1 files changed, 345 insertions, 0 deletions

diff --git a/plugins/check_radius.c b/plugins/check_radius.c
new file mode 100644
index 00000000..614d467b
--- /dev/null
+++ b/plugins/check_radius.c
@@ -0,0 +1,345 @@
+/******************************************************************************
+ *
+ * Program: radius server check plugin for Nagios
+ * License: GPL
+ *
+ * License Information:
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * $Id$
+ *
+ *****************************************************************************/
+
+#define PROGNAME "check_radius"
+#define REVISION "$Revision$"
+#define COPYRIGHT "1999-2001"
+#define AUTHORS "Robert August Vincent II/Karl DeBisschop"
+#define EMAIL "kdebisschop@users.sourceforge.net"
+#define SUMMARY "Tests to see if a radius server is accepting connections.\n"
+
+#define OPTIONS "\
+-H host -F config_file -u username -p password\'\
+              [-P port] [-t timeout] [-r retries] [-e expect]"
+
+#define LONGOPTIONS "\
+ -H, --hostname=HOST\n\
+    Host name argument for servers using host headers (use numeric\n\
+    address if possible to bypass DNS lookup).\n\
+ -P, --port=INTEGER\n\
+    Port number (default: %d)\n\
+ -u, --username=STRING\n\
+    The user to authenticate\n\
+ -p, --password=STRING\n\
+    Password for autentication (SECURITY RISK)\n\
+ -F, --filename=STRING\n\
+    Configuration file\n\
+ -e, --expect=STRING\n\
+    Response string to expect from the server\n\
+ -r, --retries=INTEGER\n\
+    Number of times to retry a failed connection\n\
+ -t, --timeout=INTEGER\n\
+    Seconds before connection times out (default: %d)\n\
+ -v\n\
+    Show details for command-line debugging (do not use with nagios server)\n\
+ -h, --help\n\
+    Print detailed help screen\n\
+ -V, --version\n\
+    Print version information\n"
+
+#define DESCRIPTION "\
+The password option presents a substantial security issue because the 
+password can be determined by careful watching of the command line in
+a process listing.  This risk is exacerbated because nagios will
+run the plugin at regular prdictable intervals.  Please be sure that
+the password used does not allow access to sensitive system resources,
+otherwise compormise could occur.\n"
+
+#include "config.h"
+#include "common.h"
+#include "utils.h"
+#include <radiusclient.h>
+
+int process_arguments (int, char **);
+void print_usage (void);
+void print_help (void);
+
+char *server = NULL;
+int port = PW_AUTH_UDP_PORT;
+char *username = NULL;
+char *password = NULL;
+char *expect = NULL;
+char *config_file = NULL;
+int retries = 1;
+int verbose = FALSE;
+
+ENV *env = NULL;
+
+/******************************************************************************
+
+The (psuedo?)literate programming XML is contained within \@\@\- <XML> \-\@\@
+tags in the comments. With in the tags, the XML is assembled sequentially.
+You can define entities in tags. You also have all the #defines available as
+entities.
+
+Please note that all tags must be lowercase to use the DocBook XML DTD.
+
+@@-<article>
+
+<sect1>
+<title>Quick Reference</title>
+<!-- The refentry forms a manpage -->
+<refentry>
+<refmeta>
+<manvolnum>5<manvolnum>
+</refmeta>
+<refnamdiv>
+<refname>&PROGNAME;</refname>
+<refpurpose>&SUMMARY;</refpurpose>
+</refnamdiv>
+</refentry>
+</sect1>
+
+<sect1>
+<title>FAQ</title>
+</sect1>
+
+<sect1>
+<title>Theory, Installation, and Operation</title>
+
+<sect2>
+<title>General Description</title>
+<para>
+&DESCRIPTION;
+</para>
+</sect2>
+
+<sect2>
+<title>Future Enhancements</title>
+<para>ToDo List</para>
+<itemizedlist>
+<listitem>Add option to get password from a secured file rather than the command line</listitem>
+</itemizedlist>
+</sect2>
+
+
+<sect2>
+<title>Functions</title>
+-@@
+******************************************************************************/
+
+int
+main (int argc, char **argv)
+{
+        UINT4 service;
+        char msg[BUFFER_LEN];
+        SEND_DATA data = { 0 };
+        int result;
+        UINT4 client_id;
+
+        if (process_arguments (argc, argv) == ERROR)
+                usage ("Could not parse arguments\n");
+
+        if ((config_file && rc_read_config (config_file)) ||
+                        rc_read_dictionary (rc_conf_str ("dictionary")))
+                terminate (STATE_UNKNOWN, "Config file error");
+
+        service = PW_AUTHENTICATE_ONLY;
+
+        if (!(rc_avpair_add (&data.send_pairs, PW_SERVICE_TYPE, &service, 0) &&
+                                rc_avpair_add (&data.send_pairs, PW_USER_NAME, username, 0) &&
+                                rc_avpair_add (&data.send_pairs, PW_USER_PASSWORD, password, 0)))
+                terminate (STATE_UNKNOWN, "Out of Memory?");
+
+        /* 
+         * Fill in NAS-IP-Address 
+         */
+
+        if ((client_id = rc_own_ipaddress ()) == 0)
+                return (ERROR_RC);
+
+        if (rc_avpair_add (&(data.send_pairs), PW_NAS_IP_ADDRESS, &client_id, 0) ==
+                        NULL) return (ERROR_RC);
+
+        rc_buildreq (&data, PW_ACCESS_REQUEST, server, port, timeout_interval,
+                                                         retries);
+
+        result = rc_send_server (&data, msg);
+        rc_avpair_free (data.send_pairs);
+        if (data.receive_pairs)
+                rc_avpair_free (data.receive_pairs);
+
+        if (result == TIMEOUT_RC)
+                terminate (STATE_CRITICAL, "Timeout");
+        if (result == ERROR_RC)
+                terminate (STATE_CRITICAL, "Auth Error");
+        if (result == BADRESP_RC)
+                terminate (STATE_WARNING, "Auth Failed");
+        if (expect && !strstr (msg, expect))
+                terminate (STATE_WARNING, msg);
+        if (result == OK_RC)
+                terminate (STATE_OK, "Auth OK");
+        return (0);
+}
+
+
+
+/* process command-line arguments */
+int
+process_arguments (int argc, char **argv)
+{
+        int c;
+
+#ifdef HAVE_GETOPT_H
+        int option_index = 0;
+        static struct option long_options[] = {
+                {"hostname", required_argument, 0, 'H'},
