problem in "use_authentication=1" function

[cronist]

hi to all.

my problem is about "use_authentication=1"

i created 5 host group.

hostgroup1
host1,host2,host3

hostgroup2
host4,host5,host6

hostgroup3
host1,host4

hostgroup4
host2,host5

hostgroup5
host3,host6

contacts of host1 - host3 = contact1
contacts of host4 - host6 = contact2

when i login with contact1 i can see
hostgroup1 (all of its hosts), hostgroup3 (all of its hosts), hostgroup4 (all of its hosts) and hostgroup5(all of its hosts). It is PROBLEM.

when i login with contact2 i can see
hostgroup2(all of its hosts), hostgroup3(all of its hosts), hostgroup4(all of its hosts) and hostgroup5(all of its hosts). It is PROBLEM.

the problem is that ALL the hosts are placed in hostgroup3, hostgroup4 and hostgroup5 are BEEING SEEN by all the contacts.

actually i have to see only the hosts that contact1 or contact2 is their OWN contact. but i can see all the hosts of other groups.

what is the solution or is it normal? or is it a BUG?

thanks...

[tmcdonald]

I would read over the relevant documentation on the matter:

http://nagios.sourceforge.net/docs/3_0/cgiauth.html

You should set up the cgi.cfg options instead of relying on just contact associations.

[cronist]

the link "http://nagios.sourceforge.net/docs/3_0/ ... efinitions" says that:

Authenticated contacts* are granted the following permissions for each host for which they are contacts (but not for hosts for which they are not contacts)...

Authorization to view host status information
Authorization to view host configuration information
Authorization to view history and notifications for the host
Authorization to issue host commands
Authorization to view status information for all services on the host
Authorization to view configuration information for all services on the host
Authorization to view history and notification information for all services on the host
Authorization to issue commands for all services on the host

but as u see it is not working properly. or am i missing something. can you be more clear for me?

thanks...

[sreinhardt]

The clarification that seems to be missing there, is if a contact is a part of a host, that is also a part of a host group. The contact can then view all hosts int hat host group, while on the hostgroup viewing page. They should not be able to drill further down into the host or service details unless they are a contact, but nagios does not restrict the hostgroup or servicegroup page so that contacts and admins will be able to see other related hosts and services that would likely be important to them in deciding how to take action and resolve issues.

[cronist]

is there any way to do something like that?

city1 = hostgroup
c1_server1 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_server2 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_server3 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_switch1 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_switch2 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_switch3 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_ups1 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_ups2 = host ( contacts are city1nagiosadmin and generalnagiosadmin )
c1_ups3 = host ( contacts are city1nagiosadmin and generalnagiosadmin )

city2 = hostgroup
c2_server1 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_server2 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_server3 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_switch1 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_switch2 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_switch3 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_ups1 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_ups2 = host ( contacts are city2nagiosadmin and generalnagiosadmin )
c2_ups3 = host ( contacts are city2nagiosadmin and generalnagiosadmin )

servers = hostgroup
c1_server1
c1_server2
c1_server3
c2_server1
c2_server2
c2_server3

switches = hostgroup
c1_switch1
c1_switch2
c1_switch3
c2_switch1
c2_switch2
c2_switch3

UPSs = hostgroup
c1_ups1
c1_ups2
c1_ups3
c2_ups1
c2_ups2
c2_ups3

I want that:
when city1nagiosadmin and city2nagiosadmin logged in, he/she can only see the hosts that he/she is a contact for in switches, UPSs and servers hostgroups.
for example i am city1nagiosadmin.
when i logged in i wanna see something like that.

city1 = hostgroup
c1_server1
c1_server2
c1_server3
c1_switch1
c1_switch2
c1_switch3
c1_ups1
c1_ups2
c1_ups3

servers = hostgroup
c1_server1
c1_server2
c1_server3

switches = hostgroup
c1_switch1
c1_switch2
c1_switch3

UPSs = hostgroup
c1_ups1
c1_ups2
c1_ups3

any addon or solution that i can buy or purchase for this?

thanks very much...

