Monitoring IP Restrictions [closed]

Question

Let's say we have web servers that are behind a firewall. There are some IP limitations rules applied to the firewall, for several ports / protocols :

• SSH, SFTP, SSH
• Some Web applications (specific port, for instance http://www.application-example.com:8080/)

These are settings, and sometimes they get messed up for X reasons (human interventions or system failure, etc ...)

Is there any service, that offers monitoring capabilities, that send alerts when these restrictions are not working ?

(For the opposite, we have service like Pingdom or IPLabel, that alert if your site is Down. Unfortunatly, we cannot do the opposite with PingDom service)

Answer 1

If I understand your question correct, you want to get an alert if a port is not closed anymore because someone on the server messed up with the config files.

What you can do is install a host based intrusion detection system (like tripwire) which keeps track of the config files and alerts you if they change.

An other possibility is to test if the ports are open from outside with a monitoring system like nagios that does a portscan to your host and reports any change. See here for nmap with nagios.

Answer 2

Icinga seems to be what you actually need with appropriate plugins (and configuration).