Re: [Nagios-devel] [oss-security] Security bug or feature?
Posted: Wed Sep 04, 2013 8:37 am
On 04.09.2013 11:03, Andreas Ericsson wrote:
> On 2013-09-04 10:31, Jonas Meurer wrote:
>> The indisputable part of this change is, that users are allowed to see
>> hostgroups and servicegroups with at least one authorized host or
>> service. Unclear is, whether this means "group and all its group
>> members", or "group and only authorized group members".
>=20
> It should mean "group and only authorized group members, except also
> hosts for services where one is authorized to see the service".
[...]
> Well, it *was* by design, but now I'm changing the design. It's a good
> time for it, since 4.0 is about to come out. I think the security teams
> can move on and we'll consider this "changed" rather than "fixed" for
> 4.0, where we do some security tightening.
Since you do seem to be willing to ponder the system of access rights
and its security implications: I haven't checked the 4.x prereleases
yet, does being authorized to see a host's information still necessarily
provide access to *all* services on it?
In the "customers accessing provider's Nagios" scenario, I suppose that
the customer might be interested in seeing "application is running" but
not, say, "the snmpd that ties this machine to the provider's NMS is
acting up" ...
Regards,
J. Bern
--=20
*NEU* - NEC IT-Infrastruktur-Produkte im :
Server--Storage--Virtualisierung--Management SW--Passion for Performance
Jochen Bern, Systemingenieur --- LINworks GmbH
Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt
PGP (1024D/4096g) FP =3D D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C2=
7
Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202
Unternehmenssitz Weiterstadt, Gesch=E4ftsf=FChrer Metin Dogan, Oliver Mic=
hel
This post was automatically imported from historical nagios-devel mailing list archives
Original poster: [email protected]
> On 2013-09-04 10:31, Jonas Meurer wrote:
>> The indisputable part of this change is, that users are allowed to see
>> hostgroups and servicegroups with at least one authorized host or
>> service. Unclear is, whether this means "group and all its group
>> members", or "group and only authorized group members".
>=20
> It should mean "group and only authorized group members, except also
> hosts for services where one is authorized to see the service".
[...]
> Well, it *was* by design, but now I'm changing the design. It's a good
> time for it, since 4.0 is about to come out. I think the security teams
> can move on and we'll consider this "changed" rather than "fixed" for
> 4.0, where we do some security tightening.
Since you do seem to be willing to ponder the system of access rights
and its security implications: I haven't checked the 4.x prereleases
yet, does being authorized to see a host's information still necessarily
provide access to *all* services on it?
In the "customers accessing provider's Nagios" scenario, I suppose that
the customer might be interested in seeing "application is running" but
not, say, "the snmpd that ties this machine to the provider's NMS is
acting up" ...
Regards,
J. Bern
--=20
*NEU* - NEC IT-Infrastruktur-Produkte im :
Server--Storage--Virtualisierung--Management SW--Passion for Performance
Jochen Bern, Systemingenieur --- LINworks GmbH
Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt
PGP (1024D/4096g) FP =3D D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C2=
7
Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202
Unternehmenssitz Weiterstadt, Gesch=E4ftsf=FChrer Metin Dogan, Oliver Mic=
hel
This post was automatically imported from historical nagios-devel mailing list archives
Original poster: [email protected]