Nagios – Checking if we are on SPAM blacklists

What's up txabales!!! We come with something that can fit us all! Anyone who has a Nagios or Centreon environment already set up (or want to cheer up), Why don't we control if our public IPs or the IP addresses through which our organization's mail leaves are blacklisted?? So far we know how we found out that you are on blacklists… Why either the mail doesn't go out or doesn't come in?, No? Get ahead of the curve and check the main blacklists!!

 

With a great script, Called 'check_rbl', we will be able to check at a glance if we are on the blacklists of Spammers, will look at SORBS, Spamhaus, SpamCop, Mail abuse or RFC Ignorant among others! We download the https://exchange.nagios.org/directory/Plugins/Email-and-Groupware/check_rbl-2Epl/details, we downloaded it to the Nagios plugin directory ('/usr/lib/nagios/plugins') or Centreon ('/usr/lib/centreon/plugins'), it depends on what each one 😉 uses and then remember to make it executable ('chmod +x check_rbl')!

 

If when executing it we get the error, We may need to fix the Perl path, in my case, I had a mistake 'Bash: ./check_rbl: /usr/bin/perl^M: bad interpreter: No such file or directory', I had to modify the first line of 'check_rbl', thus ' #!/usr/bin/perl -w'.

 

We try from the shell, we pass the command and put either a public address or an FQDN as a parameter. This would be the example format:

[SourceCode]./check_rbl DIRECCION_IP_PUBLICA[/SourceCode]

 

 

As usual, we must register the Command that we are going to execute from Centreon, We will go to “Configuration” > “Commands” > “Add” or we clone an existing one, as usual! And we modified at least the following data:

  • Command Name: Specify the name of the command, As I always tell you, I usually use the name of the script to locate it as quickly as possible if necessary.
  • Command Type: We mark 'Check'.
  • Command Line: We enter what this command will execute, in the example that concerns us: '/usr/lib/nagios/plugins/check_rbl $ARG 1$’
  • Argument Description: Click on 'Describe arguments'’ and we define each ARGx variable with what we want to see later when creating the services, as we see I indicate 'public IP or hostname to check'.

We keep with “Save”,

 

And when we already have the Command created in Centreon, Well, we will be able to create as many services that we are interested in controlling, Obviously,, we will create a Service with each public IP and/or FQDN hostname that we want to check. If we have 2 WAN, We will monitor them, in addition to MX records, if they are on public hosting, etc, etc…. We created the Service because, “Configuration” > “Services” > “Add” or we clone an existing one, We leave the following parameters at least:

  • Description: It will be the name of the service with which we will see in the monitoring.
  • Linked with Hosts: We associate it with a Host, usually with the mail server, For having it organized.
  • Template: We indicate the parent template from which you will inherit certain settings, if we did it on that template, as always when the usual thing is to modify notifications, Periods, Contacts, etc… Usually it will be the 'generic-active-service-custom'.
  • Check Command: Select the command we just created in the previous step, 'check_rbl'.
  • Args: When you select this command, you will get the arguments it asks for, ¿No? We remind you that we indicated that you will have to enter the public IP or FQDN, this would be the place to put said IP.

 

We keep with “Save”,

 

 

And it's that simple, now, as usual, remember to export the data and reload the settings so that Centreon can read the new changes we just put in. I remind you, we'll go to "Configuration" > "Pollers" > "Export configuration", Selecting our poller, We mark the checks and restart & "Export".

Once everything is generated, we can go to the part of “Monitoring” and check it out! Si queremos forzar el checkeo, ya sabemos, select the services that interest us and in the combo select 'Services – Schedule immediate check (Forced)’. You should check our public IPs or external DNS names now if they are blacklisted!!! Enjoy!!! Monitor everything!!! Even Grandma!!! 😉

 

Recommended Posts

Author

nheobug@bujarra.com
Autor del blog Bujarra.com Cualquier necesidad que tengas, Do not hesitate to contact me, I will try to help you whenever I can, Sharing is living ;) . Enjoy documents!!!