install Filesys::SmbClient (Filesys/SmbClient)

[avandemore]

$USER1$ is a macro. That usually expands to /usr/local/nagios/libexec but you can see it's definition in /usr/local/nagios/etc/resource.cfg.

That why we tell users to install plugins with this document https://assets.nagios.com/downloads/nag ... ios-XI.pdf

Then test the associated host/service with the Run Check Command in the XI GUI. This will expand $USER1$ as needed.

[SavaSC]

I don't think I've communicated my problem very well. I have uploaded the plugin and have created the command.

My problem is that the syntax I'm using works fine when directly used with the smbclient but fails when the plugin tries to call the smbclient with my syntax. I ripped off most of the code and "Frankensteined" the rest, so I don't know if I got it right. I ran it from the command line to make sure there wasn't a problem with the web interface causing the issue.

I have attached a screenshot of the results of "Run Check Command" from the web interface.

[SteveBeauchemin]

I grabbed your code, it didn't work for me either so I touched it. It works for me now.

try this...

Code: Select all

#!/bin/bash
# uncomment below for debug
#set -x
REVISION=1.2
PROGNAME=`/bin/basename $0`
PROGPATH=`echo $0 | /bin/sed -e 's,[\\/][^\\/][^\\/]*$,,'`

ACCESS_DENIED='NT_STATUS_ACCESS_DENIED'
LOGON_DENIED='NT_STATUS_LOGON_FAILURE'

logon_state=0
acces_state=0

. $PROGPATH/utils.sh

usage () {
    echo "\
Nagios plugin to check Windows share

Usage:
  $PROGNAME -H <host> -U USERNAME -P PASSWORD -D DOMAIN/WORKGROP -S SHARE -M PROTOCOL
"
}

help () {
  print_revision $PROGNAME $REVISION
  echo ""
  usage
  echo "-H ADDRESS"
  echo "   Name or IP address of host"
  echo "-U USERNAME"
  echo "   User with permission to the share"
  echo "-P PASSWORD"
  echo "   User password"
  echo "-D Domain or Workgroup"
  echo "   Name of the Domain or Workgroup needed to authenticate"
  echo "-S SHARE"
  echo "   The file share name on the host"
  echo "-M PROTOCOL"
  echo "   The SMB protocol to use SMB1 SMB2 SMB3 (Default: SMB3)"
  echo "-h"
  echo "   Print this help screen"
  echo "-V"
  echo "   Print version and license information"
  echo ""
  support
}

if [ $# -lt 1 ] || [ $# -gt 12 ]; then
    usage
    exit $STATE_UNKNOWN
fi

while test -n "$1"; do
    case "$1" in
   --help | -h)
       help
       exit $STATE_OK;;
   --version | -V)
       print_revision $PROGNAME $REVISION
       exit $STATE_OK;;
   -H)
       shift
       host=$1;;
   -U)
       shift
       usr=$1;;
   -P)
      shift
      pass=$1;;
   -D)
      shift
      domain=$1;;
   -S)
       shift
       share=$1;;
   -M)
       shift
       prot="${1:-SMB3}"
       ;;
   *)
       usage; exit $STATE_UNKNOWN;;
    esac
    shift
done

protocol="${prot:-SMB3}"

stdout=$(smbclient //$host/$share -U "$usr"%"$pass" -W $domain -m $protocol -c dir 2>&1)


logon_state=$(echo $stdout | grep $LOGON_DENIED | wc -l)
acces_state=$(echo $stdout | grep $ACCESS_DENIED | wc -l)
share_state=$(echo "$stdout" | wc -l)

if [ $logon_state -eq 1 ]; then
    echo "CRITICAL Authentication problem : Check USER/PWD config"
    exit $STATE_CRITICAL
fi

if [ $acces_state -eq 1 ]; then
    echo "CRITICAL Authorization problem : Access denied"
    exit $STATE_CRITICAL
fi

if [[ $acces_state -eq 0 && $logon_state -eq 0 && $share_state -gt 3 ]]; then
    echo "OK Share : $share"
    exit $STATE_OK
fi

echo "Unknown state : $share"
exit $STATE_UNKNOWN

Thanks for letting me have some fun.

