Nagios interface won't display, php file downloaded instead

[agenerette]

I don't think so. I've never used it and

root@ccb1:/tmp# getenforce
The program 'getenforce' is currently not installed. You can install it by typing:
apt-get install selinux-utils

root@ccb1:/tmp# sestatus
The program 'sestatus' is currently not installed. You can install it by typing:
apt-get install policycoreutils

The VM is an EC2 one, though. Could the issue be related to that? I'm new to Amazon's security-groups feature, but I've seen some trouble with accessing particular services before I'd setup necessary objects in that area.

[abrist]

A shot in the dark, but are your cgis executable?

Code: Select all

ls -la /usr/local/nagios/sbin/

This is very strange. As far as we can tell, php is installed, configured with apache, and running. When is the last time you restarted apache2?

[agenerette]

Yeah, I'm really stumped. I've restarted apache2 a number of times, because I've tried to do it each time I made a change to one of the config files, as part of troubleshooting. Here's the output from that command call:

root@ccb1:~# ls -la /usr/local/nagios/sbin/
total 3900
drwxrwxr-x 2 nagios nagios 4096 Jan 6 21:07 .
drwxr-xr-x 8 root root 4096 Jan 6 21:08 ..
-rwxrwxr-x 1 nagios nagios 281296 Jan 6 21:07 avail.cgi
-rwxrwxr-x 1 nagios nagios 275792 Jan 6 21:07 cmd.cgi
-rwxrwxr-x 1 nagios nagios 248448 Jan 6 21:07 config.cgi
-rwxrwxr-x 1 nagios nagios 289456 Jan 6 21:07 extinfo.cgi
-rwxrwxr-x 1 nagios nagios 240440 Jan 6 21:07 histogram.cgi
-rwxrwxr-x 1 nagios nagios 219824 Jan 6 21:07 history.cgi
-rwxrwxr-x 1 nagios nagios 219808 Jan 6 21:07 notifications.cgi
-rwxrwxr-x 1 nagios nagios 211576 Jan 6 21:07 outages.cgi
-rwxrwxr-x 1 nagios nagios 215688 Jan 6 21:07 showlog.cgi
-rwxrwxr-x 1 nagios nagios 289480 Jan 6 21:07 status.cgi
-rwxrwxr-x 1 nagios nagios 236408 Jan 6 21:07 statusmap.cgi
-rwxrwxr-x 1 nagios nagios 232128 Jan 6 21:07 statuswml.cgi
-rwxrwxr-x 1 nagios nagios 215712 Jan 6 21:07 statuswrl.cgi
-rwxrwxr-x 1 nagios nagios 240344 Jan 6 21:07 summary.cgi
-rwxrwxr-x 1 nagios nagios 232144 Jan 6 21:07 tac.cgi
-rwxrwxr-x 1 nagios nagios 248632 Jan 6 21:07 trends.cgi

[abrist]

Any hints in the apache logs?

Code: Select all

tail -25 /var/log/apache2/error.log

[agenerette]

I've been away from my computer for a while, so I only just saw the most recent response to my last post.

No, I don't believe selinux is enabled:

root@ccb1:~# ls -al /etc/selinux/config
ls: cannot access /etc/selinux/config: No such file or directory
root@ccb1:~# sestatus
The program 'sestatus' is currently

One new development: I installed Splunk on the EC2 host in question, yesterday. The web interface for that system displays properly, when I hit http://<host-ip>:8000 in a web browser.

[agenerette]

Oh, and here's what's showing in the log file:

