<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#ffffff"> -------- Original Message -------- Subject: Re: [Nagios-devel] Nagios - Attribute based authorization From: Vágó Tibor <a class="moz-txt-link-rfc2396E" href="mailto:oreggin@niif.hu"><oreggin@niif.hu></a> To: Nagios Developers List <a class="moz-txt-link-rfc2396E" href="mailto:nagios-devel@lists.sourceforge.net"><nagios-devel@lists.sourceforge.net></a> Date: 2010-10-18 11:05 <blockquote cite="mid:4CBC0DE0.2050706@niif.hu" type="cite">Dear List, the development of this feature has been finished and it had been tested in 99% of possible cases. The patch is attached to this e-mail. As you can see we work with nagios version 3.2.1. </blockquote> I've now taken your patch against current Icinga GIT Head, but I am a bit confused how to test this. As far as I can see this is a patch against Apache using Basic Auth an Shibboleth (having that over here). But what's the thing with getting "entitlement" as env var and how to define the authorization lines in the authorization.cfg then? Can you explain that too me a bit, so that I can create tests out of that and also some documentation on how to use it. Thanks in advance, Michael <blockquote cite="mid:4CBC0DE0.2050706@niif.hu" type="cite"> Kind Regards, Tibor Vago 2010-05-21 17:06, Vago Tibor wrote: <blockquote type="cite">Dear Andreas, Thansk for the quick answer. We will start the development for this feature and send patch(es) to the ND list. Kind regards, Tibor 2010-05-19 12:15 keltezéssel, Andreas Ericsson írta: <blockquote type="cite">On 05/19/2010 11:03 AM, Vágó Tibor wrote: <blockquote type="cite">Dear Nagios devel-list, We would like to use attribute based authority checking in Nagios. We use authentication but not SSL-based. Our conception is (based nagios-version-3.2.1) the following: *Step1* cgi/status.c: ------------------------------------------------- //line136: authdata current_authdata; //line244: get_authentication_information(&current_authdata); Add some char variables to authdata structure. include/cgiauth.h ------------------------------------------------- typedef struct authdata_struct{ char *username; int authorized_for_all_hosts; int authorized_for_all_host_commands; int authorized_for_all_services; int authorized_for_all_service_commands; int authorized_for_system_information; int authorized_for_system_commands; int authorized_for_configuration_information; int authorized_for_read_only; int authenticated; //TODO char **host_allow_to_see; char **service_allow_to_see; ... }authdata; *Step2* cgi/cgiauth.c ------------------------------------------------- line86 /* read in authorization override vars from config file... */ line87 if((thefile=mmap_fopen(get_cgi_config_location()))!=NULL){ ... line95 if((input=mmap_fgets_multiline(thefile))==NULL) line96 break; authinfo->username="" authinfo->authenticated=FALSE authinfo->authorized_for_all_hosts=FALSE; authinfo->authorized_for_all_host_commands=FALSE; authinfo->authorized_for_all_services=FALSE; authinfo->authorized_for_all_service_commands=FALSE; authinfo->authorized_for_system_information=FALSE; authinfo->authorized_for_system_commands=FALSE; authinfo->authorized_for_configuration_information=FALSE; authinfo->authorized_for_read_only=FALSE; // TODO: // newlocal variable: attribute_server_variable="entitlement"; *Step3* Check the CGI config file is it contains "attribute_server_variable". If it not doesn't contain then we can return just like now. If it contains then read its value otherwise the default value is "entitlement". Then split value about ";" and put that pieces into an array. Now we can compare the attribute pieces of array from server variable and attributes from CGI configs. Theese compares will be placed in the following functions: int is_authorized_for_host(){...} int is_authorized_for_service(){...} ... etc. Can anyone inform me if this feature is currently under development or already usable. </blockquote> It's not under development and it's definitely not already usable. <blockquote type="cite">If not, we would like to add this feature to the Nagios source code cooperate with the developer team. How can I send patches or modification? </blockquote> You can send patches in unified diff format to this list, where I, Ton or Ethan will pick them up and put them "somewhere" and evaluate them for a future release. Note that details about the patch may well be altered during the review process. If the patch is crap, we'll tell you so and give you details about what needs to be changed in order for it to be accepted. Since it's a change to the cgi's, no new major release has to be done. </blockquote> </blockquote> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> ------------------------------------------------------------------------------ Download new Adobe(R) Flash(R) Builder(TM) 4 The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly Flex(R) Builder(TM)) enable the development of rich applications that run across multiple browsers and platforms. Download your free trials today! <a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/adobe-dev2dev">http://p.sf.net/sfu/adobe-dev2dev</a></pre> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Nagios-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:Nagios-devel@lists.sourceforge.net">Nagios-devel@lists.sourceforge.net</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/nagios-devel">https://lists.sourceforge.net/lists/listinfo/nagios-devel</a> </pre> </blockquote> <pre class="moz-signature" cols="72">-- DI (FH) Michael Friedrich Vienna University Computer Center Universitaetsstrasse 7 A-1010 Vienna, Austria email: <a class="moz-txt-link-abbreviated" href="mailto:michael.friedrich@univie.ac.at">michael.friedrich@univie.ac.at</a> phone: +43 1 4277 14359 fax: +43 1 4277 14279 web: <a class="moz-txt-link-freetext" href="http://www.univie.ac.at/zid">http://www.univie.ac.at/zid</a> Icinga Core & IDOUtils Developer <a class="moz-txt-link-freetext" href="http://www.icinga.org">http://www.icinga.org</a> </pre> </body> </html>