Nagios Support Forum

Code: Select all

rpm -qa | grep openssl
cat /etc/*elease
uname -a

Code: Select all

Add the attached file to your nagios server in /tmp
chmod +x /tmp/check_ciphers.sh
/tmp/check_ciphers.sh -s [hostname or ip of web server] -d 1 -l /tmp/cipher-log -p 443

Code: Select all

cd /tmp
./check_ciphers.sh -s 23.58.34.254 -d 1 -l /tmp/cipher-log1 -p 443

Code: Select all

cat /tmp/check_ciphers.sh

Code: Select all

vi /tmp/check_ciphers.sh

Code: Select all

:set ff?

Code: Select all

#!/usr/bin/env bash

## enable file and stdout logging.
logit() {
        if [[ -z $LOG ]]; then
                printf "%s\n" "$1"
        else
                printf "%s\n" "$1" | tee -a "$LOG"
        fi
}

## Main function to test all supported local ciphers against remote systems and
verify mutual ciphers.
check_ssl_ciphers() {

        ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')

        logit "Obtaining cipher list from $(openssl version)."

        for cipher in ${ciphers[@]}; do
                result="Testing $cipher..."
                check_res+=$(echo -n | openssl s_client -cipher "$cipher" -conne
ct $SERVER:$PORT 2>&1)
                if [[ $VERBOSE -eq 1 ]]; then
                        echo "$check_res"
                fi

                if [[ "$check_res" =~ "Cipher is ${cipher}" || "$check_res" =~ "
Cipher    :" ]] ; then
                  result+="YES"
                else
                  if [[ "$result" =~ ":error:" ]] ; then
                        error=$(echo -n $result | cut -d':' -f6)
                        result+="NO ($error)"
                  else
                        result+="UNKNOWN RESPONSE"
                  fi
                fi

                logit "$result"
                sleep $DELAY
        done
}

## usage ...
usage() {
        cat <<EOF
Usage: $0 [options]

This script is intended to check a your local openssl version, against a remote
servers supported ciphers.
NMAP may be used as a one-line alternative as well with: nmap --script ssl-enum-
ciphers -p 443 www.example.com
Note: Despite the name, this is not an appropriate nagios plugin! It should only
 be used for manual validation of ciphers.

-s - Server name or IP.
-p - Remote server port.
-d - Delay between requests.
-l - Log file for output.
-v - Verbose output.
-h - This output.

EOF
}

## Handle cli arguments
while getopts "hvd:l:s:p:" opt
        do
        case $opt in
                h)
                        usage
                        exit 0
                        ;;
                d)
                        DELAY=$OPTARG
                        ;;
                l)
                        LOG="$OPTARG"
                        ;;
                s)
                        SERVER="$OPTARG"
                        ;;
                p)
                        PORT=$OPTARG
                        ;;
                v)
                        VERBOSE=1
                        ;;
                ?)
                        usage
                        exit 1
                        ;;
        esac
done

## Validate necessary args
if [[ -z $SERVER ]]; then
        echo ERROR: Server address is required.
        usage
        exit 1
fi
if [[ -z $PORT ]]; then
        echo WARNING: Using default port of 443.
        PORT=443
fi
if [[ -z $DELAY ]]; then
        echo WARNING: Using default delay of 1.
        DELAY=1
fi
if [[ -z $VERBOSE ]]; then
        VERBOSE=0
fi

## execute main()
check_ssl_ciphers