Élenchos: Check nftables

A Élenchos command for checking the number of lines in the ruleset of nftables.

Installation and Configuration

Install Élenchos if not already installed:

cd /opt

mkdir elenchos
cd elenchos

python -m venv .venv
. .venv/bin/activate
pip install elenchos

mkdir bin
ln -s ../.venv/bin/elenchos bin/elenchos

Install the check:nftables plugin:

cd /opt/elenchos
. .venv/bin/activate

pip install elenchos_check_nftables
./bin/elenchos gather-commands

Create a configuration file /etc/nrpe.d/check_nftables.cfg for nrpe:

command[check_nftables]=/opt/elenchos/bin/elenchos check:nftables <arguments>

Possible arguments are:

• -w, --warning[=WARNING] The warning level for the number of lines in the ruleset.
• -c, --critical[=CRITICAL] The critical level for the number of lines in the ruleset.

Allow Élenchos to list the ruleset of nftables by creating the config file /etc/sudoers.d/enlenchos_check_nftables:

Defaults !requiretty
 
nrpe ALL = (root) NOPASSWD: /usr/bin/nft list ruleset

Finally, restart the nrpe daemon:

systemctl reload nrpe

License

This project is licensed under the terms of the MIT license.