Bash Alerts

biosboy4 · 08-22-2016, 08:13 AM

Hello,

I'm getting ready to write a little bash script to nmap some of our external ports and make sure there is a listening service at the other end.

How do I store "listening service=yes or no" as variable to trigger the smtp alert?

I've done a little bash scripting, but I've yet to work with variables and if's n' things.

Thanks,

biosboy4

grail · 08-22-2016, 08:45 AM

Show us what you have tried?

Here is a reference in case you were unable to find any using your search engine :- http://tldp.org/LDP/abs/html/

biosboy4 · 08-22-2016, 09:10 AM

Thanks for the quick reply!

Code:

nmap -sU -p port#,port# IPADDRESS

returns:

Code:

Host is up (0.00030s latency).
PORT     STATE         SERVICE
****/udp open|filtered unknown
****/udp open|filtered unknown

How do I store the "up" or "open" status as a variable for use? I want to initiate an smtp script if it is found to be down/closed.

grail · 08-22-2016, 12:40 PM

You can store in a variable and perform a regex on it or feed into a loop and test each line as delivered or use something like sed|awk|grep|other to glean the required information.

biosboy4 · 08-22-2016, 04:22 PM

After some reading, I (hopefully) am getting close to finding a way to do it.
How does this look?

Code:

if nmap -sU -p PORT#,PORT# IPADDRESS &> /dev/null
then
    execute smtp script#1
else
    execute smtp script#2
fi

I don't fully understand what "&> /dev/null" is for, nor do I understand "fi", but from what I gather, this is supposed to work. However, when I try to execute the script I get permission denied. I created the script as root, placed it under the home directory, and ran it as root.

Thanks for your help!

biosboy4

grail · 08-22-2016, 04:38 PM

Your 'if' will test whether or not nmap ran successfully, now for some commands, they always run successfully unless called incorrectly, so you may need to know what return status nmap gives when
an error occurs and whether or not this is why script#2 should be executed.

&> /dev/null :- this will take all standard out and standard error and throw it into a black hole so you will see no output from the call to nmap

fi :- for bash this is the closing part of your call to 'if'

As for your errors, you would need to show us what permissions your script has (ls -l script_name) and then paste in the exact error message(s)

Please use [code][/code] tags instead of quote tags for code / data

biosboy4 · 08-23-2016, 06:30 AM

Ok, so I guess I'm pulling my hair out here guys, lol

All I want to do is this:

Run the script from the outside. Have it nmap (or netcat) a particular external IP to check if specific ports are open (and of possible, check to make sure something is listening too.). If for any reason, the script doesn't see something listening on the port, or doesn't see the open ports, I want it to trigger an smtp alert.

I'm literally going bonkers here trying to figure out how to pull any kind of "open/closed/listening" data from nmap or netcat. I'm just not well versed enough yet. Guidance is greatly appreciated right now.

Yes, I said bonkers.

Regards,

biosboy4

Edit:

I think I got it!

Code:

open=`nmap -sU -p port#,port# IPADDRESS | grep "port#" | grep open`
if [ -z "$open" ]; then
  echo "Connection to IPADDRESS on port port#,port# failed"
  exit 1
else
  echo "Connection to IPADDRESS on port port#,port# succeeded"
  exit 0
fi

Am I missing anything/doing something wrong?

keefaz · 08-23-2016, 07:45 AM

Maybe use grepable output for nmap, something like

Code:

if nmap -oG - $host | grep '25/open/tcp' > /dev/null; then
  echo "Port TCP 25 open in $host"
else
  echo "Port TCP 25 closed in $host"
fi

biosboy4 · 08-23-2016, 08:30 AM

I got it working (almost) like this:

Code:

open=`nmap -sU -p port# IPADDRESS | grep "port#" | grep open`
if [ -z "$open" ]; then
  mail -s "SERVER_PORT_Connection_Failure" emailaddress@domain.com <<< 'IPADDRESS:port# failed to connect'
  echo "Connection to IPADDRESS:port# failed"
  exit 1
else
  echo "Connection to IPADDRESS:port# succeeded"
  exit 0
fi

open=`nmap -sU -p port# IPADDRESS | grep "port#" | grep open`
if [ -z "$open" ]; then
  mail -s "SERVER_PORT_Connection_Failure" emailaddress@domain.com <<< 'IPADDRESS:PORT# failed to connect'
  echo "Connection to IPADDRESS:port# failed"
  exit 1
else
  echo "Connection to IPADDRESS:Port# succeeded"
  exit 0
fi

However, nmap seems to be reporting that ANY IP address is up and the ports are listening. It doesn't matter if there is machine on the other side of the IP or not.

Code:

nmap -sU -p port# IPADDRESS

(even ran by itself) ALWAYS returns:

Code:

Host is up (0.0018s latency).
 PORT      STATE         SERVICE
####/udp  open|filtered  unknown

No matter if there is something there or not. What could cause this behaviour from nmap?

Thanks,

biosboy4

keefaz · 08-23-2016, 09:39 AM

It's not easy to read your attempts when you use # as placeholder, # means comment in bash

Better show with actual port number and make ip address a variable, something like:

Code:

nmap -sU -p 25 $IPADDRESS

This way it's easier to check

michaelk · 08-23-2016, 09:49 AM

UDP scanning is more difficult then TCP. Basically a filtered UDP port does not respond so it is classified as open|filtered. The following explains how it works.

https://nmap.org/book/man-port-scanning-techniques.html

biosboy4 · 08-23-2016, 10:58 AM

Quote:

Originally Posted by michaelk

UDP scanning is more difficult then TCP. Basically a filtered UDP port does not respond so it is classified as open|filtered. The following explains how it works.

https://nmap.org/book/man-port-scanning-techniques.html

There is some really great info on that site, thanks!

However, I am pretty much getting the same behaviour from nmap no matter what protocol or IP I use, it always says the host is up and there are ports open.

I tried every protocol and I tried them against ridiculous IP's like 1.2.3.4 and 10.10.35.241, 252.253.252.194, etc.. always "host is up" and ports are usually open, sometimes open | filtered, depending on the protocol.

What in the world is going on? I found a similar thread here, but there was no solution.

https://bbs.archlinux.org/viewtopic.php?id=101868

biosboy4 · 08-25-2016, 06:59 PM

bump.

Im going to try a running this stuff from a fresh debian os to make sure it isnt something crazy these thousands of packages have done to my desktop os.

Its either that or Im missing something simple.

michaelk · 08-25-2016, 07:27 PM

If you bypass the ping test using -Pn a nonexistent host will appear up.

Code:

nmap -Pn -p 631 1.2.3.4

Starting Nmap 6.00 ( http://nmap.org ) at 2016-08-25 19:03 CDT
Nmap scan report for 1.2.3.4
Host is up.
PORT    STATE    SERVICE
631/tcp filtered ipp

Nmap done: 1 IP address (1 host up) scanned in 2.23 seconds

else

Code:

nmap -p 631 1.2.3.4

Starting Nmap 6.00 ( http://nmap.org ) at 2016-08-25 19:00 CDT
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.15 seconds