.168.48.0 -p -s" }
or
define service { use generic-service host_name vpngw.domain.tld service_description Check Tunnels check_command check_ipsec2!"-a 4" }
Command definition:
define command{ command_name check_ipsec2 command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c check_ipsec2 -a $ARG1$ }
Usage:
$PROGNAME [-hprsv] [-a number of connections] [-c IPSEC connection name] -a <number of configured tunnels> (Check all connections) -c <name of connection> (Check specific connection) -p (Ping remote gateway. Used only with -c) -r (Restart IPSEC if down) -s (Reacquire SA for connection. Used only with both -c and -p) -h (Show this help screen) -v (Show version) -a and -c cannot be used together. -s can only be used with -c. -p can only be used with -c.
1. Open to ideas
#!/bin/bash #set -x # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA # # Based partially on the work done by By Nicole in the check_ipsec script # # Plugin Name: check_ipsec2 # Version: 1.0rc1 # Date: 24/04/2013 # # Usage: check_ipsec2 -a <n> # check_ipsec2 -c <connection name> # # ipsec_gateways.txt file must be located in same directory # and has to look like: # nameofconn1 192.168.0.1 # nameofconn2 192.168.1.1 # # ------------Defining Variables------------ PROGNAME=`basename $0` PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'` REVISION="1.0rc1" GATEWAYLIST="/etc/nagios/ipsec_gateways.txt" DOWN="" AWKBIN=`which awk` EGREPBIN=`which egrep` FPINGBIN=`which fping` GREPBIN=`which grep` IPSECBIN=`which ipsec` WCBIN=`which wc` PINGIP=0 AUTHOR="Copyright 2013, Charles Williams (chuck@itadmins.net) (http://www.itadmins.net/)" missing="O" . $PROGPATH/utils.sh print_version() { echo "$VERSION $AUTHOR" } print_usage() { echo "Usage:" echo " $PROGNAME [-hprsv] [-a number of connections] [-c IPSEC connection name]" echo " -a <number of configured tunnels> (Check all connections)" echo " -c <name of connection> (Check specific connection)" echo " -p (Ping remote gateway. Used only with -c)" echo " -r (Restart IPSEC if down)" echo " -s (Reacquire SA for connection. Used only with both -c and -p)" echo " -h (Show this help screen)" echo " -v (Show version)" echo echo "-a and -c cannot be used together." echo "-s can only be used with -c." echo "-p can only be used with -c." echo "" } print_help() { print_revision $PROGNAME $REVISION echo "" print_usage echo "" } if [ $# -eq 0 ]; then print_help exit $STATE_UNKNOWN fi test -e $IPSECBIN if [ $? -ne 0 ]; then echo CRITICAL - $IPSECBIN not exist exit $STATE_CRITICAL else STRONG=`$IPSECBIN --version |grep strongSwan | wc -l` fi check_all() { if [[ "$STRONG" -eq "1" ]] then eroutes=`$IPSECBIN status | $EGREPBIN -e "INSTALLED, |IPsec SA established" | wc -l` else eroutes=`$IPSECBIN whack --status | grep -e "IPsec SA established" | grep -e "newest IPSEC" | wc -l` fi #if [[ "$PINGIP" -eq "1" ]] #then # ping_gateway $1 #fi if [[ "$eroutes" -eq "$1" ]] then echo "OK - All $1 tunnels are up and running" exit $STATE_OK elif [[ "$eroutes" -gt "$1" ]] then echo "WARNING - More than $1 ($eroutes) tunnels are up and running" exit $STATE_WARNING else echo "CRITICAL - Only $eroutes tunnels from $1 are up and running." exit $STATE_CRITICAL fi } check_connection() { if [[ "$STRONG" -eq "1" ]] then eroutes=`$IPSECBIN status | grep -e "$1" | $EGREPBIN -e "INSTALLED, |IPsec SA established" | wc -l` else eroutes=`$IPSECBIN whack --status | grep -e "IPsec SA established" | grep -e "$2" | wc -l` fi if [[ "$PINGIP" -eq "1" ]] then ping_gateway $1 fi if [[ "$eroutes" -eq "1" ]] then echo "OK - $1 Connection is up and running" exit $STATE_OK else if [[ "$REACQUIRE" -eq "1" ]]; then reacquire_sa $1 elif [[ "$RESTART" -eq "1" ]]; then restart_ipsec else echo "CRITICAL - $1 Connection is down" exit $STATE_CRITICAL fi fi } ping_gateway() { GATEWAYIP=`$GREPBIN $1 $GATEWAYLIST| $AWKBIN '{print $2}'` PING=`$FPINGBIN $GATEWAYIP -r 1 | $GREPBIN alive | $WCBIN -l` if [[ "$PING" -eq "0" ]] then if [[ "$REACQUIRE" -eq "1" ]]; then reacquire_sa $1 else echo "CRITICAL - $1 is down (no ping)" exit $STATE_CRITICAL fi fi } restart_ipsec() { RETURN=`$IPSECBIN restart` echo "WARNING - IPSEC being restarted" exit $STATE_WARNING } reacquire_sa() { RETURN=`$IPSECBIN down $1; $IPSECBIN up $1` echo "WARNING - Connection $1 SA Updating" exit $STATE_WARNING } NUMCONN="" CONNAME="" CHECKALL=0 CHECKCON=0 while getopts ":a:c:prshv" opt; do case $opt in h) print_help exit $STATE_OK ;; v) print_revision $PLUGIN $REVISION exit $STATE_OK ;; a) NUMCONN=$OPTARG CHECKALL=1 ;; c) CONNAME=$OPTARG CHECKCON=1 ;; p) PINGIP=1 ;; r) RESTART=1 ;; s) REACQUIRE=1 ;; :) echo "Option -$OPTARG requires an arguement." >&2 print_help exit $STATE_OK ;; \?) print_help exit $STATE_OK ;; esac done if [ $PINGIP -eq 1 ] then test -e $GATEWAYLIST if [ $? -ne 0 ]; then echo CRITICAL - $GATEWAYLIST does not exist exit $STATE_CRITICAL fi test -e $FPINGBIN if [ $? -ne 0 ]; then echo CRITICAL - $FPINGBIN not installed or not found exit $STATE_CRITICAL fi fi if [[ ( $CONNAME = "" && $NUMCONN = "" ) || ( $CONNAME != "" && $NUMCONN != "" ) ]]; then print_help exit $STATE_OK fi if [ $CHECKCON -eq 1 ]; then check_connection $CONNAME else check_all $NUMCONN fi