项目作者: tommarshall

项目描述 :
Nagios plugin to monitor ruby applications for security vulnerabilities via bundler-audit.
高级语言: Shell
项目地址: git://github.com/tommarshall/nagios-check-bundle-audit.git
创建时间: 2016-10-24T20:00:39Z
项目社区:https://github.com/tommarshall/nagios-check-bundle-audit

开源协议:MIT License

下载


Nagios check_bundle_audit

Build Status

Nagios plugin to monitor ruby applications for security vulnerabilities via bundler-audit.

Installation

Install the bundler-audit gem.

Download the check_bundle_audit script and make it executable.

Define a new command in the Nagios config, e.g.

  1. define command {
  2. command_name check_bundle_audit
  3. command_line $USER1$/check_bundle_audit -p /var/www/app
  4. }

Usage

  1. ./check_bundle_audit -p <path> [options]

Examples

  1. # 'Unknown' or 'High' CVEs exit CRITICAL; 'Medium' or 'Low' exit WARNING
  2. ./check_bundle_audit -p /var/www/app
  3. # exit CRITICAL if any CVE(s) are present
  4. ./check_bundle_audit -p /var/www/app -c all
  5. # exit WARNING if any CVE(s) (including high) are present
  6. ./check_bundle_audit -p /var/www/app -c '' -w all
  7. # 'High' CVEs exit CRITICAL; 'Unknown' or 'Medium' exit WARNING; 'Low' exit OK
  8. ./check_bundle_audit -p /var/www/app -c high -w medium,unknown
  9. # 'High' CVEs exit CRITICAL; 'Medium', 'Low' or 'Unknown' exit WARNING
  10. ./check_bundle_audit -p /var/www/app -c high -w medium,low,unknown
  11. # set full path to bundle-audit
  12. ./check_bundle_audit -p /var/www/app -b /usr/local/bin/bundle-audit
  13. # ignore advisories CVE-2016-4658 and CVE-2014-0083
  14. ./check_bundle_audit -p /var/www/app -i "CVE-2016-4658 CVE-2014-0083"

Options

  1. -p, --path <path> path to project
  2. -b --bundle-audit-path path to `bundle-audit` gem
  3. -w, --warning <criticalities> comma seperated CVE criticalities to treat as WARNING
  4. -c, --critical <criticalities> comma seperated CVE criticalities to treat as CRITICAL
  5. -i, --ignore <advisory ID(s)> space seperated advisories to ignore
  6. -V, --version output version
  7. -h, --help output help information

Criticalities

  • -c/--critical takes priority over -w/--warning.
  • -c/--critical default is high,unknown.
  • -w/--warning default is low,medium,high,unknown.
  • Criticality levels:
    • low
    • medium
    • high
    • unknown
    • all (alias for low,medium,high,unknown)

Troubleshooting

  1. UNKNOWN: Unable to update ruby-advisory-db

bundler-audit downloads a copy of the Ruby Advisory Database inside the user’s home directory. This can cause issues if the user running the script does not have a writable home directory. See #2 for details on how to resolve this.

Dependencies