1 /*****************************************************************************
3 * Monitoring check_radius plugin
6 * Copyright (c) 1999-2008 Monitoring Plugins Development Team
10 * This file contains the check_radius plugin
12 * Tests to see if a radius server is accepting connections.
15 * This program is free software: you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation, either version 3 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program. If not, see <http://www.gnu.org/licenses/>.
29 *****************************************************************************/
31 const char *progname
= "check_radius";
32 const char *copyright
= "2000-2008";
33 const char *email
= "devel@monitoring-plugins.org";
39 #if defined(HAVE_LIBFREERADIUS_CLIENT)
40 #include <freeradius-client.h>
41 #elif defined(HAVE_LIBRADIUSCLIENT_NG)
42 #include <radiusclient-ng.h>
44 #include <radiusclient.h>
47 int process_arguments (int, char **);
48 void print_help (void);
49 void print_usage (void);
51 #if defined(HAVE_LIBFREERADIUS_CLIENT) || defined(HAVE_LIBRADIUSCLIENT_NG)
52 #define my_rc_conf_str(a) rc_conf_str(rch,a)
53 #define my_rc_send_server(a,b) rc_send_server(rch,a,b)
54 #ifdef HAVE_LIBFREERADIUS_CLIENT
55 #define my_rc_buildreq(a,b,c,d,e,f) rc_buildreq(rch,a,b,c,d,(a)->secret,e,f)
57 #define my_rc_buildreq(a,b,c,d,e,f) rc_buildreq(rch,a,b,c,d,e,f)
59 #define my_rc_own_ipaddress() rc_own_ipaddress(rch)
60 #define my_rc_avpair_add(a,b,c,d) rc_avpair_add(rch,a,b,c,-1,d)
61 #define my_rc_read_dictionary(a) rc_read_dictionary(rch, a)
63 #define my_rc_conf_str(a) rc_conf_str(a)
64 #define my_rc_send_server(a,b) rc_send_server(a, b)
65 #define my_rc_buildreq(a,b,c,d,e,f) rc_buildreq(a,b,c,d,e,f)
66 #define my_rc_own_ipaddress() rc_own_ipaddress()
67 #define my_rc_avpair_add(a,b,c,d) rc_avpair_add(a, b, c, d)
68 #define my_rc_read_dictionary(a) rc_read_dictionary(a)
71 /* REJECT_RC is only defined in some version of radiusclient. It has
72 * been reported from radiusclient-ng 0.5.6 on FreeBSD 7.2-RELEASE */
74 #define REJECT_RC BADRESP_RC
77 int my_rc_read_config(char *);
79 #if defined(HAVE_LIBFREERADIUS_CLIENT) || defined(HAVE_LIBRADIUSCLIENT_NG)
80 rc_handle
*rch
= NULL
;
84 char *username
= NULL
;
85 char *password
= NULL
;
87 char *nasipaddress
= NULL
;
89 char *config_file
= NULL
;
90 unsigned short port
= PW_AUTH_UDP_PORT
;
95 /******************************************************************************
97 The (psuedo?)literate programming XML is contained within \@\@\- <XML> \-\@\@
98 tags in the comments. With in the tags, the XML is assembled sequentially.
