BitNinja Plugin

This plugin collects statistics from the BitNinja server security agent and sends them to 360 Monitoring.

Reported Metrics

The plugin runs bitninjacli --stats --minify and reports the JSON it returns as-is. The metrics you see therefore depend on your BitNinja version and on the BitNinja modules you have enabled. They are the same statistics BitNinja itself reports for the server.

Requirements

• BitNinja version 2.38.8 or later.
• The bitninjacli command at /usr/sbin/bitninjacli, which is its default location with a standard BitNinja installation. If it is elsewhere, see Configuration options.

Configure BitNinja

Statistics access for the agent is off by default. Add the following to /etc/bitninja/System/config.ini:

[statistics]
enableIntegration = 1

Then restart BitNinja:

service bitninja restart

Allow the agent to run bitninjacli

The agent normally runs as the agent360 user, and the plugin runs the command through sudo. The agent can't type a password, so it needs a sudoers rule. Create /etc/sudoers.d/agent360-bitninja (mode 0440) with the single command the plugin runs:

agent360 ALL=(root) NOPASSWD: /usr/sbin/bitninjacli --stats --minify

Then check the file:

visudo -cf /etc/sudoers.d/agent360-bitninja

Allowing only these arguments means the agent can read the statistics but can't change the BitNinja configuration. Avoid a rule that allows bitninjacli with any arguments.

If you use a custom statCommand (see below), the sudoers rule has to match that exact command.

Configure the plugin

Add the following lines to the /etc/agent360-custom.ini file:

[bitninja]
enabled = yes

Configuration options

statCommand is run through a shell, so only put a trusted value in it, and keep the /etc/agent360-custom.ini file writable by root only.

Test the plugin

After BitNinja has restarted, run:

sudo -u agent360 agent360 test bitninja

The output should be the BitNinja statistics. Then restart the agent for the change to take effect:

service agent360 restart

Troubleshooting

• The test returns an error or nothing. Run the command yourself and check that it prints JSON:
  Bash

  sudo -u agent360 sudo /usr/sbin/bitninjacli --stats --minify

  • If it asks for a password or says it's not allowed, fix the sudoers rule. The path and arguments have to match the plugin's command exactly.
  • If it says statistics are disabled, check enableIntegration = 1 and restart BitNinja.
  • If the command isn't found, set statCommand.
• No data in the dashboard. Make sure the [bitninja] section is in /etc/agent360-custom.ini, that enabled = yes, and that you restarted the agent.