Cisco IPS Management

This script can be used as two separate service checks and also as an event handler to reset the sensor if needed.

The main check (-c) provides the following information from the sensor:
-Service & Signature Pack Versions (can be checked against expected versions using -v)
--Exceptions can be made by individual sensor. Warning state is triggered if versions do not match
-Hardware Platform
-Serial Number
-License (warning state if license expires within -L days, critical state if license is expired)
-Uptime
-Missed Packet Percentage (Average of missed packet percentage for all sensing interfaces)
--Will trigger a warning state if no active sensing interfaces are found
-MainApp/AnalysisEngine (SensorApp) Version & Status
--Intended to be used with -r reset event handler to reset the sensor if AnalysisEngine is NotRunning

The users check (-e) can be used in conjunction with the -c check (and -U/--user-data-dir option) to verify that the correct user accounts are configured on the sensor.

The reset (-r) option can be configured as an event handler to reset the sensor when needed, especially if the AnalysisEngine (SensorApp) is found to be 'NotRunning'.

USAGE INFORMATION:
FUNCTIONS:
-c, --check
Perform the Cisco IPS health check
-e, --examine-users
Examine the data stored in the file that is output from -c -U/--user-data-dir file
-r, --reset=SERVICESTATE,OUTPUT
Attempt to connect to the sensor and reset it. Intended for when Analysis Engine is in status 'NotRunning'
(Reset the sensor if SERVICESTATE is critical and OUTPUT contains NotRunning)

OPTIONS:
-C, --critical-users=USERS
A comma separated list of users expected to be found on the IPS device (-e check only)
-D, --domain=DOMAIN
Domain to append to hostname (Example: If -H abc and -D def.org, connection will be made to abc.def.org)
-d, --debug
Print debug information while running the check. Can be used with Nagios 3 to provide multiline output
-H, --hostname=HOST
IP or hostname of the Cisco IPS sensor
-h, --help
Print this help screen
-I, --interval=MINUTES
Trigger a warning when the stored user data is older than interval (-e check only)
-i, --identity-file=SSHPRIVATEKEY
Private key to be used to log into the sensor (-c and -r only)
-L, --license-threshold=DAYS
Warn if remaining days of license fall below this threshold. Default: 7 (-c check only)
-l, --log=LOGFILE
Log results of the check to the LOGFILE. Recommended for sensor resets (-c and -r only)
-o, --options=ARGUMENTS
Used to pass SSH configuration file style options. For details see ssh_config(5) (-c and -r only)
-p, --password=PASSWORD
Password to log into the sensor (-c and -r only)
-t, --timeout=TIMEOUT
Timeout for connecting to the host and expect commands in seconds. Default: 10 (-c and -r only)
-U, --user-data-dir=USERDIR
Directory to log users data file to, to verify certain users are configured on the sensor (-c and -e only)
-u, --username=USER
Username to log into the sensor (-c and -r only)
-v, --versions=VERSIONFILE
File that contains service and signature pack versions to compare against (-c only)
FORMAT:
all,service pack version,sig pack version (the versions all sensors should be at)
hostname,service pack version,sig pack version (individual exceptions)

SECURITY WARNING:
If you provide a password as an argument to this check it will be visible to any
user that has access to view running processes of the Nagios user or that has
access to your Nagios configuration files.

It is possible to add SSH version 1 authorized keys to the sensor using the
'ssh authorized-key' command in config mode. This can be used to eliminate the
need of using a password to access the sensor.

The service account functionality on the Cisco IPS is not officially supported
It is intended only for TAC support. However, it can be used in order to add
a SSH version 2 public key to the authorized_keys file of a particular user.
Please see the following for more information about the service account:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliTasks.html#wp1073485

The following Perl modules can be found on CPAN and are required:
Date::Manip (calculate the amount of time left on the license)
Expect (connect to the sensor using expect and SSH)
IO::Capture::Stdout (capture stdout returned from expect)
Term::ReadKey (only required for reading a password from the user - for testing)

This plugin has been developed and tested with Nagios 3, but should be compatible with earlier versions.