+                {"port", required_argument, 0, 'P'},
+                {"username", required_argument, 0, 'u'},
+                {"password", required_argument, 0, 'p'},
+                {"filename", required_argument, 0, 'F'},
+                {"expect", required_argument, 0, 'e'},
+                {"retries", required_argument, 0, 'r'},
+                {"timeout", required_argument, 0, 't'},
+                {"verbose", no_argument, 0, 'v'},
+                {"version", no_argument, 0, 'V'},
+                {"help", no_argument, 0, 'h'},
+                {0, 0, 0, 0}
+        };
+#endif
+
+        if (argc < 2)
+                return ERROR;
+
+        if (argc == 9) {
+                config_file = argv[1];
+                username = argv[2];
+                password = argv[3];
+                if (is_intpos (argv[4]))
+                        timeout_interval = atoi (argv[4]);
+                else
+                        usage ("Timeout interval must be a positive integer");
+                if (is_intpos (argv[5]))
+                        retries = atoi (argv[5]);
+                else
+                        usage ("Number of retries must be a positive integer");
+                server = argv[6];
+                if (is_intpos (argv[7]))
+                        port = atoi (argv[7]);
+                else
+                        usage ("Server port must be a positive integer");
+                expect = argv[8];
+                return OK;
+        }
+
+        while (1) {
+#ifdef HAVE_GETOPT_H
+                c =
+                        getopt_long (argc, argv, "+hVvH:P:F:u:p:t:r:e:", long_options,
+                                                                         &option_index);
+#else
+                c = getopt (argc, argv, "+hVvH:P:F:u:p:t:r:e:");
+#endif
+
+                if (c == -1 || c == EOF || c == 1)
+                        break;
+
+                switch (c) {
+                case '?':                                                                       /* print short usage statement if args not parsable */
+                        printf ("%s: Unknown argument: %s\n\n", my_basename (argv[0]), optarg);
+                        print_usage ();
+                        exit (STATE_UNKNOWN);
+                case 'h':                                                                       /* help */
+                        print_help ();
+                        exit (OK);
+                case 'V':                                                                       /* version */
+                        print_revision (my_basename (argv[0]), "$Revision$");
+                        exit (OK);
+                case 'v':                                                                       /* verbose mode */
+                        verbose = TRUE;
+                        break;
+                case 'H':                                                                       /* hostname */
+                        if (is_host (optarg) == FALSE) {
+                                printf ("Invalid host name/address\n\n");
+                                print_usage ();
+                                exit (STATE_UNKNOWN);
+                        }
+                        server = optarg;
+                        break;
+                case 'P':                                                                       /* port */
+                        if (is_intnonneg (optarg))
+                                port = atoi (optarg);
+                        else
+                                usage ("Server port must be a positive integer");
+                        break;
+                case 'u':                                                                       /* username */
+                        username = optarg;
+                        break;
+                case 'p':                                                                       /* password */
+                        password = optarg;
+                        break;
+                case 'F':                                                                       /* configuration file */
+                        config_file = optarg;
+                        break;
+                case 'e':                                                                       /* expect */
+                        expect = optarg;
+                        break;
+                case 'r':                                                                       /* retries */
+                        if (is_intpos (optarg))
+                                retries = atoi (optarg);
+                        else
+                                usage ("Number of retries must be a positive integer");
+                        break;
+                case 't':                                                                       /* timeout */
+                        if (is_intpos (optarg))
+                                timeout_interval = atoi (optarg);
+                        else
+                                usage ("Timeout interval must be a positive integer");
+                        break;
+                }
+        }
+        return OK;
+}
+
+
+
+void
+print_help (void)
+{
+        print_revision (PROGNAME, REVISION);
+        printf
+                ("Copyright (c) %s %s <%s>\n\n%s\n",
+                 COPYRIGHT, AUTHORS, EMAIL, SUMMARY);
+        print_usage ();
+        printf
+                ("\nOptions:\n" LONGOPTIONS "\n" DESCRIPTION "\n", 
+                 port, timeout_interval);
+        support ();
+}
+
+
+void
+print_usage (void)
+{
+        printf ("Usage:\n" " %s %s\n"
+#ifdef HAVE_GETOPT_H
+                                        " %s (-h | --help) for detailed help\n"
+                                        " %s (-V | --version) for version information\n",
+#else
+                                        " %s -h for detailed help\n"
+                                        " %s -V for version information\n",
+#endif
+                                        PROGNAME, OPTIONS, PROGNAME, PROGNAME);
+}