From 97349ae13d65ea91abbe6fd93c34aba28817493e Mon Sep 17 00:00:00 2001
From: Jan Wagner <waja@cyconet.org>
Date: Tue, 1 Oct 2013 14:50:04 +0200
Subject: check_ssh: check protocol

It would be useful to be able to detect the protocols supported by the remote
ssh server to locate any using the insecure ssh v1 protocol. This patch
attempts to match against the protocol string in the ssh response.

Example:

check_ssh -H my.host.com -P 2.0
--
Just turning attached patch of github issue #780 into a push request.
(Closes #780)
---
 plugins/check_ssh.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

(limited to 'plugins')

diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index 6e8a5fc5..6842c4cf 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -46,6 +46,7 @@ const char *email = "nagiosplug-devel@lists.sourceforge.net";
 int port = -1;
 char *server_name = NULL;
 char *remote_version = NULL;
+char *remote_protocol = NULL;
 int verbose = FALSE;
 
 int process_arguments (int, char **);
@@ -53,7 +54,7 @@ int validate_arguments (void);
 void print_help (void);
 void print_usage (void);
 
-int ssh_connect (char *haddr, int hport, char *remote_version);
+int ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol);
 
 
 
@@ -78,7 +79,7 @@ main (int argc, char **argv)
 	alarm (socket_timeout);
 
 	/* ssh_connect exits if error is found */
-	result = ssh_connect (server_name, port, remote_version);
+	result = ssh_connect (server_name, port, remote_version, remote_protocol);
 
 	alarm (0);
 
@@ -105,6 +106,7 @@ process_arguments (int argc, char **argv)
 		{"timeout", required_argument, 0, 't'},
 		{"verbose", no_argument, 0, 'v'},
 		{"remote-version", required_argument, 0, 'r'},
+		{"remote-protcol", required_argument, 0, 'P'},
 		{0, 0, 0, 0}
 	};
 
@@ -116,7 +118,7 @@ process_arguments (int argc, char **argv)
 			strcpy (argv[c], "-t");
 
 	while (1) {
-		c = getopt_long (argc, argv, "+Vhv46t:r:H:p:", longopts, &option);
+		c = getopt_long (argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option);
 
 		if (c == -1 || c == EOF)
 			break;
@@ -152,6 +154,9 @@ process_arguments (int argc, char **argv)
 		case 'r':									/* remote version */
 			remote_version = optarg;
 			break;
+		case 'P':									/* remote version */
+			remote_protocol = optarg;
+			break;
 		case 'H':									/* host */
 			if (is_host (optarg) == FALSE)
 				usage2 (_("Invalid hostname/address"), optarg);
@@ -206,7 +211,7 @@ validate_arguments (void)
 
 
 int
-ssh_connect (char *haddr, int hport, char *remote_version)
+ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol)
 {
 	int sd;
 	int result;
@@ -254,6 +259,14 @@ ssh_connect (char *haddr, int hport, char *remote_version)
 			exit (STATE_WARNING);
 		}
 
+		if (remote_protocol && strcmp(remote_protocol, ssh_proto)) {
+			printf
+				(_("SSH WARNING - %s (protocol %s) protocol version mismatch, expected '%s'\n"),
+				 ssh_server, ssh_proto, remote_protocol);
+			close(sd);
+			exit (STATE_WARNING);
+		}
+
 		elapsed_time = (double)deltime(tv) / 1.0e6;
 
 		printf
@@ -296,6 +309,9 @@ print_help (void)
 	printf (" %s\n", "-r, --remote-version=STRING");
   printf ("    %s\n", _("Warn if string doesn't match expected server version (ex: OpenSSH_3.9p1)"));
 
+	printf (" %s\n", "-P, --remote-protocol=STRING");
+  printf ("    %s\n", _("Warn if protocol doesn't match expected protocol version (ex: 2.0)"));
+
 	printf (UT_VERBOSE);
 
 	printf (UT_SUPPORT);
-- 
cgit v1.2.3