RBL check con Nagios

Installazione pacchetto

Debian >= Jessie

sudo apt-get install nagios-plugins-contrib

Debian < Jessie

• Scaricare il tar:

wget https://trac.id.ethz.ch/projects/nagios_plugins/downnloads/check_rbl-1.3.0.tar.gz --no-check-certificates
tar xvzf check_rbl-1.3.0.tar.gz

• Creare il file .deb

sudo checkinstall \
   -D --install=no \
   -A all \
   --maintainer email@example.com \
   --requires libnagios-plugin-perl,libreadonly-perl \
   --pkgname nagios-plugins-rbl \
   --review-control

Quando si edita il file control alla fine, eliminare le ricghe vuote con Conflicts: e xxxx:

• Eventualmente uploadarlo per signarlo

• Se si installa a mano:

sudo dpkg -i nagios-plugins-rbl libnagios-plugin-perl libreadonly-perl

• Dal repository su cui lo si è caricato:

sudo apt-get install nagios-plugins-rbl

Configurazione

• Disablitare l'interprete embedded di Nagios

sudoedit /etc/nagios3/nagios.cfg
   ...
   enable_embedded_perl=0
   use_embedded_perl_implicitly=0
   ...

• Creare i comandi:

cat | sudo tee /etc/nagios3/conf.d/check_commands/check-rbl.cfg > /dev/null <<'EOFile'
define command{
                command_name    check-rbl
                command_line    $USER1$/contrib/check_rbl -H '$HOSTADDRESS$' -t 60 --extra-opts=rbl@etc/nagios-plugins/check_rbl.ini
                        #--extra-opts=check_rbl@/etc/nagios-plugins.ini -v -d
        }
EOFile

cat | sudo tee /etc/nagios3/conf.d/check_commands/check-rbl-address.cfg > /dev/null <<'EOFile'
define command{
                command_name    check-rbl-address
                command_line    $USER1$/contrib/check_rbl -H '$ARG1$' -t 60 --extra-opts=rbl@etc/nagios-plugins/check_rbl.ini
                        #--extra-opts=check_rbl@/etc/nagios-plugins.ini -v -d
        }
EOFile

• Creare il file di configurazione contenente i server da testare, OPPURE EDITARE QUELLO ESISTENTE:

cat | sudo tee -a /etc/nagios-plugins/check_rbl.ini > /dev/null <<EOFile
[rbl]
server=0spam.fusionzero.com
server=access.redhawk.org
server=b.barracudacentral.org
#server=blackholes.mail-abuse.org
server=blacklist.sci.kun.nl
server=bl.deadbeef.com
server=bl.spamcannibal.org
server=bl.spamcop.net
server=bogons.cymru.com
server=cbl.abuseat.org
server=cdl.anti-spam.org.cn
#server=combined.njabl.org
server=csi.cloudmark.com
server=db.wpbl.info
server=dnsbl-1.uceprotect.net
server=dnsbl-2.uceprotect.net
server=dnsbl-3.uceprotect.net
server=dnsbl.cyberlogic.net
server=dnsbl.dronebl.org
server=dnsbl.inps.de
server=dnsbl.kempt.net
#server=dnsbl.njabl.org
#server=dnsbl.solid.net
server=dnsbl.sorbs.net
server=drone.abuse.ch
server=dsn.rfc-ignorant.org
server=dul.dnsbl.sorbs.net
server=dyna.spamrats.com
server=forbidden.icm.edu.pl
server=hil.habeas.com
server=httpbl.abuse.ch
server=http.dnsbl.sorbs.net
server=ips.backscatterer.org
server=ix.dnsbl.manitu.net
server=korea.services.net
server=mail-abuse.blacklist.jippg.org
server=misc.dnsbl.sorbs.net
server=multi.surbl.org
server=netblock.pedantic.org
server=no-more-funn.moensted.dk
server=noptr.spamrats.com
server=opm.tornevall.org
server=pbl.spamhaus.org
server=psbl.surriel.com
server=query.senderbase.org
server=rbl.efnetrbl.org
server=rbl.interserver.net
#server=rbl-plus.mail-abuse.org
server=rbl.schulte.org
server=rbl.spamlab.com
server=rbl.suresupport.com
#server=relays.mail-abuse.org
server=relays.nether.net
server=sbl.spamhaus.org
server=sbl-xbl.spamhaus.org
server=short.rbl.jp
server=smtp.dnsbl.sorbs.net
server=socks.dnsbl.sorbs.net
server=spam.dnsbl.sorbs.net
server=spamguard.leadmon.net
server=spamrbl.imp.ch
server=spamsources.fabel.dk
server=spam.spamrats.com
server=spamtrap.drbl.drand.net
server=tor.dan.me.uk
server=ubl.unsubscore.com
server=virbl.bit.nl
server=virus.rbl.jp
server=web.dnsbl.sorbs.net
server=wormrbl.imp.ch
server=xbl.spamhaus.org
server=zen.spamhaus.org
server=zombie.dnsbl.sorbs.net
EOFile

• Utilizzarlo come ad esempio in:

define service{
    use                 generic-service
    host_name           server.example.com
    service_description RBL
    check_command       check-rbl
}

oppure

define service{
    use                 generic-service
    host_name           server.example.com
    service_description RBL
    check_command       check-rbl-address!1.2.3.4
}

Riferimenti

• Teo's Blog » nagios
• check_rbl – nagios_plugins
• Extra-Opts | Nagios Plugins
• Multi-RBL Check | The Anti-Abuse Project
• Nagios RBL Check Plugin | FAQ - HowTos - Tipps - Tricks
• BLACKLISTALERT.ORG - Test if your IP or DOMAIN is listed in a spamdatabase
• nagios-check_bl is a Nagios plugin that checks whether a server is in any known anti-spam block lists
• Checking Blacklisted MTAs with CentOS + check bl - Nagios Wiki