Install Nagios on Linux

Install Nagios on Linux

Introduction:-

Nagios is a powerful monitoring system that enables organizations to identify and resolve IT infrastructure problems before they affect critical business processes. Nagios is a popular open source computer system and network monitoring software application. It watches hosts and services, alerting users when things go wrong and again when they get better.

Nagios was designed for use with the Linux operating system, but it will also work under Unix and most Unix-based systems. Nagios runs periodic checks on user-specified resources and services. Resources that can be monitored include memory

Prerequisites:-
Make sure you've installed the following packages on your Linux installation before continuing.

• Apache
• PHP
• GCC compiler
• GD development libraries
  

• IP = 192.168.1.1
• HOSTNAME = server.anup.co.in
• Firewall and Selinux must be disabled.

1] Install gcc compiler, gd development libraries

[root@server ~]# yum install gd gd-devel gcc glibc glibc-common -y

2] Install http package for nagios web-interface

[root@server ~]# yum install httpd php -y

3] Create new user account and assign it password

[root@server ~]# useradd nagios

[root@server ~]# passwd nagios

[ Note = apache user already created ]

4] Create a new nagcmd group for allowing external commands to be submitted through the web interface. Add both the nagios user and the apache user to the group.

[root@server ~]# groupadd nagcmd

[root@server ~]# usermod -G nagcmd nagios

[root@server ~]# usermod -G nagcmd apache

5] Download nagios and plugins from following links.

Create a directory for storing the downloads.

[root@server ~]# mkdir /root/downloads

[root@server ~]# cd /root/downloads

Nagios Download Link =

[root@server downloads]# wget http://sourceforge.net/projects/nagios/files/nagios-3.x/nagios-3.3.1/nagios-3.3.1.tar.gz/download

Plugins Download Link =

[root@server downloads]# wget http://sourceforge.net/projects/nagiosplug/files/nagiosplug/1.4.15/nagios-plugins-1.4.15.tar.gz/download

6] Now compile and install nagios

[root@server downloads]# tar -xvzf nagios-3.3.1.tar.gz

[root@server downloads]# cd nagios

[root@server nagios]# ./configure --with-command-group=nagcmd

[root@server nagios]# make all

7] Now install bineries, init script

[root@server nagios]# make install

[root@server nagios]# make install-init

[root@server nagios]# make install-config

[root@server nagios]# make install-commandmode

8] Install web config file for nagios web-interface

[root@server nagios]# make install-webconf

[root@server nagios]# cd

9] Create a nagiosadmin account for logging into the Nagios web interface. Remember the password you assign to this account – you’ll need it later.

[root@server ~]# htpasswd -c /usr/local/nagios/etc/htpasswd.users nagios

10] Now compile and install nagios plugins

[root@server ~]# cd /root/downloads

[root@server downloads]# tar -xvzf nagios-plugins-1.4.15.tar.gz

[root@server downloads]# cd nagios-plugins-1.4.15

[root@server nagios-plugins-1.4.15]# ./configure --with-nagios-user=nagios --with-nagios-group=nagios

[root@server nagios-plugins-1.4.15]# make

[root@server nagios-plugins-1.4.15]# make install

[root@server ~]# cd

13] Start nagios service ( Add Nagios to the list of system services and have it automatically start when the system boots. )

[root@server ~]# chkconfig --add nagios

[root@server ~]# chkconfig nagios on

14] Verify the sample nagios configuration file

[root@server ~]# /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

15] If there are no error start nagios and httpd (for nagios web-interface)service

[root@server ~]# service nagios start

[root@server ~]# service httpd restart

16] If you done this successfully then login to Nagios Web-interface

[ Note = You should now be able to access the Nagios web interface at the URL below. You'll be prompted for the username (nagiosadmin) and password you specified earlier. ]

URL is = http://<nagios server ip/nagios

Example = http://192.168.1.1/nagios

How to install Nagios Arana Theme ?

1] Move old Nagios theme into new folder.

[root@server ~]# mkdir /usr/local/nagios/share/old-theme
[root@server ~]# mv /usr/local/nagios/share/* old-theme

2] Download Arana Theme.

[root@server ~]# cd /usr/local/nagios/share
[root@server share]# wget http://kaz.dl.sourceforge.net/project/arana-nagios/arana_style-1.0for-Nagios3x-ENG.zip

[root@server share]# unzip arana_style-1.0for-Nagios3x-ENG.zip
[root@server share]# cd

3] Restart Nagios.

[root@server ~]# service nagios reload

RkHunter Installtion

RKHunter [Rootkit Hunter]

====================

RootKit is a feature rich scanning tool that scans for rootkits, backdoors, and local exploits. It scans hidden files, wrong permissions set on binaries, suspicious strings in kernel etc.

