Nagios Support Forum

Hi folks,

I am turning our old "dev" instance in to our "new" prod instance, starting from scratch (for reasons, ask if interested).

"old" is running XI 5.5.10,
"new" is running XI 5.8.6,
both are running on
CentOS 7.9; I can't upload a profile.zip because I can't login (or is there another way?).

I added "Active Directory Integration" and "LDAP Authentication" components to "new" (which are already working on "old"), and now I cannot login, neither with a Local nor AD account -- I just get a blank page:
https://campusmon2v4.techservices.illinois.edu/nagiosxi

...I tried rebooting (it didn't help)...

...however, I can login as nagiosadmin here (but it doesn't help much):
https://campusmon2v4.techservices.illinois.edu/nagios

I have not been able to find anything relevant in log files w/re to...
https://assets.nagios.com/downloads/nag ... ptions.pdf

I have searched the form and found a couple of similar items, but nothing in these posts fixes my problem,

1. Need assistance with AD/LDAP integration...
https://support.nagios.com/forum/viewto ... 16&t=56212

2. no longer able to import users from LDAP/AD
https://support.nagios.com/forum/viewto ... 16&t=56138

Is there a way I can troubleshoot these components, see what they think the error is? Any other suggestions?

Please let me know if you have any questions,
Rob

Hello @murdock

Thanks for reaching out, understand that you are unable to login to the 'gui' and get a blank page.

Want to check to see if Selinux is enabled and if so please go ahead and disable it:
Verify that you are bringing up a SSL session on https://yournagiosxiaddresshere/nagiosxi

Let's focus on getting into your Nagios XI that you are spinning up for the time being and access via the default local 'nagiosadmin' admin. Once logged in we will be able to iron out the LDAP configs at that time.

If you need to update the 'nagiosadmin' password we have a script available for that:
You can grab the System Profile:
Then send the resulting /usr/local/nagiosxi/var/components/profile.zip​ file via Private Message.

Thanks,
Perry

Hi Perry,

I checked, SELinux was already disabled:

sestatus
SELinux status: disabled

Yes, I am definitely using HTTP:
https://{My FQDN}/

Logging in as nagiosadmin (a Local account) yields a blank page.

I do not need to reset nagiosadmin's password, I already know what it is.

Please find the requested profile.zip attached.

Thank you,
Perry

Hello @murdock

Thanks for following up and sending the System Profile.

We see that the handshake is held up by cert issue "certificate configured for caXXXX.XXX.XXX:443 does NOT include an ID which matches the server name".

Let's go in with localhost using a proxy so we can bypass the "URL validation"

1) Make sure you have created SSH tunnel and it is working by using:

• ssh <yourusername>@<yourhostnameoripaddress> -D 7070

2) Start Mozilla Firefox.

3) From the main menu click on: Tools >> Options

4) Click on the “Advanced” icon

5) Click on the “Network” tab

6) Under the “Connection” heading and “Configure how Firefox connects to the Internet”, click “Settings”

7) In the “Connection Settings” dialog box that appears, click on the “Manual proxy configuration” radio button

8) In the “Socks Host” textbox, enter 127.0.0.1
In the “Port” textbox, enter 7070
Make sure “SOCKS v5″ is selected

9) Click “OK” to close the “Connection Settings” dialog box.

10) Click “OK” to close the “Options” dialog box

Now go to firefox on your device and enter the following into the URL address:

• HTTP://localhost/nagiosxi

or

• HTTP://<yournagiosxiipaddresshere>/nagiosxi

Accept the warnings and you are in, and will be able to fix the issues in the web console 'ui'. If you are running into issues please check with the 'var/log/httpd/' by tail -F /var/log/httpd/*.log

Thanks,
Perry

Hi Perry,

Thank you for getting back to me.

I followed your instructions to the letter, but none of it worked.

I am very familiar with SSH and setting up tunnels, but I am not familiar with the approach you are proposing here; do you have more detailed instructions that discuss why / what is being accomplished?

