October 2021 - Xymon - Xymon mailman web

Remote Code execution
by zechner＠vrvis.at 14 Oct '21

14 Oct '21

Hi, after reading an old thread about remote code execution on here [1], I wondered if something like this is still possible nowadays with xymon? In 2016 [2] this has been classified as a security risk, whereas in 2007, it was considered a feature/addon. I am wondering if remote code execution is still possible either via this mechanism or in some other way or if the development team has been taking precautions against attacks like that. Thanks in advance. Cheers Christoph [1] https://lists.xymon.com/archive/2007-June/013587.html [2] https://packetstormsecurity.com/files/135758/xymon-execoverflowdisclsoe.txt

3 5

Monitor Windows service if installed
by colin.coe＠gmail.com 12 Oct '21

12 Oct '21

Hey all Is there a way to alert if a particular Windows service is installed but not running? Thanks

5 8

ports check for a VIP...
by didds3＠yahoo.co.uk 11 Oct '21

11 Oct '21

Purely a sort of FYI I guess...? not sure what was occurring but last Friday early hours the clusetrr had a bit of a tizz and both nodes had no mysqld running and so procs was not green on both nodes...? but the combo check remained green throughout.. On Thursday, 7 October 2021, 09:41:02 BST, Ian Diddams via Xymon <xymon at xymon.com> wrote: That's great Jeremy - many thanks Now (wp\-vldyn\-estrela.ports)||(wp\-vldyn\-rafeiro.ports) = (1)||(1) = 1 wp-vldyn-estrela.ports wp-vldyn-rafeiro.ports ian On Wednesday, 6 October 2021, 05:15:11 BST, Jeremy Laidman <jeremy at laidman.org> wrote: On Mon, 4 Oct 2021 at 23:15, Ian Diddams via Xymon <xymon at xymon.com> wrote: intrigiingly the actual output on that combo check shows (wp-vldyn-estrela.ports)||(wp-vldyn-rafeiro.ports) = (0-0-1)||(0-0-1) = 1 ?<snip> i.e. its all showing clear for the individual lines which are also separated where the hostname includes a hyphen...? is that all correct ? I don't think so. From the manpage of combo.cfg: "Note: If the expression involves hostnames with a character that is also an operator - e.g. if you have a host "t1-router-newyork.foo.com" with a dash in the hostname - then the operator-character must be escaped with a backslash '\' in the expression, or it will be interpreted as an operator. E.g. like this: ?nyc.conn = (t1\-router\-nyc.conn || backup\-router\-nyc.conn)" That's why it thinks you have hostnames like "wp" and "vldyn". It's almost certainly not testing what you want it to be testing. CheersJeremy _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

ports check for a VIP...
by jeremy＠laidman.org 07 Oct '21

07 Oct '21

On Mon, 4 Oct 2021 at 23:15, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > > > intrigiingly the actual output on that combo check shows > > > > (wp-vldyn-estrela.ports)||(wp-vldyn-rafeiro.ports) = (0-0-1)||(0-0-1) = 1 > <snip> > > i.e. its all showing clear for the individual lines which are also > separated where the hostname includes a hyphen... is that all correct ? > > I don't think so. From the manpage of combo.cfg: "Note: If the expression involves hostnames with a character that is also an operator - e.g. if you have a host "t1-router-newyork.foo.com" with a dash in the hostname - then the operator-character must be escaped with a backslash '\' in the expression, or it will be interpreted as an operator. E.g. like this: nyc.conn = (t1\-router\-nyc.conn || backup\-router\-nyc.conn)" That's why it thinks you have hostnames like "wp" and "vldyn". It's almost certainly not testing what you want it to be testing. Cheers Jeremy

2 1

ports check for a VIP...
by zechner＠vrvis.at 05 Oct '21

05 Oct '21

On 01/10/2021 17:39, Ian Diddams wrote: > > > >Do you also need the connection status as well? "ports" and "conn" are > >two different colums, I don't think mixing them would be wise? > > No - TBH not really > > > >That's why you need the "||", it's an or, so as long as one of your two > >hosts is green, your overall status is green. > > yes - but then presumably that emans the other host is red. And that > will just spoawn reports form our monitoring team or at the very least > obfuscate the page sending it red for no real reason. It will not spawn any reports or alarm, as long as one of them is green, everything is fine. So in your case, there would be three statuses: 1) overall status of this check: green if one is green 2) system A red or green 3) system B reg or green There are no alarms as long as one of them is green. > > The bottom line is only one server in the cluster has the port in use at > any one time and we dont want a "red" simoly becasue that is actually > the correct situation. > > cheers > > ian