As rootkits are installed into system files they cannot be removed easily however, RKHunter will still notify you of any rootkits that may exist in your system so that you can take the necessary steps to reload on server. 

Rootkit Hunter is not a reactive tool: it only enumerates encountered threats.

It is up to you to read the log file and investigate suspicious activity.

To know more about Rkhunter and its features visit http://www.rootkit.nl/.

================================== ==============

Installing Rkhunter (Rootkit Hunter) in RHEL, CentOS and Fedora

================================== ==============

Step 1: Downloading Rkhunter:

[root@server ~]# mkdir /download

[root@server ~]# cd /download

[root@server download]# wget http://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.0/rkhunter-1.4.0.tar.gz

Step 2: Installing Rkhunter:

Once you have downloaded the latest version, run the following commands as a root user to install it.

[root@server download]# tar -xvzf rkhunter-1.4.0.tar.gz

[root@server download]# cd rkhunter-1.4.0

[root@server rkhunter-1.4.0]# ./installer.sh --install

[root@server rkhunter-1.4.0]# cd 

Step 3: Updating Rkhunter:

Run the RKH updater to fill the database properties by running the following command.

[root@server ~]# /usr/local/bin/rkhunter --update

[root@server ~]# /usr/local/bin/rkhunter --propupd 

Step 4: Setting Cronjob and Email Alerts:

Create one file "rkhunter.sh under /etc/cron.daily/, which then scans your file system every day and sends email notifications to your email id. 

[root@server ~]# vi /etc/cron.daily/rkhunter.sh

#Add the following lines of code to it and replace your “Server Name” and your “Email Id“.

#!/bin/sh

(

/usr/local/bin/rkhunter --versioncheck

/usr/local/bin/rkhunter --update

/usr/local/bin/rkhunter --cronjob --report-warnings-only

) | /bin/mail -s 'rkhunter Daily Run (server.anup.co.in)' mail@anup.co.in 

Set execute permission on the file.

[root@server ~]# chmod +x /etc/cron.daily/rkhunter.sh 

Step 5: Manual Scan and Usage:

To scan the entire file system, run the Rkhunter as a root user.

[root@server ~]# rkhunter --check

The above command generates log file under /var/log/rkhunter.log with the checks results made by Rkhunter. 

For more information and options please run the following command.

[root@server ~]# rkhunter --help

Serial key for VMware Workstation 9

Serial key for VMware Workstation 9

 

     VMWare workstation is a free virtualization product that installs on any existing server or powerful PC hardware and partitions a physical computer or server into multiple virtual machines by abstracting processor, memory, storage and networking resources, and thus able to further fully utilize the hardware and have the flexibility to run another same or operating system without the need of new computer.

To install VMWare Workstation, users need to have serial number or product key. 

VMware Workstation 8 Serial Key: 

0A494-8U0EM-UZ2A9-0105M-A303M

MA406-25387-7ZNW8-F197P-1AL2D

4A4GP-6PLD0-QZTP9-WK0NK-C3UQD

4A2XP-D03DN-7Z6H9-Z2ANM-0C9PFD

0F0G8-FK29Q-AZ529-2J1NP-AC02F 

VMware Workstation 9 Serial Key: 

0F23V-4D38L-9ZQ38-2K37H-83C50

0F03K-80JEQ-8ZF89-8287H-A2R47

0A22R-400EM-EZ4W8-3K9NK-3AUPL

NA64Z-0V054-UZVC0-2L370-837K4 

Try above serial keys

Configuring A High Availability Cluster (Heartbeat) On CentOS

      In this example we will configure a webserver using apache and we will cluster it. It can be implemented on centos, fedora and other redhat flavors.

Pre-Configuration Requirements

1] Following are the hostnames and ipv4 addresses that will be used:

• Primary Node : IP - 192.168.1.1 Hostname - server1.linuxhome.in 
• Secondary Node : IP - 192.168.1.2 Hostname - server2.linuxhome.in 
• Virtual IP for Apache - 192.168.1.100
  

Assign virtual IP address using following steps on both node :

# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0:0

DEVICE=eth0 :0

BOOTPROTO=none

BROADCAST=192.168.1.255

HWADDR=00:15:17:a3:92:04

IPADDR=192.168.1.100

NETMASK=255.255.255.0

ONBOOT=yes

TYPE=Ethernet

2] Download and install the heartbeat package. In our case we are using CentOS so we will install heartbeat with yum:

[root@server1 ~]# yum install heartbeat

or download below package

heartbeat-2.08
heartbeat-pils-2.08
heartbeat-stonith-2.08

3] Now we have to configure heartbeat on our two node cluster. We will deal with three files. These are: (authkeys, ha.cf, haresources)

[root@server1 ~]# cp /usr/share/doc/heartbeat-2.1.2/{authkeys,ha.cf,haresources} /etc/ha.d/

4] First we will deal with the authkeys file, we will use authentication method 2 (sha1). For this we will make changes in the authkeys file as below.

