Mirrors/Munin-Contrib
1
0
Fork 0
mirror of https://github.com/munin-monitoring/contrib.git synced 2025-07-22 02:51:03 +00:00
Code Issues Releases Wiki Activity

Merge pull request #1217 from Wicloz/patch-1 (improve debian/debsecan_ plugin)

Browse source 
Add suggest capabilities to the debian/debsecan_ plugin.
This commit is contained in:
Lars Kruse 2021-07-15 23:18:43 +02:00 • committed by GitHub
commit 839a29e942
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 112 additions and 101 deletions
Download patch file Download diff file Expand all files Collapse all files

187
plugins/debian/debsecan_
View file

@ -36,6 +36,7 @@ Shell globbing patterns are allowed.
* Nicolas BOUTHORS <nbouthors@nbi.fr> http://nbi.fr/, Inspiration of the moment 10/10/2007 * Nicolas BOUTHORS <nbouthors@nbi.fr> http://nbi.fr/, Inspiration of the moment 10/10/2007
* Olivier Mehani <shtrom+munin@ssji.net>, 2016 * Olivier Mehani <shtrom+munin@ssji.net>, 2016
* Wilco de Boer <deboer.wilco@gmail.com>, 2021
=head1 LICENSE =head1 LICENSE
@ -43,13 +44,13 @@ Public Domain
=head1 MAGIC MARKERS =head1 MAGIC MARKERS
%# family=auto #%# family=auto
%# capabilities=autoconf #%# capabilities=autoconf suggest
=cut =cut
# Auto enable if we have debsecan only # Auto enable if we have debsecan only
if [ "$1" = "autoconf" ] ; then if [ "$1" = "autoconf" ]; then
if [ -x /usr/bin/debsecan ]; then if [ -x /usr/bin/debsecan ]; then
echo yes echo yes
else else
@ -58,13 +59,25 @@ if [ "$1" = "autoconf" ] ; then
exit 0 exit 0
fi fi
# Suggest both modes when asked
if [ "$1" = "suggest" ]; then
echo pkg
echo cve
exit 0
fi
# Fail if we don't have debsecan # Fail if we don't have debsecan
if [ ! -x /usr/bin/debsecan ]; then if [ ! -x /usr/bin/debsecan ]; then
echo 'error: /usr/bin/debsecan not found' >&2 echo 'error: /usr/bin/debsecan not found' >&2
exit 1 exit 1
fi fi
SUITE=${suite:-sid} # Suite is taken from environment but defaults to `os-release` content
SUITE=$(
. /etc/os-release
echo "${suite:-$VERSION_CODENAME}"
)
FIXEDWARN=${fixed_warning:-1} FIXEDWARN=${fixed_warning:-1}
FIXEDCRIT=${fixed_critical:-1000} FIXEDCRIT=${fixed_critical:-1000}
REMOTEWARN=${remote_warning:-1} REMOTEWARN=${remote_warning:-1}
@ -82,109 +95,107 @@ case "${MODE}" in
;; ;;
esac esac
if [ "$1" = "config" ] ; then if [ "$1" = "config" ]; then
cat <<EOF_ cat <<- EOF
graph_title DebSecan: ${TITLE_ADD}vulnerabilities graph_title DebSecan: ${TITLE_ADD}vulnerabilities
graph_info ${TITLE_ADD}vulnerabilities for ${SUITE} graph_info ${TITLE_ADD}vulnerabilities for ${SUITE}
graph_args -l 0 --base 1000 graph_args -l 0 --base 1000
graph_vlabel number of CVE graph_vlabel number of CVE
graph_category system graph_category system
graph_period second graph_period second
graph_info This graph show the number of known ${TITLE_ADD}vulnerabilities present on your system. Use debsecan to see details. graph_info This graph show the number of known ${TITLE_ADD}vulnerabilities present on your system. Use debsecan to see details.
