- Xymon - Xymon mailman web

Xymon 4.3.3 released, including security-related bugfixes
by henrik＠hswn.dk 06 May '11

06 May '11

Hi, Xymon version 4.3.3 is now available for download from Sourceforge. This release contains some important security-related bugfixes - essentially, some of the Xymon CGI scripts can be abused to read any file on the webserver. So upgrading is highly recommended. Some of these issues are probably present in all of the older 4.0.x and 4.2.x versions, so if you haven't upgraded to 4.3.x yet, this might be a good opportunity to do so. I would like to thank Jeremy Laidman for reporting this issue. A couple of other bugfixes were also included in this version. Here's the full list: * SECURITY FIX: Some CGI parameters were used to construct filenames of historical logfiles without being sanitized, so they could be abused to read files on the webserver. * SECURITY FIX: More cross-site scripting vulnerabilities. * Remove extra "," before "History" button on status-view * Critical view: Shring priority-column to 10% width * hosts.cfg loader: Check for valid IP spec (nibbles in 0-255 range). Large numbers in a nibble were accepted, triggering problems when trying to ping the host. * Alert macros no longer limited to 8kB Regards, Henrik

1 0

Directory traversal vulnerability in svcstatus.c (historylog)
by jlaidman＠rebel-it.com.au 06 May '11

06 May '11

Peoples I've discovered a directory traversal vulnerability in the svcstatus.c file, allowing a remote attacker to view any file on the filesystem that's visible to the web server user. When viewing a specific historical entry, and then setting the parameter for TIMEBUF to "../../../..(etc)/path/to/file" you get to view the file. For example: http://somesite.com/xymon-cgi/historylog.sh?HOST=somehost&SERVICE=conn&TIME… Here's a patch to prevent it: ---- web/svcstatus.c.orig 2011-05-06 12:12:45.000000000 +1000 +++ web/svcstatus.c 2011-05-06 13:20:47.000000000 +1000 @@ -83,6 +83,12 @@ else if (strcasecmp(cwalk->name, "TIMEBUF") == 0) { /* Only for the historical logs */ tstamp = strdup(cwalk->value); + char *p = basename(tstamp); + /* Sanity check timestamp to avoid dir traversal attacks */ + if (strcmp(p,tstamp) != 0) { + errormsg("Invalid time specification\n"); + return 1; + }; } else if (strcasecmp(cwalk->name, "CLIENT") == 0) { char *p; I'm not a C coder, so there's an excellent chance someone else can come up with a better patch. It would be nice to log an error into the web server log, but it doesn't work for me, and I'm guessing the xymon CGI process closes stderr when it starts up or something like that. Cheers Jeremy

2 1

nongreen.html
by vadud3＠gmail.com 05 May '11

05 May '11

The nongreen.html file shows the host type and description from info column gets appended into the hostname. It was not like that with bb2.html This is an upgrade from hobbit 4.2.0 to xymon 4.3.2 So among other stuff I have the Host type and Description shows in info column as always https://xymon.example.net/hobbit-cgi/svcstatus.sh?HOST=storage.example.net&… Host type: Array Description: Loc 38B, S/N 12345678 However this info now gets appended into the host name in nongreen.html page like below and makes the page real wide with even longer description https://xymon.example.net/hobbit/nongreen.html storage.example.net (Array:Loc 38B, S/N 12345678) list of services column I must have managed to break a template? I removed the server/web/* and just uploaded /usr/src/xymon-4.3.2/xymond/webfiles/* using tar. Thanks -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 2

