the following code is remotely ecexuted via ssh2 to check the used space on all mounted disks. It is executed via another script , this second script checks the command to execute remotely matches /^[:%'"\/\.a-z0-9 \-_]+$/i
The parameter to this second script might look like:
-C 'check_df_all -w 10% -c 3%'
the second script will see to it that the call is made with the correct absolute path.
The scripts aren't writeable to the executing user (neither on the calling nor on the called machine), but the parameters may be changed.
Given these precautions and the code below, which checks the parameters given, would you say, this is secure, or could you come up with an exploit easily?
The script:#!/usr/bin/perl -w use strict; use Getopt::Long; use vars qw($opt_h $opt_w $opt_c $PROGNAME $VERSION); use lib "/data/programme/nagios/libexec"; use utils qw(%ERRORS &print_revision &support &usage); use Filesys::DiskFree; $PROGNAME = 'check_df_all'; $VERSION = '$Revision: 1.2 $'; sub print_help (); sub print_usage (); $ENV{'PATH'}=''; $ENV{'BASH_ENV'}=''; $ENV{'ENV'}=''; Getopt::Long::Configure('bundling'); GetOptions ( "h" => \$opt_h, "help" => \$opt_h, "w=s" => \$opt_w, "warn=s" => \$opt_w, "c=s" => \$opt_c, "crit=s" => \$opt_c ); # check options # help wanted if ($opt_h) {print_help(); exit($ERRORS{'OK'});} # no use executing me without these ($opt_w && $opt_c) || usage("specify -w /and/ -c\n"); # check the passed values my $warn_limit = int($1) if $opt_w =~ m/^([0-9]+)(%??)$/; # warning limit in percent ? my $wp = 1 if $2 eq '%'; $wp |= 0; my $crit_limit = int($1) if $opt_c =~ m/^([0-9]+)(%??)$/; # critical limit in percent ? my $cp = 1 if $2 eq '%'; $cp |= 0; # no use executing me without these # passed in correctly usage("invalid parameter(s)") if !$crit_limit or !$warn_limit; # get data my $dfh = new Filesys::DiskFree; (print "can't exec df" && exit($ERRORS{'UNKNOWN'})) if !$dfh->df(); my $warn = 0; my $crit = 0; my @disks = $dfh->disks(); my $text = ''; # examine data, we're not interested in devfs, shmfs and the like map { $text .= " [" . check_disk($_) . "] " if $dfh->device($_) =~ m!^ +/!; } @disks; # print assembled status print $text; exit($ERRORS{'CRITICAL'}) if $crit > 0; exit($ERRORS{'WARNING'}) if $warn > 0; exit($ERRORS{'OK'}); # examine data for one mounted disk sub check_disk { my $mount_point = shift; my $total = $dfh->total($mount_point) / 1024; my $used = $dfh->used($mount_point) / 1024; my $used_percent = ($used / $total) * 100; my $result = int($used_percent) . '% used on ' . $mount_point; if ($cp && ((100 - $used_percent) < $crit_limit)) { $crit = 1; } elsif (!$cp && ($crit_limit < ($total - $used))) { $crit = 1; } if ($wp && ((100 - $used_percent) <= $warn_limit)) { $warn = 1; } elsif (!$wp && ($warn_limit < ($total - $used))) { $warn = 1; } return $result; } sub print_usage () { print "Usage: $PROGNAME -w d[%] -c d[%]\nUsage: $PROGNAME -h"; } sub print_help () { print_revision($PROGNAME,$VERSION); print "Copyright (c) 2003 My Company This plugin uses Filesys::DiskFree to scan all mounted devices, and re +turnes warnings or critical failures if /one/ ore more of the devices + exceed the given ranges -w, --warning=INTEGER Exit with WARNING status if less than INTEGER kilobytes of disk are + free -w, --warning=PERCENT% Exit with WARNING status if less than PERCENT of disk space is free -c, --critical=INTEGER Exit with CRITICAL status if less than INTEGER kilobytes of disk ar +e free -c, --critical=PERCENT% Exit with CRITCAL status if less than PERCENT of disk space is free "; print_usage(); print " "; support(); }
FYI: I changed Filesys::DiskFree to call df with an absolute path.
I of course also appreciate any advise to improve my perl coding-style and skills, but my main concern is the security of this code.
In reply to script-security / custom nagios-check by Tomte
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |