TCP Wrapper Integration


Introduction

This example explains how to easily generate alerts in NetSaint for connection attempts that are rejected by TCP wrappers. These directions assume that the host which you are generating alerts for (i.e. the host you are using TCP wrappers on) is not the same host on which NetSaint is running. If you want to generate alerts on the same host that NetSaint is running you will need to make a few modifications to the examples I provide. Also, I am assuming that you having installed the nsca daemon on your monitoring server and the nsca client (send_nsca) on the machine that you are generating TCP wrapper alerts from.

Defining The Service

First off you're going to have to define a service in your host configuration file for the TCP wrapper alerts. Assuming that the host that the alerts are originating from is called firestorm, a sample service definition might look something like this:

service[firestorm]=TCP Wrappers;1;none;1;1;1;security-admins;120;24x7;1;1;1;;check_ping

Important things to note are the fact that this service has the volatile option enabled. We want this option enabled because we want a notification to be generated for every alert that comes in. Also of note is the fact that the timeperiod name specified in the check_period option refers to a timeperiod definition tha thas no valid times. This means that the service will never be actively checked - all alert information will have to be sent in passively by the nsca client on the firestorm host.

Configuring TCP Wrappers

Now you're going to have to modify the /etc/hosts.deny file on the host called firestorm. In order to have the TCP wrappers send an alert to the monitoring host whenever a connection attempt is denied, you'll have to add a line similiar to the following:

ALL: ALL: RFC931: twist (/usr/local/netsaint/libexec/eventhandlers/handle_tcp_wrapper %h %d) &

This line assumes that there is a script called handle_tcp_wrapper in the /usr/local/netsaint/libexec/eventhandlers/ directory on firestorm. The directory and script name can be changed to whatever you want.

Writing The Script

The last thing you need to do is write the handle_tcp_wrapper script on firestorm that will send the alert back to the monitoring host. It might look something like this:

#!/bin/sh

/usr/local/netsaint/libexec/eventhandlers/submit_check_result firestorm "TCP Wrappers" 2 "Denied $2-$1" > /dev/null 2> /dev/null

Notice that the handle_tcp_wrapper script calls the submit_check_result script to actually send the alert back to the monitoring host. Assuming your monitoring host is called monitor, the submit check_result script might look like this (you'll have to modify this to specify the proper location of the send_nsca program on firestorm):

#!/bin/sh

# Arguments
#	$1 = name of host in service definition
#	$2 = name/description of service in service definition
#	$3 = return code
#	$4 = output

/bin/echo -e "$1\t$2\t$3\t$4\n" | /usr/local/netsaint/send_nsca monitor -c /usr/local/netsaint/send_nsca.cfg

Finishing Up

You've now configured everything you need to, so all you have to do is restart the inetd process on firestorm and restart NetSaint on your monitoring server. That's it! When the TCP wrappers on firestorm deny a connection attempt, you should be getting alerts in NetSaint. The plugin output for the alert will look something like the following:

Denied sshd2-sdn-ar-002mnminnP321.dialsprint.net