CtechZ: Cyber Security | Hacking | Malware Analysis| Threat Intelligence | Linux Tutorials

Cacti is a network graphing tool. Cacti is a complete frontend to RRDTool, it stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven. Along with being able to maintain Graphs, Data Sources, and Round Robin Archives in a database, cacti handles the data gathering. There is also SNMP support for those used to creating traffic graphs with MRTG.

Requirements
*****************
You need to install the following software on RHEL / Fedora / CentOS Linux:

    MySQL Server : Store cacti data.
    NET-SNMP server - SNMP (Simple Network Management Protocol) is a protocol used for network management.
    PHP with net-snmp module - Access SNMP data using PHP.
    Apache / lighttpd / ngnix webserver : Web server to display graphs created with PHP and RRDTOOL(acronym for round-robin database tool).

RRDtool is the OpenSource industry standard, high performance data logging and graphing system for time series data. RRDtool can be easily integrated in shell scripts, perl, python, ruby, lua or tcl applications.

Install the Following software
**************************
# yum install mysql-server mysql php-mysql php-pear php-common php-gd php-devel php php-mbstring php-cli php-snmp php-pear-Net-SMTP php-mysql httpd

Configure MySQL server
*********************
# mysqladmin -u root password NEWPASSWORD

Create cacti MySQL database
*************************
Create a database called cacti, enter:

# mysql -uroot -pmysql

mysql> create database cacti;

Create a user called "cacti" with a password called "redhat"

mysql> grant all on cacti.* to cacti@localhost identified by 'redhat';
mysql> flush privileges;
mysql> quit

Install snmpd
*************
# yum install net-snmp-utils php-snmp net-snmp-libs

Configure snmpd, open /etc/snmp/snmpd.conf

# vim /etc/snmp/snmpd.conf

com2sec local     localhost           public
group MyRWGroup v1         local
group MyRWGroup v2c        local
group MyRWGroup usm        local
view all    included .1                               80
access MyRWGroup ""      any       noauth    exact all    all    none
syslocation Unknown (edit /etc/snmp/snmpd.conf)
syscontact Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat

Save and close the file. Turn on snmpd service:

# /etc/init.d/snmpd start
# chkconfig snmpd on

Make sure you are getting information from snmpd:

# snmpwalk -v 1 -c public localhost IP-MIB::ipAdEntIfIndex

Sample ouptut:
IP-MIB::ipAdEntIfIndex.10.10.29.68 = INTEGER: 2
IP-MIB::ipAdEntIfIndex.67.yy.zz.eee = INTEGER: 3
IP-MIB::ipAdEntIfIndex.127.0.0.1 = INTEGER: 1

Install cacti
***********
First, make sure EPEL repo is enabled. Type the following command to install cacti:

# rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm

# yum install cacti

Install cacti tables
*****************
Type the following command to find out cacti.sql path:

# rpm -ql cacti | grep cacti.sql

/var/www/cacti/cacti.sql

Type the following command to install cacti tables

# mysql -uroot -pmysql cacti < /var/www/cacti/cacti.sql

Configure cacti
*************
Open /var/www/cacti/include/config.php file, enter:

# cd /var/www/cacti/include/
# vim config.php -------> in some versions it is db.php

/* make sure these values refect your actual database/host/user/password */
$database_type = "mysql";
$database_default = "cacti";
$database_hostname = "localhost";
$database_username = "cacti";
$database_password = "redhat";
$database_port = "3306";
$database_ssl = false;

Save and close the file.

Configure httpd
**************
Open /etc/httpd/conf.d/cacti.conf file, enter:

# vim /etc/httpd/conf.d/cacti.conf

You need to update allow from line. Either set to ALL or your LAN subnet to allow access to cacti:

Alias /cacti/ /var/www/cacti/
<Directory /var/www/cacti/>
    DirectoryIndex index.php
    Options -Indexes
    AllowOverride all
    order deny,allow
    deny from all
    allow from 192.168.1.0/24
    AddType application/x-httpd-php .php
    php_flag magic_quotes_gpc on
    php_flag track_vars on
</Directory>

Edit and Save the file.

Another option is create /usr/share/cacti/.htaccess file and password protect the directory. Finally, restart httpd:

# service httpd restart

Setup cacti cronjob for poller for data collection
*****************************************
Open /etc/cron.d/cacti file, enter:
# vim /etc/cron.d/cacti

*/5 * * * *     cacti   /usr/bin/php /var/www/cacti/poller.php &>/dev/null

Save and close the file. and start crond

# service crond restart

In Browser:- http://192.168.1.67/cacti/

Just follow on screen instructions. The default username and password for cacti is admin / admin. Upon first login, you will be force to change the default password.

Default Username & Passwd: admin/admin
Changed Username & Passwd: admin/cacati

How do I configure SNMP data collection
**********************************
SNMP can be used to monitor server traffic. Once installed login to cacti.

===> Click on Devices ==== Localhost

=> Make sure SNMP options are selected as follows:

Version2---public---161---500---10

And Save it.

How do I create SNMP graphs
**************************
Click on "Create Graphs for this Host" link on top right side.

