This setup installs a Nagios monitoring server on Kali and uses it to monitor devices in the network. This can be used to monitor Network Reachability, HTTPS availability and even do checks on Modbus interfaces.
Nagios checks the Anybus Defender through NRPE package, meaning Kali asks the Defender to run local checks such as CPU load, disk usage but also ping to another device, performHTTPS access, and TCP port checks. This proves what the Anybus itself can reach, not just what Kali can reach.
Anybus Defender 4000 and 6000 series, with DPI/FW or PRO/FW license
A PC with Linux installed
A device that can send Modbus traffic or a second Linux PC
In this setup the Nagios server will connect to Anybus Defender to perform checks on the Defender itself, as well as ICMP, HTTPS and TCP polls on other devices it can reach through the LAN.
The article also covers a more sophisticated scenario where a script performs a full Modbus poll - this is done form the Nagios Server directly as no such scripts can be installed on the Defender.
Kali Nagios server: 10.10.10.46
(after installation Nagios is available at http://10.10.10.46/nagios/ )
Anybus Defender: 10.10.10.254
Fake Modbus server/PLC: 10.10.10.7
Example HTTPS/Ping target: 10.10.10.10
Nagios web login user: nagiosadmin
Nagios config file: /usr/local/nagios/etc/objects/linux.cfg
Nagios plugins path: /usr/local/nagios/libexec/
1. Install Nagios Core on Kali
NOTE: Kali is a free unix environment with network management and testing tools. Obtain your copy here: https://www.kali.org After installation continue here:
Update Kali:
sudo apt update
sudo apt upgrade -y
Install required packages:
sudo apt install -y apache2 php libapache2-mod-php \
gcc make unzip wget \
openssl libssl-dev \
apache2-utils \
php-gd \
libgd-dev \
build-essential \
daemon
Start Apache:
sudo systemctl enable apache2
sudo systemctl start apache2
2. Create Nagios user and group
sudo useradd nagios
sudo groupadd nagcmd
sudo usermod -a -G nagcmd nagios
sudo usermod -a -G nagcmd www-data
3. Install Nagios Core
cd /tmp
wget https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.5.9.tar.gz
tar -zxvf nagios-4.5.9.tar.gz
cd nagios-4.5.9
Compile and install:
./configure --with-command-group=nagcmd
make all
sudo make install
sudo make install-init
sudo make install-commandmode
sudo make install-config
sudo make install-webconf
Create web login:
sudo htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin
Enable Apache modules:
sudo a2enmod rewrite
sudo a2enmod cgi
sudo systemctl restart apache2
4. Install Nagios plugins
cd /tmp
wget https://nagios-plugins.org/download/nagios-plugins-2.4.12.tar.gz
tar -xzf nagios-plugins-2.4.12.tar.gz
cd nagios-plugins-2.4.12
Compile and install:
./configure --with-nagios-user=nagios --with-nagios-group=nagios
make
sudo make install
5. Install NRPE plugin on Kali
cd /tmp
wget https://github.com/NagiosEnterprises/nrpe/releases/download/nrpe-4.1.3/nrpe-4.1.3.tar.gz
tar -xzf nrpe-4.1.3.tar.gz
cd nrpe-4.1.3
Compile the client plugin:
./configure
make check_nrpe
sudo make install-plugin
Confirm:
ls -l /usr/local/nagios/libexec/check_nrpe
6. Add required Nagios command definitions
sudo nano /usr/local/nagios/etc/objects/commands.cfg
Add these at the bottom.