[root@server1 ~]# vi /etc/ha.d/authkeys

Add the following lines at the end of file & save:

auth 2
2 sha1 test-ha

5] Also the authkeys file must be read only root:

[root@server1 ~]# chmod 600 /etc/ha.d/authkeys

6] Make changes in second file of hearteat (haresources) :

[root@server1 ~]# vi /etc/ha.d/ haresources

#Add the following line at the end of file & save:

server1.linuxhome.in  192.168.1.100  httpd

7] The final piece of work in our configuration is to edit the ha.cf file which is important :

[root@server1 ~]# vi /etc/ha.d/ha.cf

#Add / Uncommnet below lines in ha.cf file & save.

logfile /var/log/ha-log
logfacility local0
keepalive 2
deadtime 30
initdead 120
bcast eth0
udpport 694
auto_failback on
node server1.linuxhome.in
node server2.linuxhome.in

8] As we want httpd highly enabled let's start configuring httpd:

[root@server1 ~]# vi /etc/httpd/conf/httpd.conf
#Add following line:
Listen 192.168.1.100:80

9] Copy the /etc/ha.d/ directory from server1 to server2:

[root@server1 ~]# scp -rvp /etc/ha.d/ root@server2.linuxhome.in:/etc/

10] Copy httpd.conf file from server1 to server2:

[root@server1 ~]# scp -rvp /etc/httpd/conf/httpd.conf root@server2.linuxhome.in:/etc/httpd/conf/

11] Create index.html file on both server under /var/www/html directory.

On server1.linuxhome.in
[root@server1 ~]# echo "SERVER1 Apache test server" > /var/www/html/index.html

On server2.linuxhome.in
[root@server2 ~]# echo "SERVER2 Apache test server" > /var/www/html/index.html

12 ] Now start heartbeat on the primary server1 and slave server2:

# /etc/init.d/heartbeat start
13] Open web-browser and type in the URL:
http://192.168.1.100
It will show server1.linuxhome.in apache test server.
13. Now stop the hearbeat daemon on server1.linuxhome.in:
# /etc/init.d/heartbeat stop
In your browser type in the URL http://192.168.1.100 and press enter.
It will show server2.linuxhome.in apache test server.

Install and configure Apache with PHP on Windows machine

-->

Install and configure Apache with PHP on Windows machine :

Apache Installation :

1] Download the latest apache at http://httpd.apache.org/download.cgi

2] Run the installer apache_2.2.9-win32-x86-no_ssl-r2.msi.

3] First screen is the welcome note. Click Next.

4] Second screen is the licence agreement. Accept the terms in the license agreement, click Next.

5] Third screen, brief desription of the software. Next.

6] Server Information Dialogue will ask you for the following values:

Network Domain – name of your computer across a network connection. To know the Full Computer Name, right-click My Computer icon, choose Properties, click Computer Name Tab, and look for Full computer name. Or you can simply type localhost as its value.
Server Name – the same value with the Network Domain. Or localhost.
Admnistrator’s Email Address
Choose the radio button for All Users, on Port 80, as a Service. Click Next.

7] Select Typical for Set up Type. Next

8] Select Typical for Set up Type. Next

9] Destination Folder. Leave the default value, click Next.

10] Next screen is Ready to Install the Program. Click Install.

11] To Test Your Installation
Open a browser and point to http://localhost or http://127.0.0.1/. You should see the Apache Installation page.

PHP Configuration :

1] Download the latest php at http://www.php.net/downloads.php .

2] Unzip the contents of php-5.2.6-Win32.zip package to C:\PHP folder.

3] Find and rename the file php.ini-recommended to php.ini under PHP folder.

4] Open the file php.ini, look and uncomment the following directives (Click Edit > Find or Ctrl F) and save file.

