monitoring-checks/check_sshauthmethods at main · flucas1/monitoring-checks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
#!/usr/bin/env python3
#-------------------------------------------------------------------------------

import argparse
import paramiko
import os
import sys
import time
import socket

#-------------------------------------------------------------------------------

_candebug = False
def candebug():
    global _candebug
    return _candebug
def setcandebug(value):
    global _candebug
    _candebug = value

def infomsg(msg):
    if candebug() == True:
        print(msg, flush=True)

def mapstatustoexitcode(status):
    if status=="OK":
        exitcode = 0
    elif status=="WARNING":
        exitcode = 1
    elif status=="CRITICAL":
        exitcode = 2
    elif status=="UNKNOWN":
        exitcode = 3
    else:
        exitcode = 4
    return exitcode

def exitnagios(status,message):
    exitcode = mapstatustoexitcode(status)
    print(status+": "+message, flush=True)
    sys.exit(exitcode)

#-------------------------------------------------------------------------------

original_getaddrinfo = socket.getaddrinfo

def forced_ipv6_gai_family(*args, **kwargs):
    global original_getaddrinfo
    responses = original_getaddrinfo(*args, **kwargs)
    return [response
            for response in responses
            if response[0] == socket.AF_INET6]

def forced_ipv4_gai_family(*args, **kwargs):
    global original_getaddrinfo
    responses = original_getaddrinfo(*args, **kwargs)
    return [response
            for response in responses
            if response[0] == socket.AF_INET]

#-------------------------------------------------------------------------------

def test_ssh_auth(protocol, host, port, timeoutvalue, timeoutstatus, expectedlist):
    t = None
    try:
        t = paramiko.Transport((host, port))
        t.connect()
    except Exception as e:
        if t != None:
           t.close()
        exitnagios(timeoutstatus,"SSH connection failed "+host+":"+str(port)+" - cause: "+str(e))

    try:
        t.auth_none("")
    except paramiko.BadAuthenticationType as e:
        if len(expectedlist)==len(e.allowed_types):
            for item in expectedlist:
                if item not in e.allowed_types:
                    exitnagios("WARNING","The allowed methods are "+str(e.allowed_types)+" but it was expected "+str(expectedlist))
            exitnagios("OK","The allowed methods are "+str(e.allowed_types)+" as expected")
        else:
           exitnagios("CRITICAL","The allowed methods are "+str(e.allowed_types)+" but it was expected "+str(expectedlist))
    finally:
        t.close()

#-------------------------------------------------------------------------------

def main(forcedargs=None):
    parser = argparse.ArgumentParser()
    parser.add_argument("-4", "--ipv4",              action="store_true",  dest="ipv4",             default=False,                                help="use ipv4 (exclusive with ipv6)")
    parser.add_argument("-6", "--ipv6",              action="store_true",  dest="ipv6",             default=False,                                help="use ipv6 (exclusive with ipv4)")
    parser.add_argument("-0", "--ipv0",              action="store_true",  dest="ipv0",             default=False,                                help="do not specify ip protocol version")
    parser.add_argument("-H", "--host",                                    dest="host",                                                           help="Hostname")
    parser.add_argument("-p", "--port",                                    dest="port",             default="22",                                 help="Enter a TCP port number")
    parser.add_argument("-t", "--timeout",                                 dest="timeout",          default="30:CRITICAL",                        help="timeout value:STATUS")
    parser.add_argument("-e", "--expected",                                dest="expected",         default="publickey,gssapi-with-mic,password", help="expected methods")
    parser.add_argument("-®", "--debug",             action="store_true",  dest="debug",            default=False,                                help="be more verbose")
    args = parser.parse_args(forcedargs)

    setcandebug(args.debug)

    protocol = None
    exclist = 0
    if args.ipv0 == True :
        protocol = ""
        exclist = exclist+1
    if args.ipv4 == True :
        protocol = "-4"
        exclist = exclist+1
        socket.getaddrinfo = forced_ipv4_gai_family
    if args.ipv6 == True :
        protocol = "-6"
        exclist = exclist+1
        socket.getaddrinfo = forced_ipv6_gai_family
    if (exclist>1) :
        exitnagios("CRITICAL","select ip protocol version 4 or 6, or 0 to relay on OS handling")
    elif (exclist<1) :
        exitnagios("CRITICAL","no protocol selected")

    if (args.host == ""):
        exitnagios("CRITICAL","specify a host/domain to check")

    parts = args.timeout.split(":")
    timeoutvalue = int(parts[0])
    if len(parts)>1:
        timeoutstatus = parts[1]
    else:
        timeoutstatus = "CRITICAL"

    expectedlist = args.expected.split(",")
    if (len(expectedlist) == 0):
        exitnagios("CRITICAL","no expected methods")


    test_ssh_auth(protocol, args.host, int(args.port), timeoutvalue, timeoutstatus, expectedlist)

#-------------------------------------------------------------------------------

if __name__ == "__main__":
    main()

#-------------------------------------------------------------------------------