remote.label remote remote.label remote
remote.colour FF0000 remote.colour FF0000
remote.type GAUGE remote.type GAUGE
remote.draw AREASTACK remote.draw AREASTACK
remote.min 0 remote.min 0
remote.info The number of ${TITLE_ADD}remotely exploitable CVEs with any priority remote.info The number of ${TITLE_ADD}remotely exploitable CVEs with any priority
remote.warning ${REMOTEWARN} remote.warning ${REMOTEWARN}
remote.critical ${REMOTECRIT} remote.critical ${REMOTECRIT}
high.label high high.label high
high.colour DD2200 high.colour DD2200
high.type GAUGE high.type GAUGE
high.draw AREASTACK high.draw AREASTACK
high.min 0 high.min 0
high.info The number of ${TITLE_ADD}CVEs marked high priority high.info The number of ${TITLE_ADD}CVEs marked high priority
medium.label medium medium.label medium
medium.colour FFAA00 medium.colour FFAA00
medium.type GAUGE medium.type GAUGE
medium.draw AREASTACK medium.draw AREASTACK
medium.min 0 medium.min 0
medium.info The number of ${TITLE_ADD}CVEs marked medium priority medium.info The number of ${TITLE_ADD}CVEs marked medium priority
low.label low low.label low
low.colour 0000FF low.colour 0000FF
low.type GAUGE low.type GAUGE
low.draw AREASTACK low.draw AREASTACK
low.min 0 low.min 0
low.info The number of ${TITLE_ADD}CVEs marked low priority low.info The number of ${TITLE_ADD}CVEs marked low priority
other.label other other.label other
other.colour 00AAFF other.colour 00AAFF
other.type GAUGE other.type GAUGE
other.draw AREASTACK other.draw AREASTACK
other.min 0 other.min 0
other.info The number of ${TITLE_ADD}CVEs with unspecified priority other.info The number of ${TITLE_ADD}CVEs with unspecified priority
fixed.label fixed fixed.label fixed
fixed.type GAUGE fixed.type GAUGE
fixed.draw LINE2 fixed.draw LINE2
fixed.min 0 fixed.min 0
fixed.info The number of ${TITLE_ADD}CVEs fixed by available updates fixed.info The number of ${TITLE_ADD}CVEs fixed by available updates
fixed.warning ${FIXEDWARN} fixed.warning ${FIXEDWARN}
fixed.critical ${FIXEDCRIT} fixed.critical ${FIXEDCRIT}
EOF_ EOF
exit 0 exit 0
fi fi
ALL=$(debsecan --suite "${SUITE}" 2> /dev/null) ALL=$(debsecan --suite "${SUITE}" 2> /dev/null)
REMOTE=$(echo "$ALL" | grep -w 'remotely') REMOTE=$(printf '%s' "$ALL" | grep -w 'remotely')
NONREMOTE=$(echo "$ALL" | grep -wv 'remotely') NONREMOTE=$(printf '%s' "$ALL" | grep -wv 'remotely')
HIGH=$(echo "${NONREMOTE}" | grep -w 'high urgency') HIGH=$(printf '%s' "${NONREMOTE}" | grep -w 'high urgency')
MEDIUM=$(echo "${NONREMOTE}" | grep -w 'medium urgency') MEDIUM=$(printf '%s' "${NONREMOTE}" | grep -w 'medium urgency')
LOW=$(echo "${NONREMOTE}" | grep -w 'low urgency') LOW=$(printf '%s' "${NONREMOTE}" | grep -w 'low urgency')
OTHER=$(echo "${NONREMOTE}" | grep -wv 'urgency') OTHER=$(printf '%s' "${NONREMOTE}" | grep -wv 'urgency')
FIXED=$(echo "${ALL}" | grep -w '(fixed') FIXED=$(printf '%s' "${ALL}" | grep -w '(fixed')
# Arguments: Field offset to aggregate by # Arguments: Field offset to aggregate by
count_entries() { count_entries() {
CUT_FIELD="${1}" CUT_FIELD="${1}"
cut -f "${CUT_FIELD}" -d " "| sort | uniq -c cut -f "${CUT_FIELD}" -d " " | sort | uniq -c
} }
case "${MODE}" in case "${MODE}" in
'cve') 'cve')
