Suppose I have a server with a private interface and a public interface. Public might have things like HTTP(S) servers, private might have MySQL and SSH.
Obviously Nagios is useful to check that the services are running on their respective interfaces. But is it a good idea to build checks that explicitly test that the MySQL and SSH ports are not open on the public interface? The idea is to catch inadvertent misconfigurations that have opened up services that should be private, and alert appropriately.
Part of me has the idea that this wouldn't scale terribly well -- imagine there is an iptables DROP rule, for example, the check would have to wait until the check timeout exceeded before it can complete and move on. But that timeout would have to be sufficiently high to be able to differentiate a blocked service from an open one that's really bogged down.
Is this a practical idea? Is Nagios the right tool? I haven't even looked into the feasibility of negating the result from the TCP check plugins, but I'm sure it's doable...