Checkmk werks level2 December 2023

checkmk-werks-lvl2@lists.checkmk.com

1 participants
5 discussions

[1.2.7] Checkmk Werk 1665 adapted: agent_netapp: New special agent for NetApp monitoring via Web-API

by Checkmk werks level 2

Werk 1665 was adapted. The following is the new Werk, a diff is shown at the end of the message. Title: agent_netapp: New special agent for NetApp monitoring via Web-API Level: 3 Component: checks Class: feature Compatible: compat State: unknown Version: 1.2.7i1 Date: 1418736173 The new agent_netapp allows you to collect data from a NetApp Filer through its Web-API. Right now only 7-Mode setups are supported, but Cluster-Mode is following soon. H2: Agent setup This agent does not run out of the box, because it depends on some files from the Netapp Manageability SDK from NetApp. You can download it <a href="http://mysupport.netapp.com/NOW/cgi-bin/software/?product=NetApp+Manageabil…">here (customer/partner login required)</a> In this package you will find a python API binding. The agent_netapp requires the two python files (<tt>NaElement.py</tt> / <tt>NaServer.py</tt>) to be put into the sites local directory <tt>~/local/lib/python</tt>. (Our plan is to eleminate this tedious step in a future version) Once the agent has all required files you need to create a user account with the following permissions: <ul> <li>perf-object-get-instances</li> <li>net-ifconfig-get</li> <li>aggr-list-info</li> <li>storage-shelf-bay-list-info</li> <li>disk-list-info</li> <li>vfiler-list-info</li> <li>vfiler-get-status</li> <li>volume-list-info</li> <li>system-get-version</li> <li>system-get-info</li> <li>storage-shelf-environment-list-info</li> <li>cf-status</li> <li>diagnosis-status-get</li> </ul> Note: This list might increase in later versions If the new agent is able to access the Web-API the following new checks are ready to process the data: <table> <tr><th>Check</th><th>Description</th></tr> <tr><td>netapp_api_aggr</td><td>Used space and trend of aggregations</td></tr> <tr><td>netapp_api_volumes</td><td>Used space and trend of volumes. Able to record detailed performance data for each protocol</td></tr> <tr><td>netapp_api_cluster</td><td>Cluster status</td></tr> <tr><td>netapp_api_cpu</td><td>Overall CPU utilization</td></tr> <tr><td>netapp_api_disk</td><td>Disk summary check. Includes total raw capacity and info about broken and spare disks</td></tr> <tr><td>netapp_api_if</td><td>Interface checks (Fibrechannel not include so far)</td></tr> <tr><td>netapp_api_protocol</td><td>Read OPS / Write OPS for each protocol (nfs, nfsv4, cifs, fcp, iscsci)</td></tr> <tr><td>netapp_api_status</td><td>Filers Diagnosis Status (overall status)</td></tr> <tr><td>netapp_api_version</td><td>Version information</td></tr> <tr><td>netapp_api_vf_stats.traffic</td><td>vFiler traffic (Read/Write OPS, Net-Data Send/Recv, Read/Write Bytes)</td></tr> <tr><td>netapp_api_vf_stats.cpu_util</td><td>vFiler CPU utilization</td></tr> <tr><td>netapp_api_vf_status</td><td>vFiler status</td></tr> <tr><td>netapp_api_psu</td><td>Power supplies summary which are relevant to that filer. Reports broken units</td></tr> <tr><td>netapp_api_fan</td><td>Fans summary which are relevant to that filer. Reports broken units</td></tr> <tr><td>netapp_api_temp</td><td>Temperature sensor summary for internal and ambient sensors relevant to that filer. Reports broken units</td></tr> </table> Note: This is the initial version of