Nagios IP/Email blacklist monitoring using check_rbl in Ubuntu

To monitor IP/Email blacklist in Nagios, download check_rbl script from https://exchange.nagios.org/directory/Plugins/Email-and-Groupware/check_rbl/details to /usr/lib/nagios/plugins or get it from apt package nagios-plugins-contrib.

1. Install below dependencies for check_rbl.

sudo apt-get install libdata-validate-domain-perl libdata-validate-ip-perl libnet-dns-perl libreadonly-perl

2. Create your own commands at /etc/nagios3/commands.cfg.

define command{
  command_name check_rbl
  command_line $USER1$/check_rbl -H $ARG1$ -t 60 -w $ARG2$ -c $ARG3$ $ARG4$
}

3. Create your own service definition.

define service{
  use generic-service
  host_name xxx
  service_description RBL Check
  check_command check_rbl!xxx.xxx.xxx.xxx!1!1-s all.s5h.net -s b.barracudacentral.org -s bl.emailbasura.org -s bl.spamcannibal.org -s bl.spamcop.net -s blacklist.woody.ch -s bogons.cymru.com -s cbl.abuseat.org -s cdl.anti-spam.org.cn -s combined.abuse.ch -s db.wpbl.info -s dnsbl-1.uceprotect.net -s dnsbl-2.uceprotect.net     -s dnsbl-3.uceprotect.net -s dnsbl.anticaptcha.net -s dnsbl.dronebl.org -s dnsbl.inps.de -s dnsbl.sorbs.net -s dnsbl.spfbl.net -s drone.abuse.ch -s duinv.aupads.org -s dul.dnsbl.sorbs.net -s dyna.spamrats.com -s dynip.rothen.com -s http.dnsbl.sorbs.net -s ips.backscatterer.org -s ix.dnsbl.manitu.net -s korea.services.net -s misc.dnsbl.sorbs.net -s noptr.spamrats.com -s orvedb.aupads.org -s pbl.spamhaus.org -s proxy.bl.gweep.ca -s psbl.surriel.com -s relays.bl.gweep.ca -s relays.nether.net -s sbl.spamhaus.org -s short.rbl.jp -s singular.ttk.pte.hu -s smtp.dnsbl.sorbs.net -s socks.dnsbl.sorbs.net -s spam.abuse.ch -s spam.dnsbl.anonmails.de -s spam.dnsbl.sorbs.net -s spam.spamrats.com -s spambot.bls.digibase.ca -s spamrbl.imp.ch -s spamsources.fabel.dk -s ubl.lashback.com -s ubl.unsubscore.com -s virus.rbl.jp -s web.dnsbl.sorbs.net -s wormrbl.imp.ch -s xbl.spamhaus.org -s z.mailspike.net -s zen.spamhaus.org -s zombie.dnsbl.sorbs.net
  normal_check_interval 240
  max_check_attempts 4
}

Comments