remote_count=$(echo "${REMOTE}" | count_entries "${FIELD}" | wc -l) remote_count=$(printf '%s' "${REMOTE}" | count_entries "${FIELD}" | wc -l)
high_count=$(echo "${HIGH}" | count_entries "${FIELD}" | wc -l) high_count=$(printf '%s' "${HIGH}" | count_entries "${FIELD}" | wc -l)
medium_count=$(echo "${MEDIUM}" | count_entries "${FIELD}" | wc -l) medium_count=$(printf '%s' "${MEDIUM}" | count_entries "${FIELD}" | wc -l)
low_count=$(echo "${LOW}" | count_entries "${FIELD}" | wc -l) low_count=$(printf '%s' "${LOW}" | count_entries "${FIELD}" | wc -l)
other_count=$(echo "${OTHER}" | count_entries "${FIELD}" | wc -l) other_count=$(printf '%s' "${OTHER}" | count_entries "${FIELD}" | wc -l)
fixed_count=$(echo "${FIXED}" | count_entries "${FIELD}" | wc -l) fixed_count=$(printf '%s' "${FIXED}" | count_entries "${FIELD}" | wc -l)
;; ;;
'pkg' | *) 'pkg' | *)
remote_count=$(echo "${REMOTE}" | wc -l) remote_count=$(printf '%s' "${REMOTE}" | wc -l)
high_count=$(echo "${HIGH}" | wc -l) high_count=$(printf '%s' "${HIGH}" | wc -l)
medium_count=$(echo "${MEDIUM}" | wc -l) medium_count=$(printf '%s' "${MEDIUM}" | wc -l)
low_count=$(echo "${LOW}" | wc -l) low_count=$(printf '%s' "${LOW}" | wc -l)
other_count=$(echo "${OTHER}" | wc -l) other_count=$(printf '%s' "${OTHER}" | wc -l)
fixed_count=$(echo "${FIXED}" | wc -l) fixed_count=$(printf '%s' "${FIXED}" | wc -l)
;; ;;
esac esac
# Reformat the output of the cut|sort|uniq... to a more human-friendly "item (count)" format # Reformat the output of the cut|sort|uniq... to a more human-friendly "item (count)" format
CVECOUNTRE='s/^ *\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/' CVECOUNTRE='s/^ *\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/'
# shellcheck disable=SC2005 disable=SC2046 cat <<- EOF
# The nested $(echo ...)s are needed to yet the newlines remote.value $remote_count
cat <<EOF remote.extinfo $(printf '%s' "${REMOTE}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}" | xargs)
remote.value $remote_count high.value $high_count
remote.extinfo $(echo $(echo "${REMOTE}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}")) high.extinfo $(printf '%s' "${HIGH}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}" | xargs)
high.value $high_count medium.value $medium_count
high.extinfo $(echo $(echo "${HIGH}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}")) medium.extinfo $(printf '%s' "${MEDIUM}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}" | xargs)
medium.value $medium_count low.value $low_count
medium.extinfo $(echo $(echo "${MEDIUM}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}")) low.extinfo $(printf '%s' "${LOW}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}" | xargs)
low.value $low_count other.value $other_count
low.extinfo $(echo $(echo "${LOW}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}")) other.extinfo $(printf '%s' "${OTHER}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}" | xargs)
other.value $other_count fixed.value $fixed_count
other.extinfo $(echo $(echo "${OTHER}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}")) fixed.extinfo $(printf '%s' "${FIXED}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}" | xargs)
fixed.value $fixed_count
fixed.extinfo $(echo $(echo "${FIXED}" | count_entries "${FIELD}" | sort -nr | sed "${CVECOUNTRE}"))
EOF EOF