August 2019 - Xymon - Xymon mailman web

Xymonnet 4.3.29 coredumping
by mschultheiss＠ivytech.edu 19 Aug '19

19 Aug '19

We noticed our dev Xymon box's disk was filling up over the weekend and looking into it, there are hundreds of coredumps in /. Running gdb against them, I see xymonnet is exiting signal 6 and core dumping. We're using the terabithia RPMS on RHEL 7. -- ------------------------------------------------------------- Michael Schultheiss, RHCSA, RHCE OIT Administration Sr. Unix Systems Engineer Ivy Tech Community College schultmc at ivytech.edu

2 1

Xymon 4.3.29 Released - Important Security Update
by cleaver＠terabithia.org 13 Aug '19

13 Aug '19

Hello all, Xymon 4.3.29 has been released to Sourceforge and should be propagating to mirrors as I write this. Along with an assortment of bug fixes and compilation compatibility fixes for recent glibc systems, this version contains several fixes for security vulnerabilities within some CGI parsing. Although some of these overflows are not exploitable, others, including an XSS vulnerability are. Fixes beyond these CVEs have been made throughout the library, web, and network code to help reduce the likelihood of similar issues in other areas. As a result, all users are encouraged to upgrade. The specific CVEs in question are: ? CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, ? CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486 Henrik and I would like to extend our thanks to the University of Cambridge Computer Security Incident Response Team, which reported the issues and helped validate their resolution. Full release notes and other changes are available with the released tarball at https://sourceforge.net/projects/xymon/files/Xymon/4.3.29/ As always, thank you to everyone who has contributed patches, ideas, code, and feature requests to the project! Sincerely, Japheth "J.C." Cleaver

12 28

Windows XymonPSClient v2.42
by zak.beck＠accenture.com 13 Aug '19

13 Aug '19

Hi v2.42 has been committed - this contains a minor change. Download from SVN<https://sourceforge.net/p/xymon/code/HEAD/tree/sandbox/WinPSClient/> (the documentation has been updated also). * added maxloop client-local configuration item - this causes the XymonPSClient Windows service to be restarted periodically (after a set number of data collections) This is useful for a few servers where the memory usage of the client appears to grow over time. We've found and fixed a number of causes of this but it is still occurring on some servers. There are so many variations of Windows version & patch level / .NET version & patch level / Powershell version & patch level and we don't have a great deal of control over when Powershell manages memory. For these problem servers, restarting the Windows service periodically seems to be the best solution. Maxloop is specified in client-local, with the number of collections to restart after (maxloop:288) - by default the client collects data every 5 minutes so there are 12 collections per hour and 288 collections per day. If you do not specify maxloop, the service will not be restarted. Thanks to Andy Smith (abs at shadymint.com<mailto:abs at shadymint.com>) for the initial patch and testing. Zak ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update)
by tschmidt＠micron.com 09 Aug '19

09 Aug '19

I likewise see one more issue with 4.3.29 that I am trying to correct. The xymonnet RPC check is not displaying the RPC test summary correctly at the top of the svcstatus report. It should look like this: Mon Apr 1 10:53:02 2019 rpc ok, green Service rpcbind (ID: 100000) found on port 111 green Service ypbind (ID: 100007) found on port 1013 Command: rpcinfo -p 1.2.3.4 2>&1 Instead, it is getting truncated like this: Thu Aug 8 10:42:07 2019 rpc ok, green S Command: rpcinfo -p 1.2.3.4 2>&1 The truncation is causing any red/yellow/green RPC checks to not show properly at the top of the svcstatus report. Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of John Horne Sent: Thursday, August 8, 2019 10:16 AM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update) On Mon, 2019-08-05 at 13:26 -0700, Japheth Cleaver wrote: > Thanks, this does indeed fix the issue. I've added in underscores > (which have been valid for hostnames in xymon, though not in reality) > to match the checks elsewhere. Would appreciate if others could confirm on this. > > Fix/patch is committed in > https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsour > ceforge.net%2Fp%2Fxymon%2Fcode%2F8072%2F&data=02%7C01%7Ctschmidt%4 > 0micron.com%7C64388b4a70ef471166d708d71c1bcbf8%7Cf38a5ecd28134862b11ba > c1d563c806f%7C0%7C0%7C637008778033157428&sdata=L9XY5CBlGUlIFZDQpaO > kV0nffOL4RDS0uIN%2F6uJELFc%3D&reserved=0 ; > 4.3.30 with this to come shortly. > Sorry - stealing the subject - could I ask to hold fire with 4.3.30 for a little while. There still seems to be a problem with graph titles when using 'exec:'. I'm just trying to track it down now (looks like an extra double-quote has crept in somewhere). Thanks. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plymou…]<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plymou…> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form. _______________________________________________ Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…

