nagiosxi-5.8.5-1.el8 offline install issues

[zebee]

I am trying to install nagios-xi. i have mirrored the nagios repositories but doing an online RHEL8 install failed: the nagiosxi-5.8.5-1 rpm fails.

I downloaded the offline install but that has the same issue. Looking at the scripts the nagioxi rpm runs I see it runs a thing called rpminstall.

This in turn does:
# Install special requirements that cannot be done via rpms for CentOS 8
if [ "$dist" == "el8" ]; then set +e python -m pip install "pymssql<3"
echo | cpan install CPAN
cpan install Crypt::Rijndael Crypt::SSLeay Class::Accessor Mail::IMAPClient Number::Format Params::Validate Nagios::Monitoring::Plugin
set -e
fi
meaning it tries to go to the internet to get perl and python libs. and when it can't get them it fails.
I installed those libs but because the script doesn't check for them that doesn't matter. It still fails.

Why is an offline install trying to get to the internet, and how can I stop that happening? Do I have to do all the rpminstall script by hand then install the rpm --noscript?

[vtrac]

Hi @zebee,
How are you doing?
Here's the KB on how to do offline install:
https://assets.nagios.com/downloads/nag ... onment.pdf

Here's the offline download page:
https://repo.nagios.com/?repo=offline

I looked at the "fullinstall" and also the "upgrade" scripts, both used the "localinstall" of RPM packages (please see below) from the tar file:

cat fullinstall

Code: Select all

#!/bin/sh -e

# Import gpg key
if [ ! -f /etc/pki/rpm-gpg/GPG-KEY-NAGIOS-V2 ]; then
        /bin/cp -f GPG-KEY-NAGIOS-V2 /etc/pki/rpm-gpg/GPG-KEY-NAGIOS-V2
        rpm --import GPG-KEY-NAGIOS-V2
fi

# Do local install of packages
yum -y --nogpgcheck localinstall *.rpm

cat upgrade

Code: Select all

#!/bin/sh -e

# Import gpg key
if [ ! -f /etc/pki/rpm-gpg/GPG-KEY-NAGIOS-V2 ]; then
        /bin/cp -f GPG-KEY-NAGIOS-V2 /etc/pki/rpm-gpg/GPG-KEY-NAGIOS-V2
        rpm --import GPG-KEY-NAGIOS-V2
fi

# Install packages that may not be installed yet
if ! rpm -q nagiosxi-shellinabox; then
        yum -y --nogpgcheck localinstall nagiosxi-shellinabox*.rpm
fi
if ! rpm -q nagiosxi-nxti; then
        yum -y --nogpgcheck localinstall nagiosxi-nxti*.rpm
fi
if ! rpm -q perl-Nagios-Monitoring-Plugin && ! grep -q '8.' /etc/redhat-release; then
        yum -y --nogpgcheck localinstall perl-Nagios-Monitoring-Plugin*.rpm
fi

# Do local install of packages
yum -y --nogpgcheck localupdate *.rpm

Here are the steps you could try:
Download the offline package to your laptop from "https://repo.nagios.com/nagiosxi-offlin ... _64.tar.gz"
Then bring the "nagiosxi-5.8.5-1.el8.x86_64.tar.gz" onto your Nagios XI by using tool like "winscp" (for example) and put that under the "/tmp/rpms" folder.

Code: Select all

mkdir -p /tmp/rpms
cd /tmp/rpms

tar xzf nagiosxi-5.8.5-1.el8.x86_64.tar.gz
cd nagiosxi*
./fullinstall

Best Regards,
Vinh

[zebee]

Vinh,
problem is that localinstall as done in fullinstall script doesn't stop an rpm trying to install non-local things.

when I traced the process list during running fullinstall I see:
root 4076 3931 0 09:41 pts/1 00:00:00 python -m pip install pymssql<3

A bit of googling shows that "localinstall" is an old method of allowing install of rpms on disk and has been obsolete since RHEL5. Which explains why it is not in the dnf/yum man page on RHEL8. the RHEL5 man page says
*localinstall
Is used to install a set of local rpm files. If required the enabled repositories will be used to resolve dependencies. Note that the install command will do a local install, if given a filename.*

using localinstall does not stop an RPM script from trying to install things from the internet. And never has.

