mirror of
https://github.com/munin-monitoring/contrib.git
synced 2025-08-02 22:28:24 +00:00
96 lines
2.4 KiB
Bash
Executable file
96 lines
2.4 KiB
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# Plugin to monitor the number of CVE vulnerabilities present on a Debian
|
|
# system (using debsecan). Might work on other distib, who knows...
|
|
#
|
|
# Inspiration of the moment 10/10/2007
|
|
#
|
|
# Nicolas BOUTHORS <nbouthors@nbi.fr> http://nbi.fr/
|
|
#
|
|
# Licence : Public Domain
|
|
#
|
|
#%# family=auto
|
|
#%# capabilities=autoconf
|
|
|
|
# Auto enable if we have debsecan only
|
|
if [ "$1" = "autoconf" ] ; then
|
|
if [ -x /usr/bin/debsecan ]; then
|
|
echo yes
|
|
else
|
|
echo no
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
# Fail if we don't have debsecan
|
|
if [ ! -x /usr/bin/debsecan ]; then
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$1" = "config" ] ; then
|
|
cat <<EOF_
|
|
graph_title DebSecan : vulnerabilities
|
|
graph_args -l 0 --base 1000
|
|
graph_vlabel number of CVE
|
|
graph_category system
|
|
graph_period second
|
|
graph_info This graph show the number of known vulnerabilities present on your system. Use debsecan to see details.
|
|
high.label high
|
|
high.colour FF0000
|
|
high.type GAUGE
|
|
high.draw AREASTACK
|
|
high.min 0
|
|
high.info The number of CVEs marked high priority
|
|
medium.label medium
|
|
medium.colour FFA500
|
|
medium.type GAUGE
|
|
medium.draw AREASTACK
|
|
medium.min 0
|
|
medium.info The number of CVEs marked medium priority
|
|
low.label low
|
|
low.colour 0000FF
|
|
low.type GAUGE
|
|
low.draw AREASTACK
|
|
low.min 0
|
|
low.info The number of CVEs marked low priority
|
|
other.label other
|
|
other.colour 00A5FF
|
|
other.type GAUGE
|
|
other.draw AREASTACK
|
|
other.min 0
|
|
other.info The number of CVEs with unspecified priority
|
|
EOF_
|
|
exit 0
|
|
fi
|
|
|
|
CVERE="\(\(CVE\|TMP\)[-0-9A-Fa-f]\+\)"
|
|
CVECOUNTRE="s/^.*\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/"
|
|
|
|
OUT=`mktemp -t debsecan.XXXXXX`
|
|
HIGH=`mktemp -t debsecan.XXXXXX`
|
|
MEDIUM=`mktemp -t debsecan.XXXXXX`
|
|
LOW=`mktemp -t debsecan.XXXXXX`
|
|
OTHER=`mktemp -t debsecan.XXXXXX`
|
|
debsecan 2> /dev/null > ${OUT}
|
|
grep 'high urgency' ${OUT} > ${HIGH}
|
|
grep 'medium urgency' ${OUT} > ${MEDIUM}
|
|
grep 'low urgency)' ${OUT} > ${LOW}
|
|
grep -v '\(low\|medium\|high\) urgency' ${OUT} > ${OTHER}
|
|
|
|
high=`cat ${HIGH} | wc -l`
|
|
medium=`cat ${MEDIUM} | wc -l`
|
|
low=`cat ${LOW} | wc -l`
|
|
other=`cat ${OTHER} | wc -l`
|
|
|
|
cat <<EOF
|
|
high.value $high
|
|
high.extinfo `echo $(cut -f 2 -d" " ${HIGH} | uniq -c | sort -nr | sed "${CVECOUNTRE}")`
|
|
medium.value $medium
|
|
medium.extinfo `echo $(cut -f 2 -d" " ${MEDIUM} | uniq -c | sort -nr | sed "${CVECOUNTRE}")`
|
|
low.value $low
|
|
low.extinfo `echo $(cut -f 2 -d" " ${LOW} | uniq -c | sort -nr | sed "${CVECOUNTRE}")`
|
|
other.value $other
|
|
other.extinfo `echo $(cut -f 2 -d" " ${OTHER} | uniq -c | sort -nr | sed "${CVECOUNTRE}")`
|
|
EOF
|
|
|
|
rm -f ${OUT} ${HIGH} ${MEDIUM} ${LOW} ${OTHER}
|