1 1

Mail pipelining
by scarville＠lereta.com 09 Aug '19

09 Aug '19

How does XYMon send mail? I am seeing several of these kinds of messages in /var/log/maillog on the mail server (scamail01) but no corresponding errors in /var/log/maillog on the xymon (rcaxymon01) server. This doesn't seem right. Aug 9 07:21:41 scamail01 postfix/smtpd[32480]: connect from rcaxymon01.lereta.net[10.212.2.27] Aug 9 07:21:41 scamail01 postfix/smtpd[32480]: improper command pipelining after EHLO from rcaxymon01.lereta.net[10.212.2.27] Aug 9 07:21:41 scamail01 postfix/smtpd[32480]: disconnect from rcaxymon01.lereta.net[10.212.2.27] I could turn off reject_unauth_pipelining but I'd prefer not to. XYMon version: 4.3.29 (built from source) Platform: CentOS Linux release 7.6.1810 Postfix version: 2.10.1 -- Stephen

1 1

RPMs 4.3.29 - showgraph bug - PATCH
by john.horne＠plymouth.ac.uk 09 Aug '19

09 Aug '19

Hi, Attached is a unified diff patch to the 'web/showgraph.c' file for the Terabithia RPMs based on version 4.3.29. So if the file hasn't changed in the 4.3.30 branch then it should be okay to just apply it directly. The patch is only 2 (non-contiguous) lines long. The first line just removes some redundant maths. Both lines cater for the fact that 'snprintf' is now used in the code. That function has the unfortunate habit of returning the string length (say 10 characters), but the provided buffer must be large enough to hold the string *and* the terminating null character (so 11 characters). In testing it was found that the string was being truncated by one character because the terminating null was being forced onto the end. When used with 'exec:' in graph titles, this caused the title to not appear at all. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

1 0

preventing new columns
by rcohen55＠gmail.com 09 Aug '19

09 Aug '19

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20190809/bc8a38d7/attach…>

1 0

Xymon 4.3.29 Released - Important Security Update
by tschmidt＠micron.com 08 Aug '19

