ID: 13556
Title: oracle_rman: multiple backups lead to oldest backup shown
Component: Checks & agents
Level: 1
Class: Bug fix
Version: 2.1.0i1
The check oracle_rman monitors incremental backups on Oracle databases. In the
event that there are multiple backups for the same increment, the oldest backup
was shown. This has been fixed, so that the latest backup is now visible.
ID: 13486
Title: <tt>juniper_fru</tt>: Fix documentation for op. status "present"
Component: Checks & agents
Level: 1
Class: Bug fix
Version: 2.1.0i1
The documentation of the check plugin <tt>juniper_fru</tt>, which
monitors the power supplies of Juniper Ethernet Switch Chassis,
incorrectly stated that an operational status of "present" results
in the monitoring status OK. However, "present" results in WARN,
which is correct and has been fixed in the documentation.
ID: 13322
Title: Limit executable php scripts to NagVis files
Component: Site Management
Level: 1
Class: Security fix
Version: 2.1.0i1
Previously the web server was able to execute <tt>.php</tt> files from all
locations that are callable by the user. With this change, we now limit the
execution of php files to the paths we need in the default installation for
NagVis.
Please note: In case you intentionally installed php files in your site to
access them through the site web server, you may now need to extend your sites
web server configuration to make it work again as before.
For example, if you installed one file to <tt>var/www/my_script.php</tt>, you
can make it usable again with the following configuration
<tt>etc/apache/conf.d/my_script.conf</tt>:
C+:
<Location "/[site_id]/my_script.php">
Options +ExecCGI
</Location>
C-:
ID: 13335
Title: Small adjustments to the Evenc Console menu
Component: Multisite
Level: 1
Class: Bug fix
Version: 2.1.0i1
The menu entry "Add one or multiple MIBs" is now a suggested action
and the entry "Settings" is only suggested in the EC main page.
ID: 13321
Title: NagVis: Updated to 1.9.29 (Fix possible deletion of arbitrary files)
Component: Other Components
Level: 1
Class: Security fix
Version: 2.1.0i1
Fix possible deletion of arbitrary files (CVE-2021-33178).
An authenticated user with enough permissions to access the NagVis.
ManageBackgrounds endpoint, such as admin, can delete arbitrary files on the
server limited by the rights of the Apache system user. In Checkmk, this is
limited to files owned by the site user.
CVSS 3.1 base score: 4.5 (medium)
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/…https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33178
ID: 13130
Title: mk_oracle: Fix bakery crash on deactivated agent rule
Component: agents
Level: 1
Class: Bug fix
Version: 2.1.0i1
When configuring one or more "ORACLE databases" agent rules and deactivating
it with by setting "Activation" to "Do not deploy ORACLE databases plugin",
the agent bakery failed to bake agents.
This is fixed now by moving the activation/deactivation to an entry of the
ruleset. As a result, for every active agent configuration, at least one rule
with specified "Activation" entry must exist to successfully bake agents.
ID: 11823
Title: mk_oracle.ps1 use Oracle config in $MK_CONFDIR
Component: Checks & agents
Level: 1
Class: Bug fix
Version: 2.1.0i1
The Windows Oracle Agent didn't use the paths documented (https://docs.checkmk.com/latest/en/monitoring_oracle.html#_windows_4) like the Oracle Linux Agent.
With the change it uses MK_CONFDIR, if Oracle config files exist.
ID: 13130
Title: mk_oracle: Fix bakery crash on deactivated agent rule
Component: agents
Level: 1
Class: Bug fix
Version: 2.1.0i1
When configuring one or more "ORACLE databases" agent rules and deactivating
it with by setting "Activation" to "Do not deploy ORACLE databases plugin",
the agent bakery failed to bake agents.
This is fixed now by moving the activation/deactivation to an entry of the
ruleset. As a result, for every active agent configuration, at least one rule
with specified "Activation" entry must exist to successfully bake agents.
ID: 13475
Title: No longer adapt service names to the agent package name
Component: Other Components
Level: 1
Class: New feature
Version: 2.1.0i1
The configuration setting "Name of agent packages (Linux, UNIX)" no longer affects the service units names <b>included</b> in the package.
This werk only affects users who have configured a non-standard package name for the Checkmk agent packages created by the agent bakery.
The option was originally implemented to allow for different DEB or RPM packages to be distributed by a local package repository without conflicting.
However, this parameter also changed the names of the created systemd, xinetd or inetd units.
This will no longer be the case.
While the previous behaviour <b>in theory</b> allowed you to deploy multiple agent versions on the same host, that was never supported and is highly discouraged.
Trying to do so lead to inconsistent or downright wrong monitoring data in the past.
With the introduction of the new component <tt>cmk-agent-ctl</tt> support for multiple agent versions would become even more error prone and expensive (both in development and in maintenance).
By fixing the services name we no longer suggest that this would be feasable.