[abrist]

Well, you could look at creating a custom dashboard to block the hostgroup view-ability.
We may be able to do something for you concerning custom development. Talk to sales at: [email protected].

[tmcdonald]

Also it would be a lot easier if you posted the actual configs. It is quite confusing looking at a list like this.

[cronist]

i mailed to sales and they replied like that.

Hi Mesut,

Thanks for your message. For now, I would continue to work with the support techs on the forum about this. It looks like you made a post early this morning, so they'll reply as quickly as possible. In looking over the thread, I'm not certain what you're looking for, so we'll need to wait for some more guidance from the techs, who will guide you.

Best Regards,

Shamas Demoret
Sales Tech

here is my sample config. thanks for all...

###############################################################################
###############################################################################
#
# HOST DEFINITION
#
###############################################################################
###############################################################################

# Define a host for the local machine

define host{
use linux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost
alias localhost
address 127.0.0.1
}

define host{
use adanalinux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost2
alias localhost2
address 127.0.0.1
hostgroups Adana UPSler
}
define host{
use bursalinux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost3
alias localhost3
address 127.0.0.1
hostgroups Bursa UPSler
}

define host{
use adanalinux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost4
alias localhost4
address 127.0.0.1
contacts adananagiosadmin
contact_groups Adana
hostgroups Adana Switchler
}
define host{
use adanalinux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost5
alias localhost5
address 127.0.0.1
hostgroups Adana Kameralar
}
define host{
use bursalinux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost6
alias localhost6
address 127.0.0.1
hostgroups Bursa Switchler
}
define host{
use bursalinux-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name localhost7
alias localhost7
address 127.0.0.1
hostgroups Bursa Kameralar
}


###############################################################################
###############################################################################
#
# HOST GROUP DEFINITION
#
###############################################################################
###############################################################################

# Define an optional hostgroup for Linux machines

define hostgroup{
hostgroup_name Adana ; The name of the hostgroup
alias Adana ; Long name of the group
hostgroup_members Adana UPSler,Adana Switchler,Adana Kameralar
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Adana UPSler ; The name of the hostgroup
alias Adana UPSler ; Long name of the group
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Adana Switchler ; The name of the hostgroup
alias Adana Switchler ; Long name of the group
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Adana Kameralar ; The name of the hostgroup
alias Adana Kameralar ; Long name of the group
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name UPSler ; The name of the hostgroup
alias UPSler ; Long name of the group
hostgroup_members Adana UPSler,Bursa UPSler
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Switchler ; The name of the hostgroup
alias Switchler ; Long name of the group
hostgroup_members Adana Switchler,Bursa Switchler
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Kameralar ; The name of the hostgroup
alias Kameralar ; Long name of the group
hostgroup_members Adana Kameralar,Bursa Kameralar
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Bursa ; The name of the hostgroup
alias Bursa ; Long name of the group
hostgroup_members Bursa UPSler,Bursa Switchler,Bursa Kameralar
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Bursa UPSler ; The name of the hostgroup
alias Bursa UPSler ; Long name of the group
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Bursa Switchler ; The name of the hostgroup
alias Bursa Switchler ; Long name of the group
# members ; Comma separated list of hosts that belong to this group
}
define hostgroup{
hostgroup_name Bursa Kameralar ; The name of the hostgroup
alias Bursa Kameralar ; Long name of the group
# members ; Comma separated list of hosts that belong to this group
}

define hostgroup{
hostgroup_name linux-servers ; The name of the hostgroup
alias Linux Servers ; Long name of the group
members localhost ; Comma separated list of hosts that belong to this group
}

define service{
use local-service ; Name of service template to use
host_name localhost
service_description PING
check_command check_ping!100.0,20%!500.0,60%
}


###############################################################################
###############################################################################
#
# CONTACTS
#
###############################################################################
###############################################################################

# Just one contact defined by default - the Nagios admin (that's you)
# This contact definition inherits a lot of default values from the 'generic-contact'
# template which is defined elsewhere.

define contact{
contact_name nagiosadmin ; Short name of user
use generic-contact ; Inherit default values from generic-contact template (defined above)
alias Nagios Admin ; Full name of user

email [email protected] ; <<***** CHANGE THIS TO YOUR EMAIL ADDRESS ******
}
define contact{
contact_name adananagiosadmin ; Short name of user
use generic-contact ; Inherit default values from generic-contact template (defined above)
alias Adana Nagios Admin ; Full name of user

email [email protected] ; <<***** CHANGE THIS TO YOUR EMAIL ADDRESS ******
}
define contact{
contact_name bursanagiosadmin ; Short name of user
use generic-contact ; Inherit default values from generic-contact template (defined above)
alias Bursa Nagios Admin ; Full name of user

email [email protected] ; <<***** CHANGE THIS TO YOUR EMAIL ADDRESS ******
}

###############################################################################
###############################################################################
#
# CONTACT GROUPS
#
###############################################################################
###############################################################################

# We only have one contact in this simple configuration file, so there is
# no need to create more than one contact group.

define contactgroup{
contactgroup_name admins
alias Nagios Administrators
members nagiosadmin
}
define contactgroup{
contactgroup_name Adana
alias Adana Nagios Administrators
members adananagiosadmin
}
define contactgroup{
contactgroup_name Bursa
alias Bursa Nagios Administrators
members bursanagiosadmin
}

define host{
name adanalinux-server ; The name of this host template
use generic-host ; This template inherits other values from the generic-host template
check_period 24x7 ; By default, Linux hosts are checked round the clock
check_interval 5 ; Actively check the host every 5 minutes
retry_interval 1 ; Schedule host check retries at 1 minute intervals
max_check_attempts 10 ; Check each Linux host 10 times (max)
check_command check-host-alive ; Default command to check Linux hosts
notification_period workhours ; Linux admins hate to be woken up, so we only notify during the day
; Note that the notification_period variable is being overridden from
; the value that is inherited from the generic-host template!
notification_interval 120 ; Resend notifications every 2 hours
notification_options d,u,r ; Only send notifications for specific host states
contact_groups Adana ; Notifications get sent to the admins by default
register 0 ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL HOST, JUST A TEMPLATE!
}
define host{
name bursalinux-server ; The name of this host template
use generic-host ; This template inherits other values from the generic-host template
check_period 24x7 ; By default, Linux hosts are checked round the clock
check_interval 5 ; Actively check the host every 5 minutes
retry_interval 1 ; Schedule host check retries at 1 minute intervals
max_check_attempts 10 ; Check each Linux host 10 times (max)
check_command check-host-alive ; Default command to check Linux hosts
notification_period workhours ; Linux admins hate to be woken up, so we only notify during the day
; Note that the notification_period variable is being overridden from
; the value that is inherited from the generic-host template!
notification_interval 120 ; Resend notifications every 2 hours
notification_options d,u,r ; Only send notifications for specific host states
contact_groups Bursa ; Notifications get sent to the admins by default
register 0 ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL HOST, JUST A TEMPLATE!
}

[root@kgyscys etc]# more htpasswd.users
nagiosadmin:KheS5RF32D.os
adananagiosadmin:$apr1$iKxPvhLA$0D1DJu7qE6wvZsvuYboPW1
bursanagiosadmin:$apr1$Ybo1Ujvc$xBaHowjQYednp6.MibjSb/
[root@kgyscys etc]#
#

[cronist]

actually what i want is:

existing situation:

The clarification that seems to be missing there, is if a contact is a part of a host, that is also a part of a host group.

what i want is:

The clarification that seems to be missing there, is if a contact is ONLY a part of a host, that is NOT a part of a host group.

[scottwilkerson]

I want that:
when city1nagiosadmin and city2nagiosadmin logged in, he/she can only see the hosts that he/she is a contact for in switches, UPSs and servers hostgroups.
for example i am city1nagiosadmin.
when i logged in i wanna see something like that.

This is default behavior if you do not give extra permissions to these users in cgi.cfg

The clarification that seems to be missing there, is if a contact is ONLY a part of a host, that is NOT a part of a host group.

Contact CANNOT be assigned to host groups, so the later would never be the case...