Monitor a URL which have DUO authentication

[ar0431]

All,

How we can monitor a URL that require DUO authentication for a user?

[ar0431]

I want to give you more detail. So I have a URL before accessing this URL it ask for user name and password then it send a request to Duo to verify the user on the attached mobile where we accept the token. How we can monitor this URL?

[mbellerue]

The tricky thing with 2-factor authentication is that it is designed from the ground up to be a method that ensures an authenticated human is logging in to a system or service.

This poses a significant challenge for automated monitoring. Some services, I believe DUO may be one of them, offers a rolling code provided by a website. It may be possible to grab the code, and present it to the site you want to monitor using the Web Transaction Wizard. But there is no guarantee that the service providing the 2-factor code, in this case DUO, won't change how they are presenting the code on the page specifically for the purposes of breaking automation like this.

With that said. Let's talk about other ways that you may be able to monitor this site. First, is it a site that you own and operate? Do you have access to the server where the site is hosted?

[ar0431]

Yes, I we own the site and operate. I have access on the host. One thing I was thinking that we can exclude the user from DUO proxy to ignore the 2-factor authentication.

[mbellerue]

Yes, I we own the site and operate. I have access on the host. One thing I was thinking that we can exclude the user from DUO proxy to ignore the 2-factor authentication.

If it's possible to have a monitoring user that is not constrained by 2FA, that would be the easiest solution. Of course, do make sure that the monitoring user's access on your web application is very limited.

So the next step is identifying what you want to monitor. Are you just looking to have Nagios login to the web app, and make sure a specific page pulls up to verify that the web app and the login process are working properly?

[ar0431]

After the login we need to verify multiple things. Like we need to verify the status of "tomcat war deployments" or "weblogic app demployments".

[mbellerue]

Excellent, and so presumably the webapp that you are logging in to just gives you a list of "tomcat war deployments" and "weblogic app deployments"? Can you send us a screenshot of what that page, or those pages looks like?

This is definitely going to be a use case for the Web Transaction Wizard, which utilizes WebInject to interact with web pages. We can't create the rules for you, but we can help you troubleshoot the rules as you create them. Here is a link to the WebInject site.
http://www.webinject.org/plugin.html

[ar0431]

ok, I attached a screen shot. This is a weblogic. We have different deployments. We want to monitor the state of the deployments. Some time deployments are in "inactive" state. So when it goes to inactive state, nagios should send alert.
Is there any other way to monitor Weblogic. Because WebInject looks little difficult.

[mbellerue]

Ah, WebLogic, yes. We have a WebLogic Configuration Wizard. Head over to Configure -> Configuration Wizards, and search for WebLogic. If it has been a while since you have installed XI, you might want to update the configuration wizards just to make sure you get the latest and greatest. To update your wizards, head to Admin -> Manage Config Wizards, and click the Check For Updates button. Then scroll down the list and you will be able to see which wizards can be updated.

[ar0431]

I have latest version of Weblogic 1.1.0. I configure this to monitor the state of one "deployment" of weblogic. But it did not work. It always gave the same output. I tested it, to turned off deployment and change the state on weblogic. But it always gave the same output.

"AdminServer is in RUNNING state, status OK"

This is the following command run to check the state of the "deployment" (or component). Maybe I am missing something.

[[email protected] ~]$ /usr/local/nagios/libexec/check_ncpa.py -H satmbeist1.tamusa.tamus.edu -t Linux-tamusa -P 5693 -M plugins/check_wlsagent.sh -q "args=satmbeist1.tamusa.tamus.edu,args=9090,args='username=weblogic&password=dWyRbMW3CfrzpwDDMHiqnssD&hostname=localhost&port=7001&component=BannerEventPublisher-9,1,1'"
AdminServer is in RUNNING state, status OK|