99 You can define entities in tags. You also have all the #defines available as
102 Please note that all tags must be lowercase to use the DocBook XML DTD.
107 <title>Quick Reference</title>
108 <!-- The refentry forms a manpage -->
111 <manvolnum>5<manvolnum>
114 <refname>&progname;</refname>
115 <refpurpose>&SUMMARY;</refpurpose>
125 <title>Theory, Installation, and Operation</title>
128 <title>General Description</title>
135 <title>Future Enhancements</title>
136 <para>Todo List</para>
138 <listitem>Add option to get password from a secured file rather than the command line</listitem>
144 <title>Functions</title>
146 ******************************************************************************/
151 main (int argc
, char **argv
)
153 char msg
[BUFFER_LEN
];
155 int result
= STATE_UNKNOWN
;
156 uint32_t client_id
, service
;
159 setlocale (LC_ALL
, "");
160 bindtextdomain (PACKAGE
, LOCALEDIR
);
161 textdomain (PACKAGE
);
163 /* Parse extra opts if any */
164 argv
=np_extra_opts (&argc
, argv
, progname
);
166 if (process_arguments (argc
, argv
) == ERROR
)
167 usage4 (_("Could not parse arguments"));
169 str
= strdup ("dictionary");
170 if ((config_file
&& my_rc_read_config (config_file
)) ||
171 my_rc_read_dictionary (my_rc_conf_str (str
)))
172 die (STATE_UNKNOWN
, _("Config file error\n"));
174 service
= PW_AUTHENTICATE_ONLY
;
176 memset (&data
, 0, sizeof(data
));
177 if (!(my_rc_avpair_add (&data
.send_pairs
, PW_SERVICE_TYPE
, &service
, 0) &&
178 my_rc_avpair_add (&data
.send_pairs
, PW_USER_NAME
, username
, 0) &&
179 my_rc_avpair_add (&data
.send_pairs
, PW_USER_PASSWORD
, password
, 0)
181 die (STATE_UNKNOWN
, _("Out of Memory?\n"));
184 if (!(my_rc_avpair_add (&data
.send_pairs
, PW_NAS_IDENTIFIER
, nasid
, 0)))
185 die (STATE_UNKNOWN
, _("Invalid NAS-Identifier\n"));
188 if (nasipaddress
!= NULL
) {
189 if (rc_good_ipaddr (nasipaddress
))
190 die (STATE_UNKNOWN
, _("Invalid NAS-IP-Address\n"));
191 if ((client_id
= rc_get_ipaddr(nasipaddress
)) == 0)
192 die (STATE_UNKNOWN
, _("Invalid NAS-IP-Address\n"));
194 if ((client_id
= my_rc_own_ipaddress ()) == 0)
195 die (STATE_UNKNOWN
, _("Can't find local IP for NAS-IP-Address\n"));
197 if (my_rc_avpair_add (&(data
.send_pairs
), PW_NAS_IP_ADDRESS
, &client_id
, 0) == NULL
)
198 die (STATE_UNKNOWN
, _("Invalid NAS-IP-Address\n"));
200 my_rc_buildreq (&data
, PW_ACCESS_REQUEST
, server
, port
, (int)timeout_interval
,
203 result
= my_rc_send_server (&data
, msg
);
204 rc_avpair_free (data
.send_pairs
);
205 if (data
.receive_pairs
)
206 rc_avpair_free (data
.receive_pairs
);
208 if (result
== TIMEOUT_RC
)
209 die (STATE_CRITICAL
, _("Timeout\n"));
210 if (result
== ERROR_RC
)
211 die (STATE_CRITICAL
, _("Auth Error\n"));
212 if (result
== REJECT_RC
)
213 die (STATE_WARNING
, _("Auth Failed\n"));
214 if (result
== BADRESP_RC
)
215 die (STATE_WARNING
, _("Bad Response\n"));
216 if (expect
&& !strstr (msg
, expect
))
217 die (STATE_WARNING
, "%s\n", msg
);
219 die (STATE_OK
, _("Auth OK\n"));
220 (void)snprintf(msg
, sizeof(msg
), _("Unexpected result code %d"), result
);
221 die (STATE_UNKNOWN
, "%s\n", msg
);
226 /* process command-line arguments */
228 process_arguments (int argc
, char **argv
)
233 static struct option longopts
[] = {
234 {"hostname", required_argument
, 0, 'H'},
235 {"port", required_argument
, 0, 'P'},
236 {"username", required_argument
, 0, 'u'},
237 {"password", required_argument
, 0, 'p'},
238 {"nas-id", required_argument
, 0, 'n'},
239 {"nas-ip-address", required_argument
, 0, 'N'},
240 {"filename", required_argument
, 0, 'F'},
241 {"expect", required_argument
, 0, 'e'},
242 {"retries", required_argument
, 0, 'r'},
243 {"timeout", required_argument
, 0, 't'},
244 {"verbose", no_argument
, 0, 'v'},
245 {"version", no_argument
, 0, 'V'},
246 {"help", no_argument
, 0, 'h'},
251 c
= getopt_long (argc
, argv
, "+hVvH:P:F:u:p:n:N:t:r:e:", longopts
