aboutsummaryrefslogtreecommitdiff
path: root/plugins/check_ssh.c
diff options
context:
space:
mode:
authorGravatar Jan Wagner <waja@cyconet.org> 2013-10-01 14:50:04 +0200
committerGravatar Jan Wagner <waja@cyconet.org> 2013-10-01 14:50:04 +0200
commit97349ae13d65ea91abbe6fd93c34aba28817493e (patch)
tree45891d6902204bbe9943018a7bbca795576b9c6a /plugins/check_ssh.c
parentc188965c3c2f437c18a78ac47ed59099e2ecf05b (diff)
downloadmonitoring-plugins-97349ae13d65ea91abbe6fd93c34aba28817493e.tar.gz
check_ssh: check protocol
It would be useful to be able to detect the protocols supported by the remote ssh server to locate any using the insecure ssh v1 protocol. This patch attempts to match against the protocol string in the ssh response. Example: check_ssh -H my.host.com -P 2.0 -- Just turning attached patch of github issue #780 into a push request. (Closes #780)
Diffstat (limited to 'plugins/check_ssh.c')
-rw-r--r--plugins/check_ssh.c24
1 files changed, 20 insertions, 4 deletions
diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index 6e8a5fc5..6842c4cf 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -46,6 +46,7 @@ const char *email = "nagiosplug-devel@lists.sourceforge.net";
int port = -1;
char *server_name = NULL;
char *remote_version = NULL;
+char *remote_protocol = NULL;
int verbose = FALSE;
int process_arguments (int, char **);
@@ -53,7 +54,7 @@ int validate_arguments (void);
void print_help (void);
void print_usage (void);
-int ssh_connect (char *haddr, int hport, char *remote_version);
+int ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol);
@@ -78,7 +79,7 @@ main (int argc, char **argv)
alarm (socket_timeout);
/* ssh_connect exits if error is found */
- result = ssh_connect (server_name, port, remote_version);
+ result = ssh_connect (server_name, port, remote_version, remote_protocol);
alarm (0);
@@ -105,6 +106,7 @@ process_arguments (int argc, char **argv)
{"timeout", required_argument, 0, 't'},
{"verbose", no_argument, 0, 'v'},
{"remote-version", required_argument, 0, 'r'},
+ {"remote-protcol", required_argument, 0, 'P'},
{0, 0, 0, 0}
};
@@ -116,7 +118,7 @@ process_arguments (int argc, char **argv)
strcpy (argv[c], "-t");
while (1) {
- c = getopt_long (argc, argv, "+Vhv46t:r:H:p:", longopts, &option);
+ c = getopt_long (argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option);
if (c == -1 || c == EOF)
break;
@@ -152,6 +154,9 @@ process_arguments (int argc, char **argv)
case 'r': /* remote version */
remote_version = optarg;
break;
+ case 'P': /* remote version */
+ remote_protocol = optarg;
+ break;
case 'H': /* host */
if (is_host (optarg) == FALSE)
usage2 (_("Invalid hostname/address"), optarg);
@@ -206,7 +211,7 @@ validate_arguments (void)
int
-ssh_connect (char *haddr, int hport, char *remote_version)
+ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol)
{
int sd;
int result;
@@ -254,6 +259,14 @@ ssh_connect (char *haddr, int hport, char *remote_version)
exit (STATE_WARNING);
}
+ if (remote_protocol && strcmp(remote_protocol, ssh_proto)) {
+ printf
+ (_("SSH WARNING - %s (protocol %s) protocol version mismatch, expected '%s'\n"),
+ ssh_server, ssh_proto, remote_protocol);
+ close(sd);
+ exit (STATE_WARNING);
+ }
+
elapsed_time = (double)deltime(tv) / 1.0e6;
printf
@@ -296,6 +309,9 @@ print_help (void)
printf (" %s\n", "-r, --remote-version=STRING");
printf (" %s\n", _("Warn if string doesn't match expected server version (ex: OpenSSH_3.9p1)"));
+ printf (" %s\n", "-P, --remote-protocol=STRING");
+ printf (" %s\n", _("Warn if protocol doesn't match expected protocol version (ex: 2.0)"));
+
printf (UT_VERBOSE);
printf (UT_SUPPORT);