NEMS NAGIOS Core - not having permissions

[panda2297]

Robbie,


Sorry for all the questions here as I am diving into all the aspects of NEMS here. Rest assured, I will be sending money in the tip jar once I have my system finalized here this week.

Here is something that I am noticing which I can duplicate with a new install. If I go to NEMS NAGIOS core under reporting and let's say I choose something such as "View Config". And I then choose anything such as hosts and I click the continue button, I get this error:

"It appears as though you do not have permission to view the configuration information you requested...
If you believe this is an error, check the HTTP server authentication requirements for accessing this CGI
and check the authorization options in your CGI configuration file."

I looked up this error online and it seems to insinuate a permission issue on cgi.cfg. If I look at /etc/nagios3/cgi.cfg, I see that nemsadmin is listed in there. For example:

# SYSTEM/PROCESS INFORMATION ACCESS
# This option is a comma-delimited list of all usernames that
# have access to viewing the Nagios process information as
# provided by the Extended Information CGI (extinfo.cgi).  By
# default, *no one* has access to this unless you choose to
# not use authorization.  You may use an asterisk (*) to
# authorize any user who has authenticated to the web server.

authorized_for_system_information=nemsadmin



# CONFIGURATION INFORMATION ACCESS
# This option is a comma-delimited list of all usernames that
# can view ALL configuration information (hosts, commands, etc).
# By default, users can only view configuration information
# for the hosts and services they are contacts for. You may use
# an asterisk (*) to authorize any user who has authenticated
# to the web server.

authorized_for_configuration_information=nemsadmin



# SYSTEM/PROCESS COMMAND ACCESS
# This option is a comma-delimited list of all usernames that
# can issue shutdown and restart commands to Nagios via the
# command CGI (cmd.cgi).  Users in this list can also change
# the program mode to active or standby. By default, *no one* 
# has access to this unless you choose to not use authorization.
# You may use an asterisk (*) to authorize any user who has
# authenticated to the web server.

authorized_for_system_commands=nemsadmin


Now if I change anywhere it says nemsadmin to match my userid that I created from nems-init, I no longer get these permission errors. From reading the forums here, I know it's usually not a good idea to mess around with config files or cron jobs in general with NEMS as I heard that something can break and it doesn't survive a reboot. I did perform a reboot and this still works for me.

If I had to take a guess, nems-init doesn't update this file. Now granted I don't know how often this page would be used for viewing configs since we can see our configs in NCONF. But who knows. What are your thoughts?

Edit: Just one thing to note. I saw another post covering how the cfg file gets overwritten actually from the cronjobs (not originally what I thought during a reboot.) I have not modified the cron jobs in any way. But per that other post, I am not using nagiosadmin.

[Robbie Ferguson]

Something appears to have gone awry during the nems-init process. I would suggest you redo nems-init -- but keep in mind you will lose any host configs you've created.

What you're describing means part of the init process failed (for what reason, we don't know - you didn't post the output, nor did you probably realize there was a problem as it might have flashed by very quickly).

Yes, nems-init replaces all instances of nemsadmin with the chosen username automatically. But it also does a lot more - so I think it would be best to re-init (observing the caveat above).

[panda2297]

Redid nems-init and I noticed this:

Welcome to NEMS initialization script.

grep: /etc/cgi.cfg: No such file or directory
Ign:1 http://download.webmin.com/download/repository sarge InRelease
Hit:2 http://download.webmin.com/download/repository sarge Release                                                                                                                              
Hit:3 http://archive.raspbian.org/raspbian stretch InRelease                                                                                                                                    
Hit:4 http://mirrordirector.raspbian.org/raspbian stretch InRelease                                                                                                  
Hit:5 http://ftp.debian.org/debian stretch-backports InRelease                                                                                 
Hit:6 http://archive.raspberrypi.org/debian stretch InRelease                                                            
Ign:8 http://giteduberger.fr rpimonitor/ InRelease                                                 
Hit:9 http://giteduberger.fr rpimonitor/ Release   
Reading package lists... Done
Building dependency tree       
Reading state information... Done
95 packages can be upgraded. Run 'apt list --upgradable' to see them.

What would you like your NEMS Username to be? rmervine
Username accepted.
Password: 
Password (again): 
Adding password for user rmervine
adduser: The user `rmervine' already exists.
Disabling nemsadmin access. Remember you must now login as rmervine
/usr/sbin/deluser: The user `nemsadmin' is not a member of group `sudo'.
Initializing new Nagios user

  Importing: contact
  Importing: contactgroup

Current default time zone: 'America/New_York'
Local time is now:      Mon Mar  5 17:21:10 EST 2018.
Universal Time is now:  Mon Mar  5 22:21:10 UTC 2018.


Let's generate your SSL Certificates...
Done.

Now we will resize your root partition to give you access to all the space
Done.

NOTICE: When you reboot, you must login as rmervine

Press any key to reboot (required)

I wonder why it's referencing /etc/cgi.cfg and not /etc/nagios3/cgi.cfg? I know what the next step will be is to perform a fresh installation. I can tell you that I have done that before. In fact, I did nothing special. I'm going to try and do a webcast and show you what I am seeing on a new installation. I'm thinking this may be an issue with nems-init in the latest version.

[panda2297]

Here is the link to the screencast I done:

https://www.youtube.com/watch?v=1K4-GW- ... e=youtu.be

No personal data is in it. Just wanted to show you that this issue is something that I can duplicate with a new installation and nothing fancy.  I misspoke about sudo apt-get update. I didn't mean I *couldn't* do it. I meant that I don't think it's relevant to the troubleshooting since nems-init is part of NEMS installation and the updates would be related. I'm curious what your thoughts are on this. I can get you any log files you need.

[Robbie Ferguson]

That was incredibly helpful, thank you.

Please type: sudo nems-quickfix

This will apply the patch I just wrote based on your screencast.

Please then run sudo nems-init again and report if that fixed it for you.

Also, well spotted earlier regarding a grep to /etc/cgi.cfg (a non-existent file). This issue was entirely unrelated to your system, and did not affect you, but it was a bug none the less, and has been fixed thanks to you pointing it out.

Thanks again!

[panda2297]

I applied the quick fix per your instructions and all works now. Thanks for looking into this quickly! I think I got all the NEMS components nailed down and can work on the Nagios components that I am more experienced with. Thanks again!

[Robbie Ferguson]

Awesome! Thanks for your helping me understand the issue so I could fix it for you and everyone else!!

ENJOY!