December 2012 - Xymon - Xymon mailman web

Xymon security concern raised
by sholmes42＠mac.com 08 Dec '12

08 Dec '12

I have a customer who is concerned that anyone could send data messages to the xymon server with one of his host names and Xymon would accept it as real thus potentially masking an attack. Note that this is in a university environment, so even if data can come only from campus addresses we might not necessarily trust the data. Is there a way to get Xymon to check the IP address on incoming data packets to verify that it is coming from the host it claims to be? Thanks, Steve Holmes Purdue University

11 15

Disabling systems results in xymond error status?
by Mike.Burger＠FreedomMortgage.com 06 Dec '12

06 Dec '12

While looking at an answer for Tom Schmitt, I opted test by disabling "ALL" on a couple of my own systems for a minute. When the scheduled "disable" (i.e. maintenance mode) tasks ran, xymon threw a yellow alarm for xymond with the following: Latest error messages: Ran scheduled task 2 from XXX.XXX.XXX.XXX: disable host1,my-domain,org.* 1 Disabled by: me @ ###.###.###.### Reason: Testing Ran scheduled task 1 from XXX.XXX.XXX.YYY: disable host2,my-domain,org.* 1 Disabled by: me @ ###.###.###.### Reason: Testing I'm trying to figure out: a) Is this the correct behavior? It seems to me that if you put a system (or systems) into maintenance, an error state should not be reported...especially on a scheduled task. b) Why is the error state showing up on the xymon server's xymond indicator? c) This may be more my preference than the majority. When the systems come back from maintenance, if the various monitor statuses haven't changed since the pre-maintenance period, wouldn't it be better to have those status indicators reflect that the actual status is the same as previously indicated (i.e. if disk, memory, msgs, ports, etc all reflected normal for more than 24 hours...dark green if you're using the LED theme, for example...my feeling is that unless there is actually an alarm for those monitors, they should return to the previous state, rather than a state indicating a recent ( < 24hr) change. Thanks. -- Mike Burger AIX Administrator <http://freedomhome.fhmc.local/intranet/main.jsp> Phone (317) 537-3680, Fax (317) 537-4680, Cell (317) 797-2040 E-mail: Mike.Burger at FreedomMortgage.com <mailto:Anthony.House at freedommortgage.com> "Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.

1 0

xymonproxy messages getting truncated
by keenha＠gmail.com 06 Dec '12

06 Dec '12

I'm have several xymonproxy servers (over the other side of the world) which send data to my main xymon server. The trouble is that the data received by the xymon server is sometimes getting truncated, and thus it reports false red alerts - usually with procs. The xymon server itself does NOT report that it's getting truncated messages, and nor does the xymonproxy. I suspect that the network connection between the proxy and the main server is being dropped and some of the data is being lost, but the failed data is not being resent. Has anyone got any ideas what can be done about this please? I'm getting fed up with alerts saying that my servers are running no procs at all when they blatantly are :). Cheers, Heather