[ Uncomment – remove the ; before a directive to activate it. ]

-->
display_errors = on
register_globals = off
magic_quotes_gpc = on
extension_dir = /PHP/ext
session.save_path = /tmp Create a folder named TMP under the root directory (Drive C:)
extension=php_mbstring.dll
extension=php_mysql.dll

--> 5] Attach PHP to Apache as a module. Open the Apache configuration file (C:\Program Files\Apache Software Foundation\Apache2.2\Conf\httpd.conf).
Search for LoadModule. Add this at the end:
#LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule php5_module "c:/php/php5apache2_2.dll"
PHPIniDir "C:/PHP"
Search for DirectoryIndex and add index.php.<IfModule dir_module>
DirectoryIndex index.php index.html
</IfModule>
Add the following under <IfModule mime_module>:AddType application/x-httpd-php .php

6] Copy libmysql.dll file from your C:\PHP folder to the C:\WINNT\system32 directory or C:\Windows\System32 directory(Windows XP).

7] Restart Apache.
To Test PHP
Create phpinfo.php, type:<?php echo phpinfo(); ?>
Save as phpinfo.php in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\
8] Open a browser and point to http://localhost/phpinfo.php or http://127.0.0.1/phpinfo.php .

Find and Replace work in Multiple Files

Easy Search and Replace word in Multiple Files on Linux Command Line

I was trying to find a solution to do a find & replace word across multiple files which was purely command line based. There are plenty of scripts out there which will accomplish this but I needed a single line command. After some google searches and some experimentation I came up with this snippet.

Syntax : [root@server ~]# grep -lr -e '<oldword>' * | xargs sed -i 's/<oldword>/<newword>/g'

Example : [root@server ~]# grep -lr -e 'country' * | xargs sed -i 's/country/India/g'

This command broken down:

• grep for the word in a files, use recursion (to find files in sub directories), and list only file matches
• xargs passes the results from the grep command to sed
• sed -i uses a regular expression (regex) to evaluate the change: s (search) / search word / target word / g (global replace)
  

Find & Replace word of specific files:
I want to replace the word “country” with “India” from those files which are having “.php” extension. To do so use the following command :
Syntax : [root@server ~]# find . -name “*.php” -print | xargs sed -i 's/old word/new word/g'

Example : [root@server ~]# find . -name “*.php” -print | xargs sed -i 's/country/India/g'

It looks bit complicated but quite simple. There are three components to the command.

1. find . -name "*.php" -print – Find all files (recursively) which has “.php” in the file and print them out. This will give you output like this:
   

   ./file.php
   ./includes/test.php
   ./classes/class.php

2. xargs- This command is used when you want to pass a lot of arguments to one command. xargs will combine the single line output of find and run commands with multiple
   arguments, multiple times if necessary to avoid the max chars per line limit. In this case we combine xargs with sed
3. sed -i 's/country/India/g' – Stream Editor is a tool which should be in every sys admin’s toolkit. In this case every occurence of “country” is replaced by “India” in all the files found using the “find” command. Sed simply parses input and applies certain text transformations to it.
   

How to Find and Check Number of Connections to a Server

    Whenever a client connects to a server via network, a connection is established and opened on the system. On a busy high load server, the number of connections connected to the server can be run into large amount till hundreds if not thousands. Find out and get a list of connections on the server by each node, client or IP address is useful for system scaling planning, and in most cases, detect and determine whether a web server is under DoS or DDoS attack (Distributed Denial of Service), where an IP sends large amount of connections to the server. To check connection numbers on the server, administrators and webmasters can make use of netstat command.

      Below is some of the example a typically use command syntax for ‘netstat’ to check and show the number of connections a server has. Users can also use ‘man netstat’ command to get detailed netstat help and manual where there are lots of configurable options and flags to get meaningful lists and ​.

1] Display all active Internet connections to the servers and only established connections are included.
[root@server ~]# netstat -na

2] Show only active Internet connections to the server at port 80 and sort the results. Useful in detecting single flood by allowing users to recognize many connections coming from one IP.

[root@server ~]# netstat -an | grep :80 | sort

3] Let users know how many active SYNC_REC are occurring and happening on the server. The number should be pretty low, preferably less than 5. On DoS attack incident or mail bombed, the number can jump to twins. However, the value always depends on system, so a high value may be average in another server.

[root@server ~]# netstat -n -p|grep SYN_REC | wc -l

4] List out the all IP addresses involved instead of just count.

[root@server ~]# netstat -n -p | grep SYN_REC | sort -u

5] List all the unique IP addresses of the node that are sending SYN_REC connection status.

[root@server ~]# netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'

6] Use netstat command to calculate and count the number of connections each IP address makes to the server.

[root@server ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

7] List count of number of connections the IPs are connected to the server using TCP or UDP protocol.

[root@server ~]# netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

8] Check on ESTABLISHED connections instead of all connections, and displays the connections count for each IP.

[root@server ~]# netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

9] Show and list IP address and its connection count that connect to port 80 on the server. Port 80 is used mainly by HTTP web page request.

[root@server ~]# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1