So the problem I have is not solved because the offline install is not actually offline because the scripts in the nagiox-xi rpm expect internet access. This means that pymssql is not installed. Nor are the perl libs that it tries to isntall from CPAN even though there are redhat RPMs that install some of those. It does mean that the rpm install hangs for ages as it tries and fails to access the outer net several times.

So there is no obvious difference between online and offline install except in the offline some RPMs are provided - and all of those are available in rhel8/epel/nagios repos we have mirrored.

Are the extermal packages from pipy and cpan required?
pymssql
Crypt::Rijndael Crypt::SSLeay Class::Accessor Mail::IMAPClient Number::Format Params::Validate Nagios::Monitoring::Plugin
There are RPMs for some of those, some of which are in the offline tarball: perl-Class-Accessor perl-Number-Format perl-Params-Validate
and some are not
perl-Crypt-Rijndael' perl-Mail-IMAPClient perl-Net-SSLeay
and of course there's no RPM for Nagios::Monitoring::Plugin

[vtrac]

Hi,
Hope you are having a great day!!

Here's the prerequisites:

T1.png

As stated in the KB, this must be done on a clean system.
Please follow the steps (below) and post the "install.log" so we can take a look.

Code: Select all

mkdir -p /tmp/rpms
cd /tmp/rpms

tar xzf nagiosxi-5.8.5-1.el8.x86_64.tar.gz
cd nagiosxi*
./fullinstall -n 2>&1 | tee /tmp/rpms/install.log

If you are having issue with PIP and CPAN, you might want to setup proxy.
I googled and found this URL: https://abhijit.name/setting_cpan_for_proxy.html


Best Regards,
Vinh

[zebee]

We are not allowed to set up proxies, it is forbidden by corporate security rules. So we can't install anything using pip or cpan. Those are specifically forbidden due to fear of compromised libraries as has happened recently.

So to be fully offline nagios needs to provide all the libraries they require. Else give full instructions as to how to download the libraries via wget or similar to an intermediate machine including all dependencies. So no pip or cpan commands in the instructions.

Then we can install them locally on a local repo server, and get them scanned and passed as OK. Software provided in a packaged form by a vendor is OK, software downloaded directly from the net is not.

We do not have access to pastebin or other sharing sites from corporate machines, how do I get the xi-install.log to you?

[vtrac]

Hi @zebee,
Hope you are having a good Wednesday!! ...

I check with the development team and here's what I got back:

Cent8 offline install isn't supported.
CentOS 8
Offline server must still have access to CentOS Base Repo, EPEL, and PowerTools (actual or clone) for installation/upgrade.
-- https://repo.nagios.com/?repo=offline

Is there a way you can use OVA package instead?


Best Regards,
Vinh

[zebee]

Vinh,
We are RHEL8, not Centos. And we have codeready builder access.

but as their rpminstall script specifically says
# Install special requirements that cannot be done via rpms for CentOS 8
if [ "$dist" == "el8" ]; then
set +e
python -m pip install "pymssql<3"
echo | cpan install CPAN
cpan install Crypt::Rijndael Crypt::SSLeay Class::Accessor Mail::IMAPClient Number::Format Params::Validate Nagios::Monitoring::Plugin
set -e
fi
I am not sure why they said anything about repos. They aren't using repos for this job and they say so in the comment. So the problem still exists: the offline build is not offline.

I don't know about OVA, we have a required SOE with CIS compliance andother required software and standards. Retrofitting an OVA to our standards might be a bit of a problem. Do you provide a RHEL8 OVA? We can't use Centos.

As time goes on we are not likely to be the only corporate customer with security and compliance concerns.

[vtrac]

Hi @zebee,
How are you doing?

I slacked my team and also development regarding "rpminstall" issue for RHEL 8.
Here's what I got back:

hmm that's not supposed to be in there
it got removed in the rpminstall in the repo but not on the build server
however, it's inside the +/-e so it's not stopping it
will change it though for the next build

So, you might have to wait for the next offline re-package. However, no ETA at this time.

I'm very sorry for any inconvenient this might have caused.


Best Regards,
Vinh

[zebee]

Vinh,
so those aren't needed? Wonderful!

It does mean the install takes forever as they time out but we can live with that for now.

[gsmith]

Hi,

Thanks for your patience with the install, hopefully the
Dev team can get to work on fixing the install script soon.

Thanks!