Steve B

[dwhitfield]

However, when I run this command, it tells me "No such file or directory"

Code: Select all

$USER1$/check_windows_share -H servername -U username -P password -D domain -S sharename

This is the line @avandemore was addressing, but it's not 100% clear if you were running it as typed or just expanded that yourself manually.

Thanks as always, Steve!

[SteveBeauchemin]

oh yeah...

always

Code: Select all

cd /usr/local/nagios/libexec

and run the code with ./

Code: Select all

./check_blahblah....

[dwhitfield]

@SavaSC, let us know if you still need help after Steve's suggestion!

[SavaSC]

I grabbed your code, it didn't work for me either so I touched it. It works for me now.

try this...

Code: Select all

#!/bin/bash
# uncomment below for debug
#set -x
REVISION=1.2
PROGNAME=`/bin/basename $0`
PROGPATH=`echo $0 | /bin/sed -e 's,[\\/][^\\/][^\\/]*$,,'`

ACCESS_DENIED='NT_STATUS_ACCESS_DENIED'
LOGON_DENIED='NT_STATUS_LOGON_FAILURE'

logon_state=0
acces_state=0

. $PROGPATH/utils.sh

usage () {
    echo "\
Nagios plugin to check Windows share

Usage:
  $PROGNAME -H <host> -U USERNAME -P PASSWORD -D DOMAIN/WORKGROP -S SHARE -M PROTOCOL
"
}

help () {
  print_revision $PROGNAME $REVISION
  echo ""
  usage
  echo "-H ADDRESS"
  echo "   Name or IP address of host"
  echo "-U USERNAME"
  echo "   User with permission to the share"
  echo "-P PASSWORD"
  echo "   User password"
  echo "-D Domain or Workgroup"
  echo "   Name of the Domain or Workgroup needed to authenticate"
  echo "-S SHARE"
  echo "   The file share name on the host"
  echo "-M PROTOCOL"
  echo "   The SMB protocol to use SMB1 SMB2 SMB3 (Default: SMB3)"
  echo "-h"
  echo "   Print this help screen"
  echo "-V"
  echo "   Print version and license information"
  echo ""
  support
}

if [ $# -lt 1 ] || [ $# -gt 12 ]; then
    usage
    exit $STATE_UNKNOWN
fi

while test -n "$1"; do
    case "$1" in
   --help | -h)
       help
       exit $STATE_OK;;
   --version | -V)
       print_revision $PROGNAME $REVISION
       exit $STATE_OK;;
   -H)
       shift
       host=$1;;
   -U)
       shift
       usr=$1;;
   -P)
      shift
      pass=$1;;
   -D)
      shift
      domain=$1;;
   -S)
       shift
       share=$1;;
   -M)
       shift
       prot="${1:-SMB3}"
       ;;
   *)
       usage; exit $STATE_UNKNOWN;;
    esac
    shift
done

protocol="${prot:-SMB3}"

stdout=$(smbclient //$host/$share -U "$usr"%"$pass" -W $domain -m $protocol -c dir 2>&1)


logon_state=$(echo $stdout | grep $LOGON_DENIED | wc -l)
acces_state=$(echo $stdout | grep $ACCESS_DENIED | wc -l)
share_state=$(echo "$stdout" | wc -l)

if [ $logon_state -eq 1 ]; then
    echo "CRITICAL Authentication problem : Check USER/PWD config"
    exit $STATE_CRITICAL
fi

if [ $acces_state -eq 1 ]; then
    echo "CRITICAL Authorization problem : Access denied"
    exit $STATE_CRITICAL
fi

if [[ $acces_state -eq 0 && $logon_state -eq 0 && $share_state -gt 3 ]]; then
    echo "OK Share : $share"
    exit $STATE_OK
fi

echo "Unknown state : $share"
exit $STATE_UNKNOWN

Thanks for letting me have some fun.

Steve B

BRILLIANT!!!! It will now return a positive if it is working correctly.

I did make a *small* change (now that I have your example to go by!) in the code to detect if the share was simply offline. It seemed to work in my tests. Here is my current code.