DNS timeout not working
by ragonlan＠gmail.com 05 May '11

05 May '11

Hi, Since I installed version 4.3 (previous version may have same issue) DNS timeout stopped working. In Task.cfg I put this line: CMD xymonnet --report --ping --checkresponse --timeout=10 --dns-timeout=15 But dns-timeout didn't solve the issue. When I put a host that doesn't response to DNS, time-out is too large: Wed May 4 16:03:59 2011 dns NOT ok Service dns on HS-755 is not OK : Service unavailable Timeout Seconds: 178.169 If I remove dns-timeout parameter DNS check time is even greater: Service dns on HS-755 is not OK : Service unavailable Timeout Seconds: 356.336 With DNS test enabled: << TIME SPENT Event Start time Duration xymonnet startup 1357697.287237 - Service definitions loaded 1357697.287887 0.000650 Tests loaded 1357697.293270 0.005382 DNS lookups completed 1357699.442598 2.149328 Test engine setup completed 1357699.445198 0.002600 TCP tests completed 1357711.442436 11.997237 PING test completed (108 hosts) 1357719.107813 7.665377 PING test results sent 1357719.108279 0.000465 Test result collection completed 1357719.108485 0.000205 LDAP test engine setup completed 1357719.108485 0.000000 LDAP tests executed 1357719.108486 0.000000 LDAP tests result collection completed 1357719.108486 0.000000 DNS tests executed 1357897.279645 178.171159 Test results transmitted 1357897.281396 0.001751 xymonnet completed 1357897.282446 0.001049 TIME TOTAL 199.995208 >> Without DNS test: << TIME SPENT Event Start time Duration xymonnet startup 64910.045082 - Service definitions loaded 64910.045765 0.000682 Tests loaded 64910.051131 0.005365 DNS lookups completed 64910.055655 0.004524 Test engine setup completed 64910.058453 0.002797 TCP tests completed 64911.034675 0.976221 PING test completed (105 hosts) 64912.167164 1.132489 PING test results sent 64912.168239 0.001074 Test result collection completed 64912.168467 0.000227 LDAP test engine setup completed 64912.168467 0.000000 LDAP tests executed 64912.168468 0.000000 LDAP tests result collection completed 64912.168468 0.000000 DNS tests executed 64912.177910 0.009441 Test results transmitted 64912.179840 0.001930 xymonnet completed 64912.181299 0.001459 TIME TOTAL 2.136217 >> Does anyone know how to fix it? If I put many DNS test failures the whole xymon get purple because xymonnet don't do DNS test in parallel but in serial (one after other). thank for you time,

3 2

SMTP on multiple ports
by betsy.schwartz＠gmail.com 04 May '11

04 May '11

Can xymon smtp test on multiple ports out of the box? And if so is there a way to see which port is being requested? We've got a separate test defined in protocols.cfg and that works, but if the syntax were the same as for other network test, this should work also: 10.0.1.1 mailer.example.com # smtp smtp:8025 However I see only one test result with no port identified. Maybe protocols.cfg is just the way to do it, but the docs imply that network tests can take a port as a parameter)

3 2

FW: SMTP on multiple ports
by tm＠freedom.com 03 May '11

03 May '11

Hi, Without looking at the docs I think what you are seeing is a host entry getting parsed and picking up the first 'smtp' statement it sees. So, out of the box for an individual host entry with multiple smtp statements, probably no. Then again, it is an open source project, so 'out of the box' has a different meaning:) If you want to add your own tests it's fairly simple, but I don't think you can extend the single smtp gem with multiple ports on the same host. You can have tests with different host:port pairs or add a column with your own tests. Depends on if you want the screen to draw more gems horizontally, or increase the host count (vertically). Regards, Tim ________________________________________ From: xymon-bounces at xymon.com [xymon-bounces at xymon.com] On Behalf Of Elizabeth Schwartz [betsy.schwartz at gmail.com] Sent: Tuesday, May 03, 2011 12:05 PM To: xymon at xymon.com Subject: [Xymon] SMTP on multiple ports Can xymon smtp test on multiple ports out of the box? And if so is there a way to see which port is being requested? We've got a separate test defined in protocols.cfg and that works, but if the syntax were the same as for other network test, this should work also: 10.0.1.1 mailer.example.com # smtp smtp:8025 However I see only one test result with no port identified. Maybe protocols.cfg is just the way to do it, but the docs imply that network tests can take a port as a parameter) _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

Can XYMON having feature to check "User Experience".
by jayantak007＠gmail.com 03 May '11

03 May '11

Hi All, Can XYMON having feature to check "User Experience". We are having different web based application, running in LINUX/Solaris server. Some time We observed all applications are showing running state but if we click any icon(inside our own application) the response time is too long/some-time not get the result also. Kindly let me know any feature is available in XYMON to track it out. With Thanks & Regards, Jayanta.