root@ccb1:~# tail -25 /var/log/apache2/error.log
[Tue Jan 07 23:57:28 2014] [error] [client 41.160.2.18] File does not exist: /home/www/pma
[Tue Jan 07 23:57:28 2014] [error] [client 41.160.2.18] File does not exist: /home/www/admin
[Tue Jan 07 23:57:29 2014] [error] [client 41.160.2.18] File does not exist: /home/www/dbadmin
[Tue Jan 07 23:57:30 2014] [error] [client 41.160.2.18] File does not exist: /home/www/sql
[Tue Jan 07 23:57:30 2014] [error] [client 41.160.2.18] File does not exist: /home/www/mysql
[Tue Jan 07 23:57:31 2014] [error] [client 41.160.2.18] File does not exist: /home/www/myadmin
[Tue Jan 07 23:57:31 2014] [error] [client 41.160.2.18] File does not exist: /home/www/phpmyadmin2
[Tue Jan 07 23:57:32 2014] [error] [client 41.160.2.18] File does not exist: /home/www/phpMyAdmin2
[Tue Jan 07 23:57:33 2014] [error] [client 41.160.2.18] File does not exist: /home/www/phpMyAdmin-2
[Tue Jan 07 23:57:33 2014] [error] [client 41.160.2.18] File does not exist: /home/www/php-my-admin
[Tue Jan 07 23:57:34 2014] [error] [client 41.160.2.18] File does not exist: /home/www/sqlmanager
[Tue Jan 07 23:57:35 2014] [error] [client 41.160.2.18] File does not exist: /home/www/mysqlmanager
[Tue Jan 07 23:57:35 2014] [error] [client 41.160.2.18] File does not exist: /home/www/p
[Tue Jan 07 23:57:36 2014] [error] [client 41.160.2.18] File does not exist: /home/www/php-myadmin
[Tue Jan 07 23:57:37 2014] [error] [client 41.160.2.18] File does not exist: /home/www/phpmy-admin
[Tue Jan 07 23:57:37 2014] [error] [client 41.160.2.18] File does not exist: /home/www/webadmin
[Tue Jan 07 23:57:38 2014] [error] [client 41.160.2.18] File does not exist: /home/www/sqlweb
[Tue Jan 07 23:57:39 2014] [error] [client 41.160.2.18] File does not exist: /home/www/websql
[Tue Jan 07 23:57:39 2014] [error] [client 41.160.2.18] File does not exist: /home/www/webdb
[Tue Jan 07 23:57:40 2014] [error] [client 41.160.2.18] File does not exist: /home/www/mysqladmin
[Tue Jan 07 23:57:41 2014] [error] [client 41.160.2.18] File does not exist: /home/www/mysql-admin
[Wed Jan 08 08:48:56 2014] [error] [client 141.212.121.10] Invalid method in request \x16\x03\x01
[Wed Jan 08 12:58:12 2014] [error] [client 120.192.31.182] File does not exist: /home/www/manager
[Wed Jan 08 17:28:55 2014] [notice] caught SIGTERM, shutting down
[Wed Jan 08 17:28:56 2014] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.9 with Suhosin-Patch configured -- resuming normal operations

[abrist]

Looks like you have a number of web services configured on this host (btw, I think php-admin and mysql-admin are not having problems )
What happens when you browse to:

Code: Select all

http://<host ip>/nagios

You may have conflicting apache configurations. Is there a reason why you are installing so many web service to your nagios core box?

[agenerette]

When I try to browse http://<host ip>/nagios, instead of getting the Nagios web interface, my browser downloads what looks like a php file. On Chrome, I do get the login prompt, first, after hitting http://<host ip>/nagios, but after I enter credentials for nagiosadmin is when the php file gets downloaded.

I would have preferred to setup a host dedicated to nagios-server, but the person (a programmer) that I'm working with on setting up the VM in question wants to install everything on this instance.

[abrist]

MY warning to you is that nagios, depending on the number and type of checks, can be resource intensive. Also, troubleshooting apache issues on a server with a number of other unrelated web services can be frustrating, as the system is an unknown moving target. You still have a problem with php. Not to mention you have a large number of other apache errors relating to your other web services.

Maybe the php module has been restricted by one of the other configs?
Or you could possibly have another management suite controlling the apache config, other than httpd.conf?

We are running out of good suggestions, and this is looking more and more like an apache config problem. But due to the number of other, half-working web services, this may be hard to continue to troubleshoot or hunt down. I highly suggest in the future that you do not install more services/applications/etc to a server that is already having issues as this can greatly complicate the troubleshooting process.

What other high level services/applications have been installed on the server other than what was listed in the error logs above?

EDIT: Those errors could be an attempted exploit - looks like your server may currently be a target by a malicious attacker. . . So I may eat my words above, but you should be aware that you may be someones target . . .

[agenerette]

Using the notes from our discussion, I will recommend to everyone involved on my project that we move Nagios to a different host and dedicate that host to the service.

With regard to the attempted exploit question, I actually took a number of steps to try and insure that we didn't get hit... including setting up ssh-keys.

Thank you for your help/suggestions, though.