3 3

Xymon security concern raised
by Rolands＠logicaltech.com.au 06 Dec '12

06 Dec '12

I have the cluster logicalhost names in hosts.cfg, don't care about the rest of the tests. I also have the real zones running the xymonclient in that zone with all its built in monitoring. Monitoring all cluster resources from the globalzone makes the script so much easier. group-only ftp-rs|app-rs|ora-server-rs|ora-lsnr-rs CLUSTER-Resources 10.0.1.40 ftp01-lh # noconn 10.0.1.30 app01-lh # noconn 10.0.1.20 ora01-lh # noconn - Roland -----Original Message----- From: Benjamin P. August [mailto:baugust at stanford.edu] Sent: Thursday, 6 December 2012 11:49 AM To: Roland Soderstrom Cc: xymon at xymon.com Subject: Re: [Xymon] Xymon security concern raised I know this is offtopic, but how did you get them to not end up as ghost clients with differing hostnames and sent-from values? I'd really love to do this for monitoring multiple ESXi machines on the internal network from one server. I tried using multihomed in hosts.cfg, but was not having much luck. ----- Original Message ----- From: "Roland Soderstrom" <Rolands at logicaltech.com.au> To: xymon at xymon.com Sent: Wednesday, December 5, 2012 12:51:41 PM Subject: Re: [Xymon] Xymon security concern raised On a side note I actually do this on purpose in my environment. I got a Solaris Cluster running cluster resources in zoneclusters. Instead of running ext/scripts in the zone I run them in the globalzone and fake the delivery hostname to be the zoneclusters logicalhostname. Eg. Xymon $XYMSRV "status <zoneclusterhostname>.clustertest $COLOR `date` $Message" Works brilliantly. I remember a while back there was a discussion on how to encrypt the message over the xymon port 1984, that will surely prevent any false messages going through. (as false clients can't encrypt with the right key) Can't remember the outcome of the discussion. - Roland -----Original Message----- From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Novosielski, Ryan Sent: Thursday, 6 December 2012 7:39 AM To: Steve Holmes Cc: xymon at xymon.com Subject: Re: [Xymon] Xymon security concern raised -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My understanding is that it's fairly easy to do, also. I don't know if having a proxy in between helps at all or any of that, but my understanding is that what's sent is fairly simple and plain text (I believe there's info about the protocol in the manual). That said, I'm not 100% sure what nefarious thing someone could do with that information. I guess they could open the rlogin port or something and then send a status message to indicate it's still closed? On 12/05/2012 03:20 PM, Steve Holmes wrote: > I believe the concern is that a student or other 'non-admin' could > send a packet from an unconfigured workstation masquerading as a > configured host. I think I need to do a little more research on the > problem. Thanks! Steve > > On Wed, Dec 5, 2012 at 12:30 PM, Tim McCloskey <tm at freedom.com > <mailto:tm at freedom.com>> wrote: > > Not sure that can be done in Xymon currently. > > So, is the concern that one of the configured hosts could pretend to > be one of the other configured hosts? If not, a nice packet > filter/firewall allowing tcp:1984 from only the Xymon hosts -> Xymon > server would provide a possible fix for that. > > Regards, Tim ________________________________________ From: > xymon-bounces at xymon.com <mailto:xymon-bounces at xymon.com> > [xymon-bounces at xymon.com <mailto:xymon-bounces at xymon.com>] on behalf > of Steve Holmes [sholmes42 at mac.com <mailto:sholmes42 at mac.com>] Sent: > Wednesday, December 05, 2012 9:14 AM To: xymon at xymon.com > <mailto:xymon at xymon.com> Subject: [Xymon] Xymon security concern > raised > > I have a customer who is concerned that anyone could send data > messages to the xymon server with one of his host names and Xymon > would accept it as real thus potentially masking an attack. > > Note that this is in a university environment, so even if data can > come only from campus addresses we might not necessarily trust the > data. > > Is there a way to get Xymon to check the IP address on incoming data > packets to verify that it is coming from the host it claims to be? > > Thanks, Steve Holmes Purdue University > > > > > > -- If they give you ruled paper, write the other way. -Juan Ramon > Jimenez, poet, Nobel Prize in literature (1881-1958) > > I prayed for freedom for twenty years, but received no answer until I > prayed with my legs. -Frederick Douglass, Former slave, abolitionist, > editor, and orator (1817-1895) > - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlC/sNIACgkQmb+gadEcsb5FcgCfck8FSSTUeliU9HOmiN+FlFbA 3WEAnioFl9s0Y+08N6V6ox5f4tNH5F6G =1fR8 -----END PGP SIGNATURE----- _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

2 1

one of the dependent router conn fail but ping success
by vadud3＠gmail.com 05 Dec '12

05 Dec '12

$ xymoncmd xymonnet --no-update --debug --ping --trace --checkresponse --timeout=30 --concurrency=50 shows conn/ping failure for 192.168.65.254 status+30 192,168,65,254.conn red  Tue Dec 4 14:40:30 2012 conn NOT ok Service conn on 192.168.65.254 is not OK : Host does not respond to ping System unreachable for 774 poll periods (232704 seconds) &red 192.168.65.254 is unreachable But success with just 192.168.65.254 as the host $ xymoncmd xymonnet --no-update --debug --ping --trace --checkresponse --timeout=30 --concurrency=50 192.168.65.254 11079 2012-12-04 15:02:14 Adding to combo msg: status+30 192,168,65,254.conn green  Tue Dec 4 15:02:14 2012 conn ok 11079 2012-12-04 15:02:14 Flushing combo message combo status+30 216,111,65,254.conn green  Tue Dec 4 15:02:14 2012 conn ok Service conn on 192.168.65.254 is OK (up) &green 192.168.65.254 is alive (51.2 ms) $ fping 192.168.65.254 192.168.65.254 is alive What gives? -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