Select SNMP - Interface Statistics

Select a graph type (such as In/Out bytes with total bandwidth)

Create A Device In Chart
**********************
Either Click "Console" tab then you can see the below items on the screen

   * "Create devices" for network
   * "Create graphs" for your new devices
   * View your new graphs

Or Click on the "Devices" tab and do the below things, its same for both way.

-----> Click "Create devices" tab. Next Page will appear, on its right hand side click "Add" tab. After getting a new page fill the page with all the host details and click "create" at the bottom. It will add the host to cacati. And then Add "Associated Graph Templates" from the bottom of the page. select appropriate template and click add.

-----> And then add "Associated Data Queries" and "Save". After saving create the graph for the Host. You can create the graph from the top of the current window OR click "Devices" there you can see the newly added host. click on it, At right side you can see "Create Graphs for this Host" link click on it. There you can select each 'Graph Templates' and select "create" to setup graph for each.

After that add chart for "Data Query" ( Interface Statistics ) and also for (Mounted Partitions ) this is up to each one, what they create.

-----> To Add the newly added host under the graph tree menu we already created(Pfx25) go to "Graph Trees" menu. There we can see the main tree Pfx25, click "Add"
        Parent Item              : root
        Tree Item Type         : Host
        Host                    : select the host we want
        Graph Grouping Style :
        Round Robin Archive :

   After filling this give 'create' and then 'save'.

Then to view the graph go to "graph" menu on top. there we can see the newly added host as well winder the main menu Pfx25.

To create A new User
*******************
Go to "User Management"

Create Graphs
*************
Still in the device screen from above, click at the top right Create Graphs for this Host

In this screen, you can select as many of the potential graphs as desired.

For the Virtual Server, you will need to create the Connection Rate, Connections/s, & the Traffic graphs in separate steps via the select box at the bottom

Click Create

Accept the Defaults, Click Create again

Note: Created graphs will be listed at the top of the screen

How do I view graphs
*******************
To view graphs click on Graphs tab.

Manage Graphs

1. In the GUI menu on the left under Management, click Graph Trees
2. Click Add
3. Under Name, I define the F5 device hostname, but it can be anything
4. Under Sorting Type, select your preference
5. Click Create
6. In the GUI menu on the left under Management, click Graph Management
7. Select the Host you created
8. Select the Graphs you created
9. In the Choose an Action select box, select Place a tree (your new tree)
10. Click Go
11. Click Yes
12. Click the Graphs Tab at the top of the screen
13. Select the Tree you created
14. View your graphs!

snmp commands
***************
snmpwalk -Os -c mycommunity -v 1 localhost system
snmpwalk -Os -c public -v 1 localhost system

Configuring Client Machines
************************
just install snmp on each client machines. Then configure the host in cacati.

This section is optional and for those looking to use Cacti to monitor additional devices. These steps are written for other CentOS-based distributions, but with modification, will work on any flavor of Linux. You will need to follow these instructions for each client machine you'd like to monitor with Cacti. Client machines need an SNMP daemon in order to serve Cacti information.

First, install snmp and snmpd on the client:

# yum install net-snmp-utils php-snmp net-snmp-libs

Configure snmpd, open /etc/snmp/snmpd.conf
# vi /etc/snmp/snmpd.conf

Append / modify it as follows (see snmpd.conf man page for details):

com2sec local     localhost           public
group MyRWGroup v1         local
group MyRWGroup v2c        local
group MyRWGroup usm        local
view all    included .1                               80
access MyRWGroup ""      any       noauth    exact all    all    none
syslocation Unknown (edit /etc/snmp/snmpd.conf)
syscontact Root (configure /etc/snmp/snmp.local.conf)
pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat

Save and close the file. Turn on snmpd service:

# /etc/init.d/snmpd start
# chkconfig snmpd on

Make sure you are getting information from snmpd:

# snmpwalk -v 1 -c public localhost IP-MIB::ipAdEntIfIndex

                                                New SSH-KeyPair on aws server

1. Open aws interface Network & Security --------> KeyPair and generate a new keypair

2. Press "Create key Pair" tab and generate a new keypair, Download it and save it in a location

3. chmod 600 tintinctechz.pem   ---- give the file a secure permission

4. Then using ssh-keygen(authentication key generation)generate a new authkey for new .pem file

$ ssh-keygen -y
Enter file in which the key is (/home/tech/.ssh/id_rsa): tintinctechz.pem
   -------- Give the .pem file name or location here

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsm9OwjJiaTgnhlh9PEZZjVwzHixrhMET0oHv6aREqQ9K1qtvQU0Zg8VvYmKASXiYIrrzbHiK8+QVo9DwbJ4a+em0+bj+fqm2hhpROV63+Y4XCt9Em8fUrNnJPN4GMKfHEPF1B4sWbh3phLYKThKa4FhW71D6ZZTDR7Vn4R0XdqShHMt8rlBYtxAuMkAcIDQGPBuVeBPgx3pgRboFUcIKZ/Iix/Zg2QKA51Ak3zFApIawyEd2oKQxMFcgOG20+ls448sxuKZ+b1fqYv92tpdvVegB4rO52QrzGNGqGsLInEw5uryznjBf2EhgjKI5RvBSWRmjUTYT6FSrA8il+pH+1

5. Copy this key and login into aws server and replace this key with current key in "authorized_keys"