Monitoring

Team: Artur Ovtsinnikov, Mohanad Aly, Etienne Barrier, Meelis Hass

Group : Cyber Security Engineering (C21)

Page Created: 23 October 2016

‎Last modified: ‎23 October 2016

Introduction

This article introduces the Monitoring application called Nagios.

Monitoring

Monitoring is the process of keep tracking of system resources.

Monitoring is the process of observing and checking the progress or quality of something over a period of time; keep under systematic review. Monitoring cannot be achieved without logging. That is the reason integrated solutions combine the two processes. Monitoring is used to:

• check performance
• detect if something worth noticing happened
• prevent something to happen
• detect whether a system is under attack

The good solution: Nagios

As of today, [1] is the most popular open-source solution for monitoring computer systems before

Monitoring is made of three components:

• Apache
• PHP
• MySQL

The main advantages of Nagios are:

• Open-source
• Customized Dashboards
• Ease of Use
• Infinite Scalability
• Data in Real Time
• Network Security

Why monitor our servers

There are many reasons why a system administrator would want to monitor its server(s).

• Prevent undesired events to happen

Without monitoring, a system administrator will react to a problem only when it has already occurred. Such issue can in the worst case cause a failure of the CIA triad. It is of course wiser to anticipate such issues and solve the problem before they arise. The monitoring system sends alerts that help to identify potential sources of futures failures to avoid.

• Understand what happened in case of failure

In the event of a system failure, the monitoring system will give crucial information to determine where, when and how the problems occurred. This information makes the debugging process to be much faster and easier.

In the end, monitoring a system can be seen as an insurance policy. It costs money and time, but the money and time it saves is worth it.

Topology of the Elab system

Desktop machine

Topology []

Begin with the basic setup, network configuration and make the machine has internet access which the ip address of the machine is 192.168.56.100

Server machine IP address 192.168.56.200

• Can be connected over ssh with student@192.168.56.200
• Also can connect with other IP address ssh student@10.10.10.10

IDS IP address 192.168.56.201

Starting to update and upgrade the OS

Check for current version

If your machine is running older version then 16.04 which is the latest long term supported version, please follow the following commands to upgrade your machine to the latest version.

• First check your current Ubuntu version by running the following command:

lsb_release -a

If you find that your machine is already running the following version or higher than:

Description:Ubuntu 16.04.1 LTS Release:16.04

Then there is no need to upgrade the OS

Upgrade

• First become super user "root":

sudo -i

• Begin by updating the package list:

apt-get update

• Upgrade installed packages to their latest available versions:

apt-get upgrade

• Once upgrade finishes, use the dist-upgrade command, which will perform upgrades involving changing dependencies

apt-get dist-upgrade

• Now that you have an up-to-date installation of Ubuntu 16.04 LTS, you can use do-release-upgrade to upgrade to the Ubuntu 16.04 LTS release.

Setup of Nagios

Prerequisites

Ubuntu Linux machine, sudo access and some Linux beginner skills are needed.

In this tutorial, Ubuntu 16.04 64-bit distribution will be used since it is the latest LTS.

Unfortunately, Nagios cannot be installed simply by using one command, because there are some prerequisite applications needed for it to work.

This tutorial describes the commands and configuration to make the services work together Nagios.

Installation tutorial on Ubuntu 16.04 Linux host machine

• It is important to have the latest package lists to update them to get info on the newest versions of packages and their dependencies. So we need to run the following command to update them:

Command sudo apt-get update

Installing the prerequisites

• Nagios requires the gcc compiler and build-essentials for the compilation, LAMP (Apache, PHP, MySQL) for the Nagios web interface and Send mail to send alerts from the server. To install all those packages, run this command (it's just 1 line):

Command sudo apt-get install wget build-essential apache2 php apache2-mod-php7.0 php-gd libgd-dev sendmail unzip

