Can't get REST API to work with XPOST

Post by **WillemDH** » Mon Jan 11, 2016 10:25 am

Were you on 5.2.2 previously on this server?

Yes I was. I'm not seeing any relevant information in the Apache error_log nor the ssl_error_log.

My Apache config file looks like this on my Nagios XI Production server.

Code: Select all

<VirtualHost *:80>
        <Directory "/usr/local/nagiosxi/html">
                #  SSLRequireSSL
                Options None
                AllowOverride None
                Order allow,deny
                Allow from all
                #  Order deny,allow
                #  Deny from all
                #  Allow from 127.0.0.1
                #  AuthName "Nagios XI"
                #  AuthType Basic
                #  AuthUserFile /usr/local/nagiosxi/etc/htpasswd.users
                #  Require valid-user
        </Directory>
</VirtualHost>
<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/nagiosserver.crt
        #SSLCertificateFile /etc/pki/tls/certs/ca.crt
        SSLCertificateKeyFile /etc/pki/tls/private/nagiosserver.key
        #SSLCertificateKeyFile /etc/pki/tls/private/ca.key
        ErrorLog  /var/log/httpd/ssl_error_log
        CustomLog /var/log/httpd/ssl_access_log combined
        <Directory "/usr/local/nagiosxi/html">
                AllowOverride All
        </Directory>
        <IfModule mod_rewrite.c>
                RewriteEngine On
                RewriteCond %{REQUEST_FILENAME} !-f
                RewriteCond %{REQUEST_FILENAME} !-d
                RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
        </IfModule>
</VirtualHost>

Alias /nagiosxi "/usr/local/nagiosxi/html"

I guess I need to re-overwrite utils-api.inc.php? Can someone please confirm?

Grtz

ssax · Post by **ssax** » Mon Jan 11, 2016 4:56 pm

I'm not showing any differences in that file from 5.2.2 to 5.2.3..

ssax · Post by **ssax** » Mon Jan 11, 2016 5:00 pm

The problem with the API not working with HTTP is because of the way you have your apache config setup.

You would need to do it like this:

Code: Select all

<VirtualHost *:80>
        <Directory "/usr/local/nagiosxi/html">
                #  SSLRequireSSL
                Options None
                AllowOverride None
                Order allow,deny
                Allow from all
                #  Order deny,allow
                #  Deny from all
                #  Allow from 127.0.0.1
                #  AuthName "Nagios XI"
                #  AuthType Basic
                #  AuthUserFile /usr/local/nagiosxi/etc/htpasswd.users
                #  Require valid-user
        </Directory>
</VirtualHost>
<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/nagiosserver.crt
        #SSLCertificateFile /etc/pki/tls/certs/ca.crt
        SSLCertificateKeyFile /etc/pki/tls/private/nagiosserver.key
        #SSLCertificateKeyFile /etc/pki/tls/private/ca.key
        ErrorLog  /var/log/httpd/ssl_error_log
        CustomLog /var/log/httpd/ssl_access_log combined
        <Directory "/usr/local/nagiosxi/html">
                AllowOverride All
        </Directory>
</VirtualHost>

Alias /nagiosxi "/usr/local/nagiosxi/html"

<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
</IfModule>

Post by **WillemDH** » Mon Jan 11, 2016 5:33 pm

Sean,

Correct me if I'm wrong, but your documentation says different no?

https://assets.nagios.com/downloads/nag ... s%20XI.pdf

EDIT: Anyway I tried your suggestiona nd still experiencing the same problem. In fact it seems like it is also no longer working from the CLI with GET and HTTP. Seems like I'm experiencing a new issue that was probably introduced with the 5.2.3 installation or some yum updates I did. (Fully patched the server last week)

Code: Select all

curl -XGET "http://nagiosserver/nagiosxi/api/v1/system/applyconfig?apikey=blablaapikey&pretty=1"
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /nagiosxi/api/v1/system/applyconfig was not found on this server.</p>
<hr>
<address>Apache/2.2.15 (CentOS) Server at nagiosserver Port 80</address>
</body></html>

Let me know what I can do to troubleshoot this further
.
Grtz

ssax · Post by **ssax** » Tue Jan 12, 2016 10:31 am

Please PM me your /etc/httpd/conf.d directory and your /etc/httpd/conf/httpd.conf file so that I can lab it up.

Post by **WillemDH** » Tue Jan 12, 2016 11:05 am

Sent you pm Sean with the asked information.

ssax · Post by **ssax** » Tue Jan 12, 2016 1:04 pm

Ok, with the way you have it setup you would need two of them:

Code: Select all

<VirtualHost *:80>
        <Directory "/usr/local/nagiosxi/html">
                #  SSLRequireSSL
                Options None
                AllowOverride None
                Order allow,deny
                Allow from all
                #  Order deny,allow
                #  Deny from all
                #  Allow from 127.0.0.1
                #  AuthName "Nagios XI"
                #  AuthType Basic
                #  AuthUserFile /usr/local/nagiosxi/etc/htpasswd.users
                #  Require valid-user
        </Directory>
        <IfModule mod_rewrite.c>
                RewriteEngine On
                RewriteCond %{REQUEST_FILENAME} !-f
                RewriteCond %{REQUEST_FILENAME} !-d
                RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
        </IfModule>
</VirtualHost>
<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/nagiosserver.crt
        #SSLCertificateFile /etc/pki/tls/certs/ca.crt
        SSLCertificateKeyFile /etc/pki/tls/private/nagiosserver.key
        #SSLCertificateKeyFile /etc/pki/tls/private/ca.key
        ErrorLog  /var/log/httpd/ssl_error_log
        CustomLog /var/log/httpd/ssl_access_log combined
        <Directory "/usr/local/nagiosxi/html">
                AllowOverride All
        </Directory>
        <IfModule mod_rewrite.c>
                RewriteEngine On
                RewriteCond %{REQUEST_FILENAME} !-f
                RewriteCond %{REQUEST_FILENAME} !-d
                RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
        </IfModule>
</VirtualHost>

Alias /nagiosxi "/usr/local/nagiosxi/html"

Post by **WillemDH** » Thu Jan 14, 2016 10:45 am

Sean,

The way I set it up is as described in the Nagios documentation https://assets.nagios.com/downloads/nag ... s%20XI.pdf

Your suggestion fixed the issue for HTTP though. It might be a good idea to adjust the documentation?

About HTTPS, I managed to get it working in CLI over HTTPS, but I need to specify our root CA PEM certificate location like this:

Code: Select all

curl --cacert /etc/pki/ca-trust/source/SECURECHAIN.pem -XGET "https://nagiosserver/nagiosxi/api/v1/system/applyconfig?apikey=blablaapikey&pretty=1"
{
    "success": "Apply config command has been sent to the backend."
}

Apparently curl doesn't use the default trusted certificate store locations as described in this awesome post which helped me a lot:

https://www.happyassassin.net/2015/01/1 ... scert-pem/

Now that I got it working with a GET from CLI I tried to use the Reactor chain I created. Apparently this does work with HTTP and HTTPS, which is nice, but as discussed earlier we need to get this working with a POST http request.

My tests with a POST were not successfully from CLI, not with HTTP and not with HTTPS:

Code: Select all

curl -XPOST --data "apikey=blablaapikey&pretty=1" "http://nagiosserver/nagiosxi/api/v1/system/applyconfig"
{"error":"Unknown API endpoint."}

Code: Select all

curl --cacert /etc/pki/ca-trust/source/GENTSECURECHAIN.pem -XPOST --data "apikey=blablaapikey&pretty=1" "https://nagiosserver/nagiosxi/api/v1/system/applyconfig"
{"error":"Unknown API endpoint."}

But I receive as you can see an "Unknown API endpoint." error. Do you manage to get it working with an XPOST? Seems like another Apache config issue?

And once I got it working with XPOST from CLI, I would need this to work from Reactor so I can use this apply chain in more complex bigger chains. I'm not sure how the 'submit HTTP request' action works. Does it use curl?

As the GET works over HTTPS, I assume Reactor does recognizes the default cert store, so think I won't have to specify the option --cacert /etc/pki/ca-trust/source/SECURECHAIN.pem in the Extra GET/POST Params textbox.

ssax · Post by **ssax** » Thu Jan 14, 2016 4:21 pm

After looking at the code it will not work with XPOST, you could make it work though...

We'll use apply configuration in this example.

You could edit this file:

Code: Select all

/usr/local/nagiosxi/html/api/includes/utils-api.inc.php

Then search for "function system" (you could also search for "function objects" and "function config" if trying to do something else)

You will see that most of the stuff is located under the GET case statement, no worry, just add the apply config one from the GET to the POST one:

From this:

Code: Select all

            case 'POST':
                switch ($verb)
                {
                    case 'user':
                        return $this->add_user();
                        break;

                    default:
                        return array('error' => _('Unknown API endpoint.'));
                        break;
                }
                break;

To this:

Code: Select all

            case 'POST':
                switch ($verb)
                {
                    case 'user':
                        return $this->add_user();
                        break;

                    case 'applyconfig':
                        return $this->apply_config();
                        break;

                    default:
                        return array('error' => _('Unknown API endpoint.'));
                        break;
                }
                break;

Now it should work for you. I will let the developers know about this.

ssax · Post by **ssax** » Thu Jan 14, 2016 5:11 pm

I've added it as a feature request:

Code: Select all

NEW TASK ID 7490 created - Nagios XI Feature Request: Add API XPOST functionality for other functions

Nagios Support Forum

Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST

Re: Can't get REST API to work with XPOST