NRPE command
define command{
command_name check_nrpe
command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c $ARG1$
}
7. Create Nagios host/service config file
sudo nano /usr/local/nagios/etc/objects/linux.cfg
Add your hosts:
define host{
use linux-server
host_name anybus
alias Anybus Defender
address 10.10.10.254
}
define host{
use linux-server
host_name ubuntu_modbus
alias Ubuntu Fake Modbus Server
address 10.10.10.7
}
8. Enable linux.cfg in Nagios
sudo nano /usr/local/nagios/etc/nagios.cfg
Add this line if it is not already there:
cfg_file=/usr/local/nagios/etc/objects/linux.cfg
9. Configure NRPE on the Anybus Defender
On the Anybus Defender GUI:
Services → NRPE
Set:
Enable NRPE: checked
Port Number: 5666
Bind IP Address: blank
Nagios Server(s): 10.10.10.46
Allow Arguments: unchecked unless needed
The Nagios Server(s) field must contain the Kali Nagios server IP:
10.10.10.46
Test from Kali:
/usr/local/nagios/libexec/check_nrpe -H 10.10.10.254
Expected:
NRPE v4.x.x
10. Add NRPE health checks for Anybus
On the Anybus Defender NRPE GUI, you already had commands like:
check_users
check_load
check_root
check_var
check_zombie_procs
check_total_procs
check_swap
Add services on Kali:
define service{
use generic-service
host_name anybus
service_description Anybus CPU Load
check_command check_nrpe!check_load
}
define service{
use generic-service
host_name anybus
service_description Anybus Root Filesystem
check_command check_nrpe!check_root
}
define service{
use generic-service
host_name anybus
service_description Anybus Swap Usage
check_command check_nrpe!check_swap
}
define service{
use generic-service
host_name anybus
service_description Anybus Total Processes
check_command check_nrpe!check_total_procs
}
define service{
use generic-service
host_name anybus
service_description Anybus Zombie Processes
check_command check_nrpe!check_zombie_procs
}
Manual test:
/usr/local/nagios/libexec/check_nrpe -H 10.10.10.254 -c check_load
Example of configuration:
11. Check connectivity from Anybus to another device
Example:
Anybus 10.10.10.254 → ping → 10.10.10.10
This is the ping check. The ping is performed by Anybus, not Kali.
On Anybus NRPE GUI, add:
Name:
check_ping_10_10_10_10
Command:
check_ping
Warning Level:
100.0,20%
Critical Level:
500.0,60%
Extra Options:
-H 10.10.10.10 -t 5
Test from Kali:
/usr/local/nagios/libexec/check_nrpe -H 10.10.10.254 -t 30 -c check_ping_10_10_10_10
Expected:
PING OK - Packet loss = 0%, RTA = ...
Add Nagios service:
define service{
use generic-service
host_name anybus
service_description Anybus ping to 10.10.10.10
check_command check_nrpe!check_ping_10_10_10_10
}
If it times out, add a firewall rule on the Anybus allowing ICMP from Anybus to the destination.
12. Check HTTP/HTTPS from Anybus to another device
Example:
Anybus → HTTPS → 10.10.10.10
On Anybus NRPE GUI, add:
Name:
check_https_10_10_10_10
Command:
check_http
Warning Level:
5
Critical Level:
10
Extra Options:
-H 10.10.10.10 -S --sni
Test from Kali:
/usr/local/nagios/libexec/check_nrpe -H 10.10.10.254 -c check_https_10_10_10_10
Add service on Kali:
define service{
use generic-service
host_name anybus
service_description Anybus HTTPS check to 10.10.10.10
check_command check_nrpe!check_https_10_10_10_10
}
If HTTP returns:
HTTP CRITICAL - HTTP/1.1 301 Moved Permanently
then use HTTPS with:
-H 10.10.10.10 -S --sni
13. Simple Modbus TCP port check from Anybus
This checks whether Anybus can reach a Modbus TCP server on port 502.
Example:
Anybus 10.10.10.254 → TCP/502 → Ubuntu 10.10.10.7
On Anybus NRPE GUI, add:
Name:
check_modbus_10_10_10_7
Command:
check_tcp
Warning Level:
5
Critical Level:
10
Extra Options:
-H 10.10.10.7 -p 502
Test from Kali:
/usr/local/nagios/libexec/check_nrpe -H 10.10.10.254 -c check_modbus_10_10_10_7
Add Nagios service:
define service{
use generic-service
host_name anybus
service_description Anybus to Modbus TCP 10.10.10.7
check_command check_nrpe!check_modbus_10_10_10_7
}
This checks only that port 502 is open. It does not read Modbus registers.