,
254 if (c
== -1 || c
== EOF
|| c
== 1)
258 case '?': /* print short usage statement if args not parsable */
263 case 'V': /* version */
264 print_revision (progname
, NP_VERSION
);
266 case 'v': /* verbose mode */
269 case 'H': /* hostname */
270 if (is_host (optarg
) == FALSE
) {
271 usage2 (_("Invalid hostname/address"), optarg
);
276 if (is_intnonneg (optarg
))
277 port
= atoi (optarg
);
279 usage4 (_("Port must be a positive integer"));
281 case 'u': /* username */
284 case 'p': /* password */
285 password
= strdup(optarg
);
287 /* Delete the password from process list */
288 while (*optarg
!= '\0') {
293 case 'n': /* nas id */
296 case 'N': /* nas ip address */
297 nasipaddress
= optarg
;
299 case 'F': /* configuration file */
300 config_file
= optarg
;
302 case 'e': /* expect */
305 case 'r': /* retries */
306 if (is_intpos (optarg
))
307 retries
= atoi (optarg
);
309 usage4 (_("Number of retries must be a positive integer"));
311 case 't': /* timeout */
312 if (is_intpos (optarg
))
313 timeout_interval
= atoi (optarg
);
315 usage2 (_("Timeout interval must be a positive integer"), optarg
);
321 usage4 (_("Hostname was not supplied"));
322 if (username
== NULL
)
323 usage4 (_("User not specified"));
324 if (password
== NULL
)
325 usage4 (_("Password not specified"));
326 if (config_file
== NULL
)
327 usage4 (_("Configuration file not specified"));
338 xasprintf (&myport
, "%d", PW_AUTH_UDP_PORT
);
340 print_revision (progname
, NP_VERSION
);
342 printf ("Copyright (c) 1999 Robert August Vincent II\n");
343 printf (COPYRIGHT
, copyright
, email
);
345 printf("%s\n", _("Tests to see if a RADIUS server is accepting connections."));
351 printf (UT_HELP_VRSN
);
352 printf (UT_EXTRA_OPTS
);
354 printf (UT_HOST_PORT
, 'P', myport
);
356 printf (" %s\n", "-u, --username=STRING");
357 printf (" %s\n", _("The user to authenticate"));
358 printf (" %s\n", "-p, --password=STRING");
359 printf (" %s\n", _("Password for autentication (SECURITY RISK)"));
360 printf (" %s\n", "-n, --nas-id=STRING");
361 printf (" %s\n", _("NAS identifier"));
362 printf (" %s\n", "-N, --nas-ip-address=STRING");
363 printf (" %s\n", _("NAS IP Address"));
364 printf (" %s\n", "-F, --filename=STRING");
365 printf (" %s\n", _("Configuration file"));
366 printf (" %s\n", "-e, --expect=STRING");
367 printf (" %s\n", _("Response string to expect from the server"));
368 printf (" %s\n", "-r, --retries=INTEGER");
369 printf (" %s\n", _("Number of times to retry a failed connection"));
371 printf (UT_CONN_TIMEOUT
, timeout_interval
);
374 printf ("%s\n", _("This plugin tests a RADIUS server to see if it is accepting connections."));
375 printf ("%s\n", _("The server to test must be specified in the invocation, as well as a user"));
376 printf ("%s\n", _("name and password. A configuration file may also be present. The format of"));
377 printf ("%s\n", _("the configuration file is described in the radiusclient library sources."));
378 printf ("%s\n", _("The password option presents a substantial security issue because the"));
379 printf ("%s\n", _("password can possibly be determined by careful watching of the command line"));
380 printf ("%s\n", _("in a process listing. This risk is exacerbated because the plugin will"));
381 printf ("%s\n", _("typically be executed at regular predictable intervals. Please be sure that"));
382 printf ("%s\n", _("the password used does not allow access to sensitive system resources."));
392 printf ("%s\n", _("Usage:"));
393 printf ("%s -H host -F config_file -u username -p password\n\
394 [-P port] [-t timeout] [-r retries] [-e expect]\n\
395 [-n nas-id] [-N nas-ip-addr]\n", progname
);
400 int my_rc_read_config(char * a
)
402 #if defined(HAVE_LIBFREERADIUS_CLIENT) || defined(HAVE_LIBRADIUSCLIENT_NG)
403 rch
= rc_read_config(a
);
404 return (rch
== NULL
) ? 1 : 0;
406 return rc_read_config(a
);