Nagios Support Forum

Good afternoon,

We have been looking at Nagios as a solution for our company. However, with the old versions of PHP and APACHE being used it keeps coming up on our parent companies vulnerability scans. Can we install Nagios XI on top of the most current PHP and APACHE versions?

If you're using the absolute latest stable releases of Apache and PHP, it probably will not work.

It's a tough situation that leaves the development cycle of Nagios XI almost completely reliant on what the Base repository for CentOS/RHEL distributes for it's php/httpd packages. You might have your security team review Red Hat's policy about backporting security fixes to see if it is sufficient:
https://access.redhat.com/security/updates/backporting

mcapra is correct on the backporting of security fixes, however, XI currently supports Apache up to 2.4.X and PHP up to 5.6.X should you determine that you need to upgrade your packages.

I was told that XI 5.4.8 should have support for PHP 7.X when it is released.

If you are on RHEL/CentOS 6 you will likely need to install apache 2.4 from source or build your own RPMs, I was unable to find a repository for RHEL/CentOS 6 that had Apache 2.4 included that wasn't a separate package (meaning httpd24 package instead of httpd package, this will not work with XI since the installer expects the httpd package and locations). If you are on RHEL/CentOS 7 this shouldn't be a problem.

Nagios XI is written and tested against the versions that are released in the default repositories for RHEL/CentOS, while you certainly can go to a higher level Apache/HTTPD (we have other customers running Apache 2.4.X and PHP 5.6.X) and it will likely work, it hasn't been as tested against as thoroughly as the default packages from those distros so you will need to keep an eye out for any issues.

But technically, if you install httpd and PHP at the latest versions we support before you run the fullinstall script, it should work just fine.


Let us know if you have any questions.

Thank you