Code: Select all

#!/bin/sh

#####################################################
# Check Windows share access                        #
#                                                   #
# Steve Beauchemin - 06-06-2017                     #
#                                                   #
# This plugin check access to Windows share         #
# It's testing Authentication and Authorization too #
#                                                   #
# Authentication mean a bad usr/pwd config          #
# Authorization mean a denied access on the share   #
#                                                   #
#                                                   #
# Verified with SMBClient 4.4.4                     #
#####################################################


#!/bin/bash
# uncomment below for debug
#set -x
REVISION=1.2
PROGNAME=`/bin/basename $0`
PROGPATH=`echo $0 | /bin/sed -e 's,[\\/][^\\/][^\\/]*$,,'`

ACCESS_DENIED='NT_STATUS_ACCESS_DENIED'
LOGON_DENIED='NT_STATUS_LOGON_FAILURE'
BAD_NETWORK_NAME='NT_STATUS_BAD_NETWORK_NAME'

logon_state=0
acces_state=0

. $PROGPATH/utils.sh

usage () {
    echo "\
Nagios plugin to check Windows share

Usage:
  $PROGNAME -H <host> -U USERNAME -P PASSWORD -D DOMAIN/WORKGROP -S SHARE -M PROTOCOL
"
}

help () {
  print_revision $PROGNAME $REVISION
  echo ""
  usage
  echo "-H ADDRESS"
  echo "   Name or IP address of host"
  echo "-U USERNAME"
  echo "   User with permission to the share"
  echo "-P PASSWORD"
  echo "   User password"
  echo "-D Domain or Workgroup"
  echo "   Name of the Domain or Workgroup needed to authenticate"
  echo "-S SHARE"
  echo "   The file share name on the host"
  echo "-M PROTOCOL"
  echo "   The SMB protocol to use SMB1 SMB2 SMB3 (Default: SMB3)"
  echo "-h"
  echo "   Print this help screen"
  echo "-V"
  echo "   Print version and license information"
  echo ""
  support
}

if [ $# -lt 1 ] || [ $# -gt 12 ]; then
    usage
    exit $STATE_UNKNOWN
fi

while test -n "$1"; do
    case "$1" in
   --help | -h)
       help
       exit $STATE_OK;;
   --version | -V)
       print_revision $PROGNAME $REVISION
       exit $STATE_OK;;
   -H)
       shift
       host=$1;;
   -U)
       shift
       usr=$1;;
   -P)
      shift
      pass=$1;;
   -D)
      shift
      domain=$1;;
   -S)
       shift
       share=$1;;
   -M)
       shift
       prot="${1:-SMB3}"
       ;;
   *)
       usage; exit $STATE_UNKNOWN;;
    esac
    shift
done

protocol="${prot:-SMB3}"

stdout=$(smbclient //$host/$share -U "$usr"%"$pass" -W $domain -m $protocol -c dir 2>&1)


logon_state=$(echo $stdout | grep $LOGON_DENIED | wc -l)
acces_state=$(echo $stdout | grep $ACCESS_DENIED | wc -l)
share_exists=$(echo $stdout | grep $BAD_NETWORK_NAME | wc -l)
share_state=$(echo "$stdout" | wc -l)

if [ $logon_state -eq 1 ]; then
    echo "CRITICAL Authentication problem : Check USER/PWD config"
    exit $STATE_CRITICAL
fi

if [ $acces_state -eq 1 ]; then
    echo "CRITICAL Authorization problem : Access denied"
    exit $STATE_CRITICAL
fi

if [ $share_exists -eq 1 ]; then	
	echo "CRITICAL: Share $share not avalible."
	exit $STATE_CRITICAL
fi

if [[ $acces_state -eq 0 && $logon_state -eq 0 && $share_state -gt 3 ]]; then
    echo "OK Share : $share"
    exit $STATE_OK
fi

echo "Unknown state : $share"
exit $STATE_UNKNOWN

[dwhitfield]

It sounds like this issue has been resolved. Is it okay if we lock this thread? Thanks for choosing the Nagios forums!

[SavaSC]

It sounds like this issue has been resolved. Is it okay if we lock this thread? Thanks for choosing the Nagios forums!

Yes, you may close this. Thank y'all again for your help!

BTW, you should put Steve's plugin out on the repository. I can't be the only person who needs SMB2/3 monitoring.

[dwhitfield]

you should put Steve's plugin out on the repository.

Anyone is welcome to post to exchange.nagios.com. It's best that the original writer upload. That way, if there are updates, the author is able to maintain the updates.