3 2

Help with new graph and rrd file
by tlewick＠tradebotsystems.com 03 May '11

03 May '11

I have a problem where I've set up a new graph definition, but the rrd file is not being generated. I'm running xymon 4.3.0.0-beta2, so it still uses the old hobbit file names in most places. I am comparing ntp vs ptp on a few servers. We've had the ntp setup for some time, and have been graphing that in the usual way in xymon. I setup the ptp graphs in the same way. Also, verified via bbcmd hobbit_channel -channel=status hobbit_capture -tests=ptp that the data is coming through. The only difference in setup is the ntp information is obtained from a script running on the xymon display server that queries each client while the ptp data is sent to the xymon server from a script running on each client. So push vs pull... Below are the relevant config file entries, again, ntp graphs work great, when I click on the ptp graph I get "opening ptp.rrd": No such file or directory hobbitserver.cfg TEST2RRD="cpu=la,disk... ntp=ncv,ptp=ncv" GRAPHS="la,disk.... ntp,ptp" NCV_ntp="Offset:GAUGE,*:NONE" NCV_ptp="Offset:GAUGE,*:NONE" Hobbitgraph.cfg [ntp] TITLE NTP accuracy YAXIS Offset (ms) DEF:offset=ntp.rrd:Offset:AVERAGE LINE2:offset#FF0000:Offset (ms) COMMENT:\n GPRINT:offset:LAST: \: %6.3lf ms (cur)\n GPRINT:offset:MAX: \: %6.3lf ms (max)\n GPRINT:offset:MIN: \: %6.3lf ms (min)\n GPRINT:offset:AVERAGE: \: %6.3lf ms (avg)\n [ptp] TITLE PTP accuracy YAXIS Offset (us) DEF:offset=ptp.rrd:offset_Mean:AVERAGE LINE2:offset#FF0000:Offset (us) COMMENT:\n GPRINT:offset:LAST: \: %6.3lf us (cur)\n GPRINT:offset:MAX: \: %6.3lf us (max)\n GPRINT:offset:MIN: \: %6.3lf us (min)\n GPRINT:offset:AVERAGE: \: %6.3lf us (avg)\n Any help in determining why xymon is not creating a ptp.rrd file would be appreciated.

1 0

RRD error since upgrade
by David.Raymond＠ca.ebarrette.com 03 May '11

03 May '11

Hi all, I have upgrade our server and start new one on Ubuntu 11.04 x86. We have this error now : 2011-05-02 14:16:18 RRD error updating /usr/lib/xymon/data/rrd/fen-webhmi/netstat.rrd from 10.30.63.105: This RRD was created on another architecture Anyone get this ? thx David Raymond

2 1

Xymon By Example page.
by soopal＠ice.go.cr 03 May '11

03 May '11

Hi all: I really like Xymon so ... I want to help by doing something like Xymon By Example page (as samba.org does) ... covering from basic to too many-times asked setups... this as complement to the demo site. I order to make this are there coding/presentation style guides/standards for xymon project? I'm talking about graphics format/size; fonts types, file size, compress on zip or tar, etc. Will wikibooks or sf.net wiki the publication site (if its accepted of course) my help? Any input or advie wellcome! Este mensaje de correo electrónico, incluidos los archivos adjuntos, es para el uso exclusivo de la persona a la que se ha enviado, y puede contener información que sea confidencial o protegida legalmente. Si usted no es el destinatario, o ha recibido este mensaje por error, no está autorizado a copiar, distribuir, o utilizar de alguna manera este mensaje. Por favor notifique inmediatamente al remitente por correo electrónico y suprimir permanentemente este mensaje y los archivos adjuntos. No se otorga ninguna garantía de que este e-mail esté libre de errores o virus. INSTITUTO COSTARRICENSE DE ELECTRICIDAD

3 2