14. Create fake Modbus server on Ubuntu
On Ubuntu 10.10.10.7, create a Python virtual environment:
sudo apt update
sudo apt install -y python3 python3-venv python3-pip
python3 -m venv ~/modbus-venv
source ~/modbus-venv/bin/activate
pip install "pymodbus==3.6.9"
Create script:
nano ~/Documents/modbus_server.py
Paste:
#!/usr/bin/env python3
from pymodbus.server import StartTcpServer
from pymodbus.datastore import ModbusSequentialDataBlock
from pymodbus.datastore import ModbusSlaveContext
from pymodbus.datastore import ModbusServerContext
from pymodbus.device import ModbusDeviceIdentification
store = ModbusSlaveContext(
di=ModbusSequentialDataBlock(0, [0] * 100),
co=ModbusSequentialDataBlock(0, [0] * 100),
hr=ModbusSequentialDataBlock(0, [123] * 100),
ir=ModbusSequentialDataBlock(0, [456] * 100),
)
context = ModbusServerContext(slaves=store, single=True)
identity = ModbusDeviceIdentification()
identity.VendorName = "Test"
identity.ProductCode = "TEST"
identity.ProductName = "Fake Modbus Server"
identity.ModelName = "Ubuntu Test"
identity.MajorMinorRevision = "1.0"
print("Starting fake Modbus TCP server on 0.0.0.0:502")
StartTcpServer(
context=context,
identity=identity,
address=("0.0.0.0", 502),
)Run it:
sudo ~/modbus-venv/bin/python ~/Documents/modbus_server.py
Check it is listening:
sudo ss -lntp | grep 502
15. Install check_modbus plugin on Kali
On Kali:
sudo apt update
sudo apt install -y git build-essential autoconf automake libtool pkg-config libmodbus-dev
Download and build:
cd /tmp
git clone https://github.com/AndreySV/check_modbus.git
cd check_modbus
Build:
./autogen.sh
./configure
make
If ./autogen.sh fails:
autoreconf -i
./configure
make
Install:
sudo cp src/check_modbus /usr/local/nagios/libexec/
sudo chmod +x /usr/local/nagios/libexec/check_modbus
Confirm:
/usr/local/nagios/libexec/check_modbus --help
16. Add check_modbus command in Nagios
sudo nano /usr/local/nagios/etc/objects/commands.cfg
Add:
define command{
command_name check_modbus
command_line $USER1$/check_modbus $ARG1$
}
17. Test Modbus register read from Kali
Different check_modbus plugins use different syntax, so do not copy random examples unless they match the installed plugin.
First check the plugin’s options:
/usr/local/nagios/libexec/check_modbus --help
For this guides installed plugin, the important options are:
-H Target IP address
-p TCP port, usually 502
-d Device/unit ID
-a Register or bit address
-f Modbus function
-F Data format
-w Warning threshold
-c Critical threshold
This guides plugin uses Modbus function numbers like this:
-f 1 = Read coils
-f 2 = Read input discretes
-f 3 = Read holding registers
-f 4 = Read input registers
And data format numbers like this:
-F 1 = int16_t
-F 2 = uint16_t
-F 3 = int32_t
-F 4 = uint32_t
-F 7 = float
-F 8 = double
Test:
/usr/local/nagios/libexec/check_modbus -H 10.10.10.7 -p 502 -d 1 -a 1 -f 3 -F 1 -w 200 -c 300
If address 1 fails, try address 0:
/usr/local/nagios/libexec/check_modbus -H 10.10.10.7 -p 502 -d 1 -a 0 -f 3 -F 1 -w 200 -c 300
The fake Modbus Server holding register value is 123, so with warning 200 and critical 300, it should be OK.
For input registers, the fake server uses value 456, and the function is -f 4:
/usr/local/nagios/libexec/check_modbus -H 10.10.10.7 -p 502 -d 1 -a 1 -f 4 -F 1 -w 500 -c 600
18. Add Modbus register service to Nagios
sudo nano /usr/local/nagios/etc/objects/linux.cfg
Add:
define service{
use generic-service
host_name ubuntu_modbus
service_description Modbus Holding Register 1
check_command check_modbus!-H 10.10.10.7 -p 502 -d 1 -a 1 -f 3 -F 1 -w 200 -c 300
}
If address 0 worked instead, use:
define service{
use generic-service
host_name ubuntu_modbus
service_description Modbus Holding Register 0
check_command check_modbus!-H 10.10.10.7 -p 502 -d 1 -a 0 -f 3 -F 1 -w 200 -c 300
}
19. Verify Nagios config
Always verify after changes:
sudo /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg
If successful:
sudo systemctl restart nagios
20. Open Nagios web interface
In your browser:
http://10.10.10.46/nagios
Login:
Username: nagiosadmin
Password: the password you created earlier
21. Force service recheck
In the Nagios web UI:
Services → click service → Re-schedule the next check of this service → Commit
Or restart Nagios:
sudo systemctl restart nagios
Final layout
You now have these checks:
Kali checks directly
Kali → Modbus register read → Ubuntu 10.10.10.7:502
Anybus checks through NRPE
Kali Nagios → NRPE on Anybus → Anybus ping 10.10.10.10
Kali Nagios → NRPE on Anybus → Anybus HTTPS 10.10.10.10
Kali Nagios → NRPE on Anybus → Anybus TCP/502 to 10.10.10.7
Important limitation:
Anybus can check TCP/502 with check_tcp.
Anybus cannot read Modbus registers unless it has modpoll, mbpoll, check_modbus, Python, or another Modbus client installed locally.