User and group configuration

• For Nagios to run, you have to create a new user for Nagios. We will name the user "nagios" and additionally create a group named "nagcmd". We add the new user to the group as shown below:

3- Command useradd nagios 4- Command groupadd nagcmd 5- Command usermod -a -G nagcmd nagios 6- Command usermod -a -G nagios,nagcmd www-data

File:11.png

Nagios []

Installing Nagios

• Step 1 - Download and extract the Nagios core

cd ~

wget https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.2.0.tar.gz

tar -xzf nagios*.tar.gz

cd nagios-4.2.0

• Step 2 - Compile Nagios

Before you build Nagios, you will have to configure it with the user and the group you have created earlier.

./configure --with-nagios-group=nagios --with-command-group=nagcmd

For more information please use: ./configure --help .

• Now to install Nagios:

make all

sudo make install

sudo make install-commandmode

sudo make install-init

sudo make install-config

/usr/bin/install -c -m 644 sample-config/httpd.conf /etc/apache2/sites-available/nagios.conf

• And copy evenhandler directory to the nagios directory:

cp -R contrib/eventhandlers/ /usr/local/nagios/libexec/

chown -R nagios:nagios /usr/local/nagios/libexec/eventhandlers

• Step 3 - Install the Nagios Plugins

Download and extract the Nagios plugins:

cd ~

wget https://nagios-plugins.org/download/nagios-plugins-2.1.2.tar.gz

tar -xzf nagios-plugins*.tar.gz

cd nagios-plugin-2.1.2/

• Install the Nagios plugin's with the commands below:

./configure --with-nagios-user=nagios --with-nagios-group=nagios --with-openssl

make

make install

• Step 4 - Configure Nagios

After the installation phase is complete, you can find the default configuration of Nagios in /usr/local/nagios/. We will configure Nagios and Nagios contact. Edit default nagios configuration with nano:

nano /usr/local/nagios/etc/nagios.cfg

uncomment line 51 for the host monitor configuration.

• cfg_dir=/usr/local/nagios/etc/servers

Save and exit. Add a new folder named servers: mkdir -p /usr/local/nagios/etc/servers

The Nagios contact can be configured in the contact.cfg file. To open it use: nano /usr/local/nagios/etc/objects/contacts.cfg

Configuring Apache

• Step 1 - enable Apache modules

sudo a2enmod rewrite sudo a2enmod cgi

You can use the htpasswd command to configure a user nagiosadmin for the nagios web interface

sudo htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

and type your password.

• Step 2 - enable the Nagios virtualhost

sudo ln -s /etc/apache2/sites-available/nagios.conf /etc/apache2/sites-enabled/

• Step 3 - Start Apache and Nagios

service apache2 restart service nagios start

When Nagios starts, you may see the following error :

• • Starting nagios (via systemctl): nagios.serviceFailed

And this is how to fix it:

cd /etc/init.d/ cp /etc/init.d/skeleton /etc/init.d/nagios

Now edit the Nagios file:

nano /etc/init.d/nagios

and add the following code:

DESC="Nagios" NAME=nagios DAEMON=/usr/local/nagios/bin/$NAME DAEMON_ARGS="-d /usr/local/nagios/etc/nagios.cfg" PIDFILE=/usr/local/nagios/var/$NAME.lock

Make it executable and start Nagios:

chmod +x /etc/init.d/nagios service apache2 restart service nagios start

Testing the Nagios Server

Please open your browser and access the Nagios server ip, in my case: http://192.168.1.9/nagios.

Nagios Login with apache htpasswd.

[[File:|thumb|center|]]

Nagios Admin Dashboard

[[File:|thumb|center|]]

• Adding a Host to Monitor

In this tutorial, I will add an Ubuntu host to monitor to the Nagios server we have made above.

