Page 2 of 2
Re: Nagios XI exploit
Posted: Tue Jan 26, 2021 3:48 pm
by dchurch
None of those code snippets or logs indicate any attacks are going on.
MarkCampbell wrote:Does anyone have a checksum list for all of the files bundled in the nagiosxi 5.8.1 release? I'd like to compare mine to them, find any that might be different.
Depending on how you installed Nagios XI, it might be different. If you installed via
yum install nagiosxi you can simply ask yum to reinstall Nagios XI from the package:
Re: Nagios XI exploit
Posted: Tue Jan 26, 2021 4:49 pm
by MarkCampbell
I would have preferred to do it via yum, but in following the installation guide, I had to build it out with the tarball. Can I download the x-5.8.1.tar.gz and reinstall with the install script that way? Would that be safe?
Re: Nagios XI exploit
Posted: Wed Jan 27, 2021 3:07 pm
by dchurch
Unfortunately installing nagios XI on top of an existing XI installation isn't recommended.
Important: Nagios Enterprises highly recommends and will only support installing Nagios XI on a newly
installed, "clean" system (a bare minimal install with nothing else installed or configured).
Attempting to install Nagios XI on a pre-existing system with other applications already installed can cause
the Nagios XI installation process to fail, critical system components and settings (e.g. database servers) to
be modified in a way that negatively affects other applications, and previously installed applications to be
automatically upgraded or removed. While installing XI on a system with other applications is possible, it is
not recommended due to the possible interactions and complexity of multiple components that are required
for Nagios XI to function. If you choose to ignore these warnings, you do so at your own risk.
Other Nagios products (Network Analyzer, Log Server and Fusion) should not co-exist on the same server.
--
https://assets.nagios.com/downloads/nag ... -Linux.pdf
Re: Nagios XI exploit
Posted: Wed Jan 27, 2021 7:10 pm
by MarkCampbell
So what are my options then? Can I switch over to yum after it's already been installed via tarball?
Re: Nagios XI exploit
Posted: Thu Jan 28, 2021 1:18 pm
by dchurch
What version of Nagios XI are you running?
The recommended process is to create a backup of XI, create a new VM/server, yum install XI on that machine, and restore the backup to the new machine.
After setting up a new CentOS machine, set up the Nagios repo using the instructions
here.
Then the import process: