Check de Nagios para buscar una IP en las DNSBL

Tal como se ha visto anteriormente, para consultar a una determinada DNSBL se puede usar un script en perl. A continuación veremos una check de Nagios para verificar si una determinada lista de IPs se encuentra en alguna DNSBL.

El siguiente check de Nagios toma como argumentos un listado de IPs y comprueba en el listado de blacklists si alguna de las IPs esta listada.

#!/usr/bin/perl -w

use Net::DNS;
my $res   = Net::DNS::Resolver->new;

$res->udp_timeout(5);


my $problems="";
my $incalol=0;

my $listaips="";

@blacklists=("dnsbl.dronebl.org","access.redhawk.org", "bl.csma.biz", "bl.spamcannibal.org", "bl.spamcop.net", "bl.technovision.dk", "blackholes.five-ten-sg.com", "blackholes.wirehub.net", "blacklist.sci.kun.nl", "block.dnsbl.sorbs.net", "blocked.hilli.dk","cart00ney.surriel.com","cbl.abuseat.org","dev.null.dk", "dialup.blacklist.jippg.org", "dialups.mail-abuse.org","dialups.visi.com","dnsbl.ahbl.org","dnsbl.antispam.or.id", "dnsbl.cyberlogic.net","dnsbl.kempt.net", "dnsbl.njabl.org", "dnsbl.sorbs.net", "dnsbl-1.uceprotect.net","dnsbl-2.uceprotect.net", "dnsbl-3.uceprotect.net","dsbl.dnsbl.net.au", "duinv.aupads.org", "dul.dnsbl.sorbs.net","dul.ru", "fl.chickenboner.biz","hil.habeas.com","http.dnsbl.sorbs.net","http.opm.blitzed.org", "intruders.docs.uu.se","korea.services.net", "l1.spews.dnsbl.sorbs.net","l2.spews.dnsbl.sorbs.net","mail-abuse.blacklist.jippg.org","map.spam-rbl.com","misc.dnsbl.sorbs.net", "msgid.bl.gweep.ca", "multihop.dsbl.org", "no-more-funn.moensted.dk","ohps.dnsbl.net.au", "omrs.dnsbl.net.au", "orid.dnsbl.net.au", "orvedb.aupads.org","osps.dnsbl.net.au","osrs.dnsbl.net.au", "owfs.dnsbl.net.au","owps.dnsbl.net.au","probes.dnsbl.net.au","proxy.bl.gweep.ca","psbl.surriel.com","pss.spambusters.org.ar","rbl.schulte.org","rbl.snark.net","rbl.triumf.ca","rdts.dnsbl.net.au","relays.bl.gweep.ca","relays.bl.kundenserver.de","relays.mail-abuse.org","relays.nether.net","ricn.dnsbl.net.au","rmst.dnsbl.net.au","rsbl.aupads.org","sbl.csma.biz", "sbl.spamhaus.org","sbl-xbl.spamhaus.org","smtp.dnsbl.sorbs.net","socks.dnsbl.sorbs.net","socks.opm.blitzed.org","sorbs.dnsbl.net.au","spam.dnsbl.sorbs.net","spam.olsentech.net","spam.wytnij.to","spamguard.leadmon.net","spamsites.dnsbl.net.au","spamsources.fabel.dk", "spews.dnsbl.net.au", "t1.dnsbl.net.au", "ucepn.dnsbl.net.au", "unconfirmed.dsbl.org", "web.dnsbl.sorbs.net","whois.rfc-ignorant.org","will-spam-for-food.eu.org","wingate.opm.blitzed.org","xbl.spamhaus.org", "zen.spamhaus.org","zombie.dnsbl.sorbs.net" );

for $arg (@ARGV)
{
  $arg=~m/(\d+)\.(\d+)\.(\d+)\.(\d+)/;
  $arginv=$4.".".$3.".".$2.".".$1;

  $listaips.=" ".$arg;

  for $bl (@blacklists)
  {

   my $query = $res->search($arginv.".".$bl);

   if ($query)
   {
    $reason=$res->query($arginv.".".$bl, 'TXT');

    $problems.="FOUND $arg in ".$bl."!! (reason: ";

    for $txt ($reason->answer)
    {
        $problems.=$txt->rdatastr if($txt->type eq "TXT");
    }
    $problems.=");; ";

    $incalol++;
   }

  }

}

if($incalol!=0)
{
  print $problems."\n";
  exit 2;
}

print "OK - $listaips comprobado\n";
exit 0;

Para añadir al Nagios primero definimos el comando:

define command{
        command_name    check_multi_dnsbl
        command_line    $USER1$/check_multi_bl $ARG1$
        }

Y a continuación definimos la comprobación en un determinado host con una lista separada por espacios el listado de IPs:

define service{
        use                             local-service
        host_name                       localhost
        service_description             DNS BL
        check_command                   check_multi_dnsbl!1.1.1.1 2.2.2.2
        check_interval                  1440
        notification_interval           1440
        retry_interval                  60
        max_check_attempts              1
        }

Esta comprobación se ejecuta una vez al día (1440 “tiempos” de 60 segundos).

Deberemos tener en cuenta que este check tarda mucho tiempo en completar y según los timeouts se puede alargar más o menos, por lo que seguramente deberemos ajustar el service_check_timeout (se trata de una variable global). Para comprobar una sola IP para un determinado service check con 120 segundos hay suficiente:

service_check_timeout=120

Personalmente desde hace bastante que uso este script en perl pero comprobando solo las listas sbl y xbl de spamhaus. Ayer en security by default publicaron el script am I Spammer?, del cual he “cogido prestado” (también conocido como robado) el array de blacklists para este script.