2 4

ports check for a VIP...
by jeremy＠laidman.org 04 Oct '21

04 Oct '21

On Mon, 4 Oct 2021 at 19:25, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > well having set it up, the combo test is green indeed - but the two > servfers that make up the combo test are shwoing > > * one green (as the port check is green as mysqld is runnoing on that > system) > * one red (as the port check is red as mysqld is runnoing on that > system) > > So we do get a red showing that the monitoring team will respond to. I > cant make it "clear" as there are other procs and ports being checked that > do need a red if alerting. > > so unfortunately it doesnt seem to be the solution - but I do appreciate > the attem[pt to help :-) > You can silence the alarms for the individual tests, in alarms.cfg. J

1 1

ports check for a VIP...
by zechner＠vrvis.at 01 Oct '21

01 Oct '21

Hi, On 01/10/2021 14:15, Ian Diddams via Xymon wrote: > we have a HA mysql db cluster that runs with a VIP (drbd, pacemaker, > corosync) > > we want a ports check for 3306 - but if we configure it for the two > systems in the cluster one of them will always be red as its the slave > and not running mysqld (it only runs on the master). > > the clear alternative is to somehow run a 3306 check on the VIP...? but > the VIP itself is only an IP in hosts.cfg (so we can conn check its > existence etc) and so isnt a client sending reports back to the server. > > any hints as to how we can acheive such a test ? You could try a combo status test, I've implemented these for connection tests, but it should work for port checks too, I guess (have not tried it though). (all paths are for Debian, that's what I am using) I defined a target in /etc/xymon/combo.cfg like this: computer.conn = (computer1.conn || computer2.conn) This returns green if one of the machines is green and also shows both statuses in the web interface. I guess, this should also work with ports... Good luck! Christoph

2 2

ports check for a VIP...
by didds3＠yahoo.co.uk 01 Oct '21

01 Oct '21

we have a HA mysql db cluster that runs with a VIP (drbd, pacemaker, corosync) we want a ports check for 3306 - but if we configure it for the two systems in the cluster one of them will always be red as its the slave and not running mysqld (it only runs on the master). the clear alternative is to somehow run a 3306 check on the VIP...? but the VIP itself is only an IP in hosts.cfg (so we can conn check its existence etc) and so isnt a client sending reports back to the server. any hints as to how we can acheive such a test ?

1 0

SMTP checks
by lk＠man-da.de 01 Oct '21

01 Oct '21

On Mittwoch, 29. September 2021 14:31:03 CEST Jeremy Laidman wrote: > read(3, "220 <servername> ESMTP Postfix\r\n221 2.0.0 Bye\r\n", 4095) = 60 > close(3) > > The "ehlo string" was completely ignored, and was not sent to the mail > server. Hi Jeremy, The message above is also what I'm seeing in the Xymon message, and you are right. There is of course no output from the EHLO response. This change avoids the log message on the mailserver, but the xymon server only sends quit, and looks at the initial greeting banner. Which is still better than nothing. But doesn?t he with the other configurations? And probably I could leave the ehlo simply away. The piplining log messages are thrown on the mailserver because the xymon server sends multiple commands on the same time. But if you are sending only ehlo the Mailserver will complain about inpropperly closed sessions. Kind regards Lars -- Lars Kollstedt Telefon: +49 6151 16-71027 E-Mail: lk at man-da.de man-da.de GmbH Dolivostra?e 11 64293 Darmstadt Sitz der Gesellschaft: Darmstadt Registergericht: Amtsgericht Darmstadt Handelsregisternummer: HRB 9484 Gesch?ftsf?hrer: Andreas Ebert

2 1

Xymon-client for Proxmox ve
by christian.becker＠rhein-zeitung.net 01 Oct '21

01 Oct '21

Hello Gabo, in my environment i do this using xymon-rclient as described here: http://tools.rebel-it.com.au/xymon-rclient/ The other solution could lead to a ?normal? xymon client installation, since Proxmox VE is based on Debian, but i didn?t try this with my setup. Hope this helps a bit. Greetings Christian Von: Xymon <xymon-bounces at xymon.com> Im Auftrag von Gabo Su?rez Gesendet: Donnerstag, 30. September 2021 17:37 An: xymon at xymon.com Betreff: [Xymon] Xymon-client for Proxmox ve HI Where do I get the xymon client installer for proxmox ve? -- Saludos, GS

1 0