Cacti extend snmp by a custom script - linux

Question

I have created a graph on Cacti about time to access to a specific page on our infrastructure with cacti and net-snmp.
I have extended the capability with adding two new lines in file /etc/snmp/snmpd.conf :
extend stat_page1 /usr/local/bin/cacti/access_page.sh context1
extend stat_page2 /usr/local/bin/cacti/access_page.sh context2
I have restarted the daemon snmpd to load this configuration.
The script called is describe below, with other value, because for some reason, i can show this.
#!/bin/bash
domain="mydomain"
cookie_name="myCookie"
token="myToken"
if [ $# -eq 1 ]
then
if [ "$1" = "context1" ]
then
target_url="https://${domain}/${1}/page1.html"
TIME=$(curl -s -w "%{time_total}" -o /dev/null --cookie \"${cookie_name}=${token}\" ${target_url})
echo "$TIME"
elif [ "$1" = "context2" ]
then
target_url="https://${domain}/${1}/page2.html"
TIME=$(curl -s -w "%{time_total}" -o /dev/null --cookie \"${cookie_name}=${token}\" ${target_url})
echo "$TIME"
fi
If I launch the script manually i have this
$ /usr/local/bin/cacti/access_page.sh context2
0.061
$ /usr/local/bin/cacti/access_page.sh context1
0.041
When I launch the script with snmpget, I have this result:
snmpwalk -v2c -c myCommunity localhost NET-SNMP-EXTEND-MIB::nsExtendOutput2Table
NET-SNMP-EXTEND-MIB::nsExtendOutLine."stat_page1".1 = STRING: 0.000
NET-SNMP-EXTEND-MIB::nsExtendOutLine."stat_page2".1 = STRING: 0.000
All time, I get 0.000 value by snmp command and manually a real value.
Could you help me about it?, please

Answer 1

Recently i had an issue with snmp and the execution script that call the curl command.
This post was the closest of the problem when i searched some solutions.
I found a solution without disabling SELinux.
I am a newbie in SELinux but i solved this issue with some SELinux configuration, that could interest someone in the future.
Context :
Centos 7
Content of the configuration file for SNMP /etc/snmp/snmpd.conf :
# sec.name source community
com2sec myuser default public
# groupName securityModel securityName
group mygroup v2c pad
# name incl/excl subtree mask(optional)
view systemview included .1.3.6.1.4
view systemview included .1.3.6.1.4.1
view systemview included .1.3.6.1.4.1.1234
view systemview included .1.3.6.1.4.1.1234.1
# group context sec.model sec.level prefix read write notif
access mygroup "" any noauth exact systemview none none
perl do "/appli/snmp_scripts/agent.pl"
SNMAP agent agent.pl :
#!/usr/bin/perl
use NetSNMP::agent (':all');
use NetSNMP::ASN qw(ASN_OCTET_STR ASN_INTEGER);
sub handler {
my ($handler, $registration_info, $request_info, $requests) = #_;
my $request;
for($request = $requests; $request; $request = $request->next()) {
my $oid = $request->getOID();
if ($request_info->getMode() == MODE_GET) {
if ($oid == new NetSNMP::OID(".1.3.6.1.4.1.1581.1.6.2.1.5")) {
$request->setValue(ASN_OCTET_STR,`/path/to/myscript`);
}
}
}
}
my $AGENT_OID = ".1.3.6.1.4.1.1234";
$agent->register("MYAGENT", ".1.3.6.1.4.1.1234",
\&handler);
Solution:
When i looked for trace of the execution, with sudo systemctl status snmpd, some trace of curl were display :
snmpd: curl: (7) Failed to connect to 127.0.0.1:8081 Permission denied
However, the server was running well at this port and the script executed outside SNMP worked well.
SELinux errors have been generated in audit logs :
$> sudo grep snmp /var/log/audit/audit.log | audit2allow -w -a
type=AVC msg=audit(1528188940.802:2025): avc: denied { name_connect } for pid=26809 comm="curl" dest=8081 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket
Was caused by:
Missing type enforcement (TE) allow rule.
You can use audit2allow to generate a loadable module to allow this access.
$> sudo grep snmp /var/log/audit/audit.log | audit2allow -M mysnmpmodule
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i snmpdcanopensocket.pp
Follow the step told by audit2allow comm apply to SELinux the new created module for snmp_t. The audit2allow -M command generated two files snmpdcanopensocket.pp snmpdcanopensocket.te in your current directory.
SELinux needs the .pp file to remap it's security rules.
$> semodule -i snmpdcanopensocket.pp
Restart the SNMP service with sudo systemctl restart snmp
Now the curl in the script executed by SNMP behaves well and does not quit with a (7) error code.

Answer 2

I have done this test and when i call the script i have permission denied when I do this : line 34: /tmp/echo-curl: Permission denied, and I have done a script with just id to be sure that is launched with privilege user.
I have find the source of the problem, which is probably due to enforcing of SELinux – user3249935