ID: 12173
Title: Fixed service authorization handling
Component: cmc
Level: 2
Class: Bug fix
Version: 2.1.0i1
For some tables ("comments" / "log") and some aggregated columns (like
"num_services" or "worst_service_state") in the tables "hosts" /
"hostgroups" / "servicegroups", the service authorization was always
"loose", regardless of the global setting. As a consequence, some users
could see too many comments and log entries, and some aggregated values
didn't match what they were seeing elsewhere. This has been fixed.
ID: 12653
Title: agent_innovaphone: added support for TLS
Component: Checks & agents
Level: 1
Class: New feature
Version: 2.1.0i1
The agent_innovaphone is now ready to handle TLS connections.
The parameters "Protocol" and "SSL certificate verification" were added to agent_innovaphone.
The default parameter for "Prococol" is "HTTPS" and "SSL certificate verification" is enabled by default.
This werk is marked as incompatible, because the new default settings will forced to be secure even if
the old configuration was insecure.
If you want to keep the old default configuration you can change the protocol to "HTTP" and select
"Ignore certificate errors" for the option "SSL certificate verification".
ID: 12672
Title: real-time-checks: Provide default password
Component: Checks & agents
Level: 1
Class: Security fix
Version: 2.1.0i1
This Werk fixes a security issue that may arise from a misconfiguration
of real-time checks.
As mentioned in Werk <a href=https://checkmk.com/werk/8350>#8350</a>
(Introduction of real-time checks), a password has to be provided when
configuring real-time checks.<br>
When using the agent bakery, the ruleset "Encryption" is used to
provide the encryption password, while the real-time checks itself are
activated for the agents via the ruleset "Send data for real-time checks".
If the real-time checks get activated without providing a password, this
will result in an empty password, that will nevertheless be used by the agent
to encrypt the real-time check data on the host.<br>
While the user would most likely fix this situation, because real-time checks
won't work (A password is mandatory to activate real-time checks in CMC),
the real-time check data can be decrypted without a password/key in this case,
resulting in a security issue.
This is now fixed with the following mechanism:
<ul>
<li>The agent bakery will read the default password from the global setting
"Monitoring core/Enable handling of real-time checks" and bake it into the
agents that have the rule "Send data for real-time checks" activated. Accordingly,
a changed global setting will lead to new agents on next bake.</li>
<li>The agent bakery will keep to package the password from the "Encryption" rule,
and the Linux agent will prefer it over the default password from the CMC configuration.</li>
<li>If none of the two passwords are configured, but the "Send data for real-time checks"
rule is active, the agent bakery will refuse to bake agents.</li>
<li>If the Linux agent is requested to send encrypted real-time check data, but no password
is deployed, the sending be inhibited. However, up from now, this may only happen
if real-time checks are configured without the agent bakery.</li>
</ul>
ID: 12826
Title: Fix reflected XSS using the on page search
Component: Multisite
Level: 1
Class: Security fix
Version: 2.1.0i1
The on page search could be used to trigger a reflected XSS attack. It was
possible to execute arbitrary javascript code in the context of the user
clicking on the reset button of the on page search.
ID: 12467
Title: BI configuration: The macro $1$ incorrectly referred to the hostname instead of the first regex match group
Component: BI
Level: 1
Class: Bug fix
Version: 2.1.0i1
ID: 12200
Title: winperf_processor_util: Perfometer for CPU utilization added
Component: Checks & agents
Level: 1
Class: Bug fix
Version: 2.1.0i1
In version 2.0, CPU utilization metric was renamed,
but perfometer for a new metric wasn't added.
ID: 12672
Title: real-time-checks: Provide default password
Component: Checks & agents
Level: 1
Class: Security fix
Version: 2.1.0i1
This Werk fixes a security issue that may arise from a misconfiguration
of real-time checks.
As mentioned in Werk <a href=https://checkmk.com/werk/8350>#8350</a>
(Introduction of real-time checks), a password has to be provided when
configuring real-time checks.<br>
When using the agent bakery, the ruleset "Encryption" is used to
provide the encryption password, while the real-time checks itself are
activated for the agents via the ruleset "Send data for real-time checks".
If the real-time checks get activated without providing a password, this
will result in an empty password, that will nevertheless be used by the agent
to encrypt the real-time check data on the host.<br>
While the user would most likely fix this situation, because real-time checks
won't work (A password is mandatory to activate real-time checks in CMC),
the real-time check data can be decrypted without a password/key in this case,
resulting in a security issue.
This is now fixed with the following mechanism:
<ul>
<li>The agent bakery will read the default password from the global setting
"Monitoring core/Enable handling of real-time checks" and bake it into the
agents that have the rule "Send data for real-time checks" activated. Accordingly,
a changed global setting will lead to new agents on next bake.</li>
<li>The agent bakery will keep to package the password from the "Encryption" rule,
and the Linux agent will prefer it over the default password from the CMC configuration.</li>
<li>If none of the two passwords are configured, but the "Send data for real-time checks"
rule is active, the agent bakery will refuse to bake agents.</li>
<li>If the Linux agent is requested to send encrypted real-time check data, but no password
is deployed, the sending be inhibited. However, up from now, this may only happen
if real-time checks are configured without the agent bakery.</li>
</ul>
ID: 12751
Title: mkevents: Fix link to events of host
Component: Multisite
Level: 1
Class: Bug fix
Version: 2.1.0i1
If you used the rule "Check event state in Event Console" in previous 2.0
versions, the link to events of the host in the related service was not built
correctly.