08 Aug '19

I looked at the source code of 4.3.29 for more instances where dashes in the hostname was not being accepted. I found that the web/reportlog.c file also needed patched to allow dashes and underscores in hostnames and service names for the "Availability Report" feature. Attached is the patch file for it as well. Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Tom Schmidt (tschmidt) Sent: Monday, August 5, 2019 11:03 AM To: Richard L. Hamilton <rlhamil2 at gmail.com>; xymon at xymon.com Subject: RE: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update I likewise see that history button issue for hostnames with dashes or underscores. Attached is a context diff patch file to fix the issue. Are there other alphanumerics in hostnames that should be added to line 608 of the web/history.c file? Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Richard L. Hamilton Sent: Monday, August 5, 2019 10:53 AM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update Yes, I'm seeing the dash problem too. Some of my VMs have dashes in the name (since they don't migrate, it makes it easier to remember which host they're on); most don't run all the time ("dialup" if you will), but one (actually a Solaris zone) does. All the ones with dashes in the name get "Cannot open history file". Please fix!!! > On Aug 5, 2019, at 11:51, John Horne <john.horne at plymouth.ac.uk> wrote: > > On Mon, 2019-08-05 at 07:52 -0700, Japheth Cleaver wrote: >> On 8/5/2019 6:19 AM, Dirk Kastens wrote: >>> Hi, >>> >>> I just upgraded our xymon server on Scientific Linux release 6.10 >>> frpm xymon 4.3.28 to 4.3.29. >>> >>> Two things are not working any longer: >>> >>> http authentication: I defined the login information in the file >>> /etc/xymon/netrc, which worked before the upgrade. Now the http test >>> are red with the message "Authorization Required". >>> >>> history files cannot be opened any more. When I click on the history >>> button of a test, I get an empty page with the message "Cannot open >>> history file" >> >> Thanks, >> > ... > >> >> For history file checking, can you verify that hosts with dashes in >> the name show this symptom while those with just alphanumerics (and >> periods) don't? I believe this may actually be the bug cause here. >> > Interesting. Can confirm that our clients without a hyphen/dash in the > name work fine with history. The hosts with a hyphen/dash do not - > they get a "Cannot open history file" error. > > > > John. > > -- > John Horne | Senior Operations Analyst | Technology and Information > Services University of Plymouth | Drake Circus | Plymouth | Devon | > PL4 8AA | UK ________________________________ > [https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > plymouth.ac.uk%2Fimages%2Femail_footer.gif&data=02%7C01%7Ctschmidt > %40micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11 > bac1d563c806f%7C0%7C0%7C637006207919043258&sdata=PU9uQpCzE4ncJnmC9 > GDVRFV7n9silwy1FQP3IyCYMNk%3D&reserved=0]<https://nam01.safelinks. > protection.outlook.com/?url=http%3A%2F%2Fwww.plymouth.ac.uk%2Fworldcla > ss&data=02%7C01%7Ctschmidt%40micron.com%7Cad7b0f57ffe848cc8adf08d7 > 19c564d8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C6370062079190432 > 58&sdata=%2BkT7Ki%2FfHy2o96Tf2Z483xvGh2UUxEauM%2BJHcv5uK0k%3D& > reserved=0> > > This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form. > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists > .xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40 > micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11bac > 1d563c806f%7C0%7C0%7C637006207919043258&sdata=0jIe1wKKWphh7%2FFhir > dYAB8Z8A4Qwbr%2BKIKcOdV5kMA%3D&reserved=0 _______________________________________________ Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…