this agent. It has been tested on a handful of NetApp systems. ------------------------------------<diff>------------------------------------------- Title: agent_netapp: New special agent for NetApp monitoring via Web-API Level: 3 Component: checks Class: feature Compatible: compat State: unknown Version: 1.2.7i1 Date: 1418736173 The new agent_netapp allows you to collect data from a NetApp Filer through its Web-API. Right now only 7-Mode setups are supported, but Cluster-Mode is following soon. H2: Agent setup This agent does not run out of the box, because it depends on some files from the Netapp Manageability SDK from NetApp. You can download it <a href="http://mysupport.netapp.com/NOW/cgi-bin/software/?product=NetApp+Manageabil…">here (customer/partner login required)</a> In this package you will find a python API binding. The agent_netapp requires the two python files (<tt>NaElement.py</tt> / <tt>NaServer.py</tt>) to be put into the sites local directory <tt>~/local/lib/python</tt>. (Our plan is to eleminate this tedious step in a future version) Once the agent has all required files you need to create a user account with the following permissions: <ul> <li>perf-object-get-instances</li> <li>net-ifconfig-get</li> <li>aggr-list-info</li> <li>storage-shelf-bay-list-info</li> <li>disk-list-info</li> <li>vfiler-list-info</li> <li>vfiler-get-status</li> <li>volume-list-info</li> <li>system-get-version</li> <li>system-get-info</li> <li>storage-shelf-environment-list-info</li> <li>cf-status</li> <li>diagnosis-status-get</li> </ul> Note: This list might increase in later versions If the new agent is able to access the Web-API the following new checks are ready to process the data: <table> <tr><th>Check</th><th>Description</th></tr> <tr><td>netapp_api_aggr</td><td>Used space and trend of aggregations</td></tr> <tr><td>netapp_api_volumes</td><td>Used space and trend of volumes. Able to record detailed performance data for each protocol</td></tr> <tr><td>netapp_api_cluster</td><td>Cluster status</td></tr> <tr><td>netapp_api_cpu</td><td>Overall CPU utilization</td></tr> <tr><td>netapp_api_disk</td><td>Disk summary check. Includes total raw capacity and info about broken and spare disks</td></tr> <tr><td>netapp_api_if</td><td>Interface checks (Fibrechannel not include so far)</td></tr> <tr><td>netapp_api_protocol</td><td>Read OPS / Write OPS for each protocol (nfs, nfsv4, cifs, fcp, iscsci)</td></tr> <tr><td>netapp_api_status</td><td>Filers Diagnosis Status (overall status)</td></tr> <tr><td>netapp_api_version</td><td>Version information</td></tr> <tr><td>netapp_api_vf_stats.traffic</td><td>vFiler traffic (Read/Write OPS, Net-Data Send/Recv, Read/Write Bytes)</td></tr> <tr><td>netapp_api_vf_stats.cpu_util</td><td>vFiler CPU utilization</td></tr> <tr><td>netapp_api_vf_status</td><td>vFiler status</td></tr> <tr><td>netapp_api_psu</td><td>Power supplies summary which are relevant to that filer. Reports broken units</td></tr> - <tr><td>netapp_api_fan</td><td>Fans summary which are relevant to that filer. Reports broken units</td><tr> + <tr><td>netapp_api_fan</td><td>Fans summary which are relevant to that filer. Reports broken units</td></tr> ? + <tr><td>netapp_api_temp</td><td>Temperature sensor summary for internal and ambient sensors relevant to that filer. Reports broken units</td></tr> </table> Note: This is the initial version of this agent. It has been tested on a handful of NetApp systems.