Nagios Server IP : 192.168.1.9 Ubuntu Host IP : 192.168.1.10

• Step 1 - Connect to ubuntu host

ssh student@192.168.56.100

• Step 2 - Install NRPE Service

sudo apt-get install nagios-nrpe-server nagios-plugins

• Step 3 - Configure NRPE

After the installation is complete, edit the nrpe file /etc/nagios/nrpe.cfg:

nano /etc/nagios/nrpe.cfg

and add Nagios Server IP 192.168.1.9 to the server_address.

server_address=192.168.56.200

• Step 4 - Restart NRPE

service nagios-nrpe-server restart

• Step 5 - Add Ubuntu Host to Nagios Server

Connect back to the Nagios server:

ssh student@192.168.56.200

Then create a new file for the host configuration in /usr/local/nagios/etc/servers/.

nano /usr/local/nagios/etc/servers/ubuntu_host.cfg

Add the following lines:

1. Ubuntu Host configuration file

define host {

       use                          linux-server
       host_name                    ubuntu_host
       alias                        Ubuntu Host
       address                      192.168.1.10
       register                     1

}

define service {

     host_name                       ubuntu_host
     service_description             PING
     check_command                   check_ping!100.0,20%!500.0,60%
     max_check_attempts              2
     check_interval                  2
     retry_interval                  2
     check_period                    24x7
     check_freshness                 1
     contact_groups                  admins
     notification_interval           2
     notification_period             24x7
     notifications_enabled           1
     register                        1

}

define service {

     host_name                       ubuntu_host
     service_description             Check Users
     check_command           check_local_users!20!50
     max_check_attempts              2
     check_interval                  2
     retry_interval                  2
     check_period                    24x7
     check_freshness                 1
     contact_groups                  admins
     notification_interval           2
     notification_period             24x7
     notifications_enabled           1
     register                        1

}

define service {

     host_name                       ubuntu_host
     service_description             Local Disk
     check_command                   check_local_disk!20%!10%!/
     max_check_attempts              2
     check_interval                  2
     retry_interval                  2
     check_period                    24x7
     check_freshness                 1
     contact_groups                  admins
     notification_interval           2
     notification_period             24x7
     notifications_enabled           1
     register                        1

}

define service {

     host_name                       ubuntu_host
     service_description             Check SSH
     check_command                   check_ssh
     max_check_attempts              2
     check_interval                  2
     retry_interval                  2
     check_period                    24x7
     check_freshness                 1
     contact_groups                  admins
     notification_interval           2
     notification_period             24x7
     notifications_enabled           1
     register                        1

}

define service {

     host_name                       ubuntu_host
     service_description             Total Process
     check_command                   check_local_procs!250!400!RSZDT
     max_check_attempts              2
     check_interval                  2
     retry_interval                  2
     check_period                    24x7
     check_freshness                 1
     contact_groups                  admins
     notification_interval           2
     notification_period             24x7
     notifications_enabled           1
     register                        1

}

You can find many check_command in /usr/local/nagios/etc/objects/commands.cfg file. See there if you want to add more services like DHCP, POP etc.

And now check the configuration: /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

To see if the configuration is correct.

• Step 6 - Restart all services

On the Ubuntu Host start NRPE Service:

service nagios-nrpe-server restart

The Nagios server, start Apache and Nagios:

service apache2 restart service nagios restart

• Step 7 - Testing the Ubuntu Host

Open the Nagios server from the browser and see the ubuntu_host being monitored. The Ubuntu host is available on monitored host.

[[File:|thumb|center|]]

All services monitored without error.

Summary

Nagios is an open source application for monitoring a system. Nagios has been widely used because of the ease of configuration. Nagios in support by various plugins, and you can even create your own plugins. Look here for more information.

[[File:|thumb|center|]]

[[File:|thumb|center|]]

[[File:|thumb|center|]]

References

1- https://en.wikipedia.org/wiki/System_monitoring

2- https://www.howtoforge.com/tutorial/ubuntu-nagios/

3- https://www.nagios.com/products/nagios-log-server/

---