1 2

Graph generation suppression
by mjones＠mnsi.net 05 Dec '12

05 Dec '12

We have some switches with 175 plus ports and we would like to not display the graphs for them all on one page. We have created a way to link to them individually but they still all show up on the main page. Any ideas how I can do this? Mark Jones Operations Managed Network Systems London Desk 519-679-5207 Windsor Desk 519-258-2333 x8417 Cell 519-521-8222

1 0

findhost.c / cgi behaviour
by cami＠hack.co.za 05 Dec '12

05 Dec '12

Hi, This is mainly an issue i ran into when having duplicate names for locations, which allows us to keep locations looking consistent with one another, eg: hosts.cfg: .. page CPT CPT subparent CPT monitoring monitoring subparent monitoring xymon xymon group-compress <h3><i>xymon</i></h3> 64.71.152.161 cpt.hack.co.za page JHB JHB subparent JHB monitoring monitoring subparent monitoring xymon xymon group-compress <h3><i>xymon</i></h3> 64.71.152.162 jhb.hack.co.za .. Xymon will display that type of thing as you would expect it to when looking at the menus. The issue comes when trying to use findhost to see on which page " jhb.hack.co.za" exists. What currently happens is that findhost finds a match, but the match would be "CPT/monitoring/xymon" instead of "JHB/monitoring/xymon". Regards, Cami

1 0

Can't get data: distinguishing between icons
by David.Mills＠ngc.com 05 Dec '12

05 Dec '12

All - Could someone please spell out for me the differences between the different icon displays indicating there's a problem getting data for a particular host / test? No icon: (dash displayed in the given column) Purple: Clear: Thanks! david ~~~~~~~~~~~~~~~~~~~ David Mills Systems Administrator Northrop Grumman 512-595-1238 david.mills at ngc.com

3 3

problem with xymon
by Christophe.Baroni-EXTERNAL＠gemalto.com 05 Dec '12

05 Dec '12

Hi, I try to install xymon but when I add a new server in the hosts.cfg file the name of server and his ip address, this information don't appear in the xymon map. Please what is the file that I must modified for have the good hour and a good day in the page with the different alert. Best regards christophe

4 7

[Xymon] [Newbie] Smaller, lighter Xymon based program?
by henrik＠hswn.dk 05 Dec '12

05 Dec '12

Hi James, On Mon, 26 Nov 2012 18:44:48 -0800, James <kfc.android at gmail.com> wrote: > The reason why I want to modify Xymon is because I'm working on a small > class project which only need a simple networking-related function > (in my case: ping) with minimal size of code. [snip] > My optimal goal is: to use minimal amount of code to perform a ping test, > but keep the framework and style of Xymon. (Now I'm reading Xymonping.c > file under /xymonnet folder) I think those are somewhat conflicting goals; keeping a Xymon style "framework" will require more work than what is really necessary for a "small class project". My guess is that the primary focus of your project is to show that you understand some network programming, rather than prove that you understand the details of Xymon - although I would be personally flattered if Xymon became mandatory teaching :-) My advice to you would be: Is it a requirement to use ping as the network test, or could you use a TCP connection as the network test ? ping is a bit complicated, because the normal network programming API's don't support it directly - you have to more or less construct the contents of each packet yourself. The socket API in Unix (or Winsock on Windows) have much better support for a normal transport-layer protocol - TCP - so that would allow you to show that you understand network programming, rather then getting bogged down with the details of ICMP packet request/response formats. If you are allowed to use normal TCP connections for your network test, try writing some code using the Unix socket API and non-blocking sockets. I.e. you need to use the socket(), connect(), select(), read(), write() and close() API's - plus the various little details of getting all the data structures setup correctly. There must be lots of sample code for this - not least the "select_tut(2)" man-page in Linux - but for Xymon code look at lib/sendmsg.c the "sendtoxymond()" routine, or xymonnet/contest.c file "do_tcp_tests()". The first one is good to understand the basics, because it does one connection at a time; the xymonnet/contest.c code is a bit more complicated, because it juggles multiple connections at once. With TCP, you can use a connection to e.g. port 80 (web) or some other port - possibly something user-configurable on a per-host basis. If you must use ping, then xymonping.c borrows heavily from fping, so have a look at that code as well. Once you know how to check if you can connect/ping a host, then you can decide what the configuration file should be like, and how the test results can be reported. If you want something "xymon-like", then perhaps you can just generate a simple webpage listing the test result, so it gets updated whenever your test-program runs. Regards, Henrik PS: I know this does go a bit off-topic for the Xymon list, but we've all had to learn things at some point. So I'm just trying to guide the newbies in the right direction :-)

3 2