8 months, 4 weeks

[1.2.3] Checkmk Werk 50 adapted: New concept of favorite hosts and services plus matching filters and views

by Checkmk werks level 2

Werk 50 was adapted. The following is the new Werk, a diff is shown at the end of the message. Title: New concept of favorite hosts and services plus matching filters and views Level: 2 Component: multisite Version: 1.2.3i7 Date: 1383411707 Class: feature The new "Favorites" feature introduces a new pair of commands for hosts and services: Add to favourites and Remove from favourites. It allows you to manage your personal list of favourite hosts and services. This list is saved on a per-user-base. Objects on this list are marked with a star icon. The favourites-list can be used for filtering. Two new predefined views "Favourite hosts" and "Favourite services" are available for showing you favourite objects. Also the new filters have been added to several views. Please note, that when you make a host a favourite, the services of that host will not automatically get favourites as well. But you easily can use the "Service Search" view for listing all services on favorite hosts, if you like that behaviour. With a combination of the existing filters you can do many useful queries like "Show me all problems on my favourite hosts in host group X". The advantage of favourites as opposed to host- and service groups are: <ul> <li>No change to the monitoring configuration is neccessary and thus no restart of the core.</li> <li>Each user can manage his indiviual list.</li> </ul> ------------------------------------<diff>------------------------------------------- Title: New concept of favorite hosts and services plus matching filters and views Level: 2 Component: multisite Version: 1.2.3i7 Date: 1383411707 Class: feature The new "Favorites" feature introduces a new pair of commands for hosts and services: Add to favourites and Remove from favourites. It allows you to manage your personal list of favourite hosts and services. This list is saved on a per-user-base. Objects on this list are marked with a star icon. The favourites-list can be used for filtering. Two new predefined views "Favourite hosts" and "Favourite services" are available for showing you favourite objects. Also the new filters have been added to several views. Please note, that when you make a host a favourite, the services of that host will not automatically get favourites as well. But you easily can use the "Service Search" view for listing all services on favorite hosts, if you like that behaviour. With a combination of the existing filters you can do many useful queries like "Show me all problems on my favourite hosts in host group X". The advantage of favourites as opposed to host- and service groups are: <ul> <li>No change to the monitoring configuration is neccessary and thus no restart of the core.</li> - <li>Each user can manage his indiviual list.</li>. ? - + <li>Each user can manage his indiviual list.</li> </ul>

8 months, 4 weeks

[2.2.0] Checkmk Werk 16226 created: Privilege escalation in Agent

by Checkmk werks level 2

Title: Privilege escalation in Agent Class: security Compatible: compat Component: checks Date: 1701938773 Edition: cre Level: 2 Version: 2.2.0p17 In order to monitor livestatus from running sites on a host the Checkmk agent uses unixcat that is part of Checkmk. Since the binary is linked to libraries that are also part of Checkmk and may differ from the libraries of the operating system calling unixcat outside of the scope of a site could result to errors due to version mismatches in these libraries. To use the correct libraries in Checkmk 2.2.0p10 a fix was introduced to add the libraries from the site to the call in the agent. Since the lib folder within a site is writable by the site a rogue site could inject malicious libraries into the unixcat call from the agent that is executed as root leading to a privilege escalation. We thank Jan-Philipp Litza for reporting this issue. Affected Versions: * since 2.2.0p10 Vulnerability Management: We have rated the issue with a CVSS Score of 8.8 (High) with the following CVSS vector: <tt>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</tt>. We assigned CVE-2023-31210 to this vulnerability. Changes: This Werk changes the library path from the site to the version files, which are only root-writable.

8 months, 4 weeks

[2.3.0] Checkmk Werk 16226 created: Privilege escalation in Agent

by Checkmk werks level 2

Title: Privilege escalation in Agent Class: security Compatible: compat Component: checks Date: 1701938773 Edition: cre Level: 2 Version: 2.3.0b1 In order to monitor livestatus from running sites on a host the Checkmk agent uses unixcat that is part of Checkmk. Since the binary is linked to libraries that are also part of Checkmk and may differ from the libraries of the operating system calling unixcat outside of the scope of a site could result to errors due to version mismatches in these libraries. To use the correct libraries in Checkmk 2.2.0p10 a fix was introduced to add the libraries from the site to the call in the agent. Since the lib folder within a site is writable by the site a rogue site could inject malicious libraries into the unixcat call from the agent that is executed as root leading to a privilege escalation. We thank Jan-Philipp Litza for reporting this issue. Affected Versions: LI: since 2.2.0p10 Vulnerability Management: We have rated the issue with a CVSS Score of 8.8 (High) with the following CVSS vector: <tt>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</tt>. We assigned CVE-2023-31210 to this vulnerability. Changes: This Werk changes the library path from the site to the version files, which are only root-writable.

8 months, 4 weeks

[2.2.0] Checkmk Werk 15714 created: Add support for Checkmk Appliance 1.7+

by Checkmk werks level 2

Title: Add support for Checkmk Appliance 1.7+ Class: feature Compatible: compat Component: distros Date: 1701285077 Edition: cre Level: 2 Version: 2.2.0p17

9 months, 1 week

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level2 December 2023