Schedule SSH backup failing via GUI

[absarcompass]

HI team,
I have upgraded to version 5.6.7
I can scp the nagiosxi backup file from /store/backups/nagiosxi/ to remote server but the web interface is failing to do so.
testing connection is fine but test file transfer gives permission error. where as transfer is working fine using same user, authentication and same directories.
what needs to be looked at here ?

scp connection test OK.PNG

scp transfer fail.PNG

[tgriep]

Follow this article to enable debugging for the Scheduled backup component.
https://support.nagios.com/kb/article/n ... l-578.html

Try running the Test button again and look at the log for any errors.

Code: Select all

/usr/local/nagiosxi/var/components/scheduledbackups.log

Can you post the permission settings for the folder on the remote system so we can view them?

[absarcompass]

Hi
nothing comes in scheduledbackups.log when I test connection from gui
these are the permissions on directory.

drwx------ 2 nagiosxi nagiosxi 4096 Nov 6 11:14 nagiosxi

like i mentioned earlier manual scp is working from command line from the same directory of nagiosxi to same directory of remote server.
It must be something to do with gui :S

[tgriep]

Run this command on the nagios server and post the output here.

Code: Select all

ls -l /usr/local/nagiosxi/html/includes/components/scheduledbackups/includes/ssh_test_secure_copy.txt

If the test cannot read the file that it sends, it would generate that error as well.

Here is what the permissions should look like.

Code: Select all

-rw-r--r-- 1 nagios nagios 110 Nov  4 15:22 /usr/local/nagiosxi/html/includes/components/scheduledbackups/includes/ssh_test_secure_copy.txt

Another thing is to look on the remote server ssh logs to see what error is there when transfering the test file.

[absarcompass]

the out put is

Code: Select all

-rw-r--r-- 1 nagios nagios 110 Oct 31 14:22 /usr/local/nagiosxi/html/includes/components/scheduledbackups/includes/ssh_test_secure_copy.txt

permission looks fine.
remote server is giving error invalid format

Code: Select all

session_exec_req: parse packet: Connection from user nagiosxi 192.168.x.x port 43388: invalid format

When transfer 3 gigs of backup file via command line ssh session closes from nagiosxi, after completion of transfer, in remote server ssh logs

Code: Select all

Received disconnect from 192.168.x.x port 45705:11: disconnected by user
 Disconnected from user nagiosxi 192.168.x.x port 45705

[tgriep]

In the Scheduled Backup SSH settings in XI, what SSH Auth Type are you using?
Password or Public Key?

The php module that is trying to transfer the file is setting the create mode permissions for the file to 0644 which is "-rw-r--r--" for the remote file permissions.
Is there a policy or security setting that is blocking the creation of the file to be read for the group and other setting?

[absarcompass]

we are using public key for authentication.
I am able to copy backup from command line so there shouldn't be any policy or security settings stopping Gui of nagiosxi from creating file :S

[absarcompass]

to test I triggered schedule backup and was able to see nagiosxi creating backup file successfully in /store/backups/nagiosxi directory
but then nothing reached to remote server and schedule backup file removed from the /store/backups/nagiosxi

I tried again with changing the remote server directory to /var/tmp and /tmp at schedule backup setup page in nagiosxi and same happened with no logs in /usr/local/nagiosxi/var/components/scheduledbackups.log
and remote server ssh logs after getting authenticated with publick key, suggest invalid format from nagiosxi

Nov 11 10:58:42 mgmt sshd[189]: session_exec_req: parse packet: Connection from user nagiosxi 192.168.x.x port 44068: invalid format
Nov 11 10:58:42 mgmt sshd[14488]: pam_unix(sshd:session): session closed for user nagiosxi

[tgriep]

Transferring the file from the command line is different than what is done in XI.
XI uses a PHP function to send the file.
When you run it from the command line, are you using the public key to authenticate?

The strange thing is that there is nothing logged.
Can you run the following as root and post the output so we can view the loglevel?

Code: Select all

grep SB_LOGLEVEL /usr/local/nagiosxi/html/includes/constants.inc.php

What OS and release and version of PHP is the nagios server running?
Can you run the following as root and post the output

Code: Select all

uname -a
cat /etc/*release*
php -v

Also, what OS and release is the remote server running?
What ssh daemon is it running and what is it's version?

[absarcompass]

Yes both command line and web interface use public key authentication.
log level

grep SB_LOGLEVEL /usr/local/nagiosxi/html/includes/constants.inc.php
define('SB_LOGLEVEL', 3);

uname -a
Linux nagiosxi 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

cat /etc/*release*
CentOS release 6.5 (Final)
CentOS release 6.5 (Final)
CentOS release 6.5 (Final)
cpe:/o:centos:linux:6:GA

php -v
PHP 5.3.3 (cli) (built: Mar 22 2017 12:27:09)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies


remote server in Gentoo
4.19.72-gentoo
Gentoo Base System release 2.6

OpenSSH
PHP version is PHP 7.3.9 which is definitely higher than nagios server