7 7

xymond_rrd program crashed
by tschmidt＠micron.com 07 Aug '19

07 Aug '19

Andreas, I likewise am seeing xymond_rrd program crashing with 4.3.29 but it did not with 4.3.28. If you look at the differences in the xymond/rrd/do_netstat.c between 4.3.28 and 4.3.29 you will see that the code was updated to handle newer Linux systems net-tools format. Your logs also show that it is not recognizing the OS for your "rackstation*" hosts. I do not know what type of OS these systems are, but you may have to update your netstat monitor or the xymond/rrd/do_netstat.c code to recognize their netstat output format. For me, xymond_rrd is crashing when trying to extract RRD data from some of our temperature reports. Some of our older temperature monitors returned data in this format: Device Temp(C) Temp(F) Threshold(C) ------------------------------------------------------ &green System Board Inlet Temp 21 69 ( 42) &green CPU1 Temp 32 89 ( 93) &green CPU2 Temp 31 87 ( 93) ------------------------------------------------------ Xymon 4.3.28 handled this properly by treating the data in the parenthesis as comments. Attached is my patch to fix xymond/rrd/do_temperature.c to handle temperature reports like the above. Most of this code was already in 4.3.28 but I do not know why it was removed. Japheth, Please consider adding this patch for xymond/rrd/do_temperature.c to the next release. It also includes the stripping off of any leading bold and italic HTML tags from sensor names that I submitted earlier. Thanks...Tom [http://collab.micron.com/corp/brand/SiteAssets/Micron.png]<http://www.micron.com/> Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office: +1 (208) 368-4058 Fax: (208)368-2807 Email: tschmidt at micron.com<mailto:tschmidt at micron.com> Website: micron.com<http://www.micron.com/> Micron Technology, Inc., Confidential and Proprietary. From: Xymon <xymon-bounces at xymon.com> On Behalf Of Andreas Kunberger Sent: Monday, August 5, 2019 4:13 AM To: 'Xymon at xymon.com' <Xymon at xymon.com> Subject: [EXT] [Xymon] xymond_rrd program crashed Since we have updated to Xymon 4.3.29-1.el7.terabithia We get the xymond status: xymond_rrd program crashed Fatal signal caught! In the /var/log/messages we have: Aug 4 06:59:33 suse abrt-hook-ccpp[9966]: Process 8736 (xymond_rrd) of user 1000 killed by SIGABRT - dumping core Aug 4 06:59:34 suse abrt-server[9968]: Package 'xymon' isn't signed with proper key Aug 4 06:59:34 suse abrt-server[9968]: 'post-create' on '/var/spool/abrt/ccpp-2019-08-04-06:59:33-8736' exited with 1 Aug 4 06:59:34 suse abrt-server[9968]: Deleting problem directory '/var/spool/abrt/ccpp-2019-08-04-06:59:33-8736' and in /var/log/xymon/rrd-status 2019-08-04 06:58:43.164318 net-janus/ntpd.rrd: Bug - duplicate RRD data with same timestamp 1564894723, different data 2019-08-04 06:59:33.750946 Host 'rackstation' reports netstat for an unknown OS 2019-08-04 06:59:34.621163 xymond_channel: Child process 8736 died: Signal 6 2019-08-04 06:59:34.739280 xymond_channel: Peer at 0.0.0.0:0 failed: Broken pipe 2019-08-04 06:59:34.986178 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:56.727302 Host 'rackstation3' reports netstat for an unknown OS 2019-08-04 06:59:57.603455 xymond_channel: Child process 9971 died: Signal 6 2019-08-04 06:59:58.136009 xymond_channel: Peer at 0.0.0.0:0 failed: Broken pipe 2019-08-04 06:59:58.136109 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136150 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136192 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136316 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136374 xymond_channel: Peer not up, flushing message queue .... The Server runs on CentOS Linux release 7.6.1810 (Core) Thanks in advance! i.A. Andreas Kunberger -- Andreas Kunberger ZD/IT

2 1

Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update)
by tschmidt＠micron.com 06 Aug '19

06 Aug '19

I did not mean for this to get into a debate. The systems I am monitoring with Xymon do not have underscores in their hostnames but many have the hyphen. When I queried my companies DNS server, a few CNAME records have underscores, but no A records have an underscore. Xymon could monitor a system using a CNAME record, so IMHO it should still allow it for the reporting and history features. Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Axel Beckert Sent: Monday, August 5, 2019 3:48 PM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update) Hi, On Mon, Aug 05, 2019 at 05:21:33PM -0400, Richard L. Hamilton wrote: > Seems to me that underscore is mainly a problem with address 0.0.0.0 > in hosts.cfg (name to IP address resolution via host naming services, > esp. if that ends up being DNS). If an IP address in hosts.cfg is > used, and the hostname there isn't used in some other way, I don't > guess it would matter. Hmmm, indeed https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fen.wikipe… as well as RFC 608, 810 and 952 say that no other characters than letters, digits and hyphens are allowed. I'm though quite sure to already have seen hostnames with underscore and even a slash in the wild. The latter was though about 20 years ago or so where I saw router names of a university with a slash in their hostname. Traces of hostnames with slashes can also be found on the web, e.g. https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fserverfau… And underscore is explicitly mentioned in https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fen.wikipe… So IMHO while not being standard-compliant hostnames, Xymon should accept at least hostnames with underscore, too. On the other hand, I don't think, it's necessary to also add the slash to the list of valid characters for hostnames as the dot is already in there, too, and hostnames which are allowed to contain "/../" are definitely no good. :-) Kind regards, Axel -- PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Farc.pasp.d… Mail: abe at deuxchevaux.org \ / Say No to HTML in E-Mail and Usenet Mail+Jabber: abe at noone.org X https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faxel.beck… / \ I love long mails: https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Femail.is-… _______________________________________________ Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…

2 1