I note my Firefox (version 92.0, released Sep 7, 2021 -- 9 days ago) menus are very different from yours (noted inline), suggesting that we may be running very different versions... perhaps things don't work the way they used to?

Below my comments are inline after "---" lines, I don't see any convenient way to hilite or set apart what I type...

Let me know if you want me to attach any screencaps.

Please let me know what else I can try?
Rob

...
We see that the handshake is held up by cert issue "certificate configured for caXXXX.XXX.XXX:443 does NOT include an ID which matches the server name".
--
The error being discussed has not occurred since I fixed it a couple days ago.

Let's go in with localhost using a proxy so we can bypass the "URL validation"

1) Make sure you have created SSH tunnel and it is working by using:

ssh <yourusername>@<yourhostnameoripaddress> -D 7070


2) Start Mozilla Firefox.
---
92.0 (64-bit)

3) From the main menu click on: Tools >> Options
4) Click on the “Advanced” icon
5) Click on the “Network” tab
6) Under the “Connection” heading and “Configure how Firefox connects to the Internet”, click “Settings”
7) In the “Connection Settings” dialog box that appears, click on the “Manual proxy configuration” radio button
---
(menu) > Settings >
General >
Network Settings >
Settings >
(*) Use system proxy settings # before
(*) Manual proxy configuration # after

8) In the “Socks Host” textbox, enter 127.0.0.1
In the “Port” textbox, enter 7070
Make sure “SOCKS v5″ is selected

9) Click “OK” to close the “Connection Settings” dialog box.

10) Click “OK” to close the “Options” dialog box
---
Close tab.

Now go to firefox on your device and enter the following into the URL address:

HTTP://localhost/nagiosxi
---
Not found

or

HTTP://{my FQDN}/nagiosxi
---
Login token was expired, please try again.

Accept the warnings and you are in, and will be able to fix the issues in the web console 'ui'. If you are running into issues please check with the 'var/log/httpd/' by tail -F /var/log/httpd/*.log

Thanks,
Perry

Hello @murdock

Let's get the httpd logs on that:
Please send over the results via PM.

Thanks,
Perry

"results.txt" uploaded as requested (2nd try).

Hello @murdock

Thanks for taking the time to upload the results, we see HTTP 304 not modified status code means that the website you're requesting hasn't been updated since the last time accessed it. Typically, your browser will cache.

Want to have you access the NagiosXI web console in private mode or incognito mode to verify cached browser previous visits are not causing the issue. If you are running into issues; please try accessing the web console directly from IP Address from the server. Several landing pages to try: http://youripaddress/nagiosxi http://youripaddress/nagios http://youripaddress/index.php.

Please use the 'nagiosadmin' local account credentials to gain access.

Please let me know the results,
Perry

Hi Perry,

I tried logging in as nagiosadmin (it is a Local account) at the 3 URLs you gave me, clearing the cache before each one.

The 1st & 3rd yielded the same blank page; the 2nd only took me to Core, where one really can't do anything.

Here are the details:

# cleared cache
http://myipaddress/nagiosxi
http://myipaddress/nagiosxi/login.php?r ... f&noauth=1
# blank page

# cleared cache
http://myipaddress/nagios
http://myipaddress/nagios/
# this works, but it is Core and can't change anything in the web ui

# cleared cache
http://myipaddress/index.php
http://myipaddress/nagiosxi/login.php?r ... f&noauth=1
# blank page

Here is how I am clearing my cache:

(menu) > Settings > Privacy & Security > Cookies and Site Data > Clear Data >
[ ] Cookies and Site Data
[/] Cached Web Content
Clear >

Can you suggest something else I can try?

AD integration is absolutely essential to us, and it worked reliably through XI 5.5.10.

XI 5.8.4 was working fine until I added AD integration.

I noted in my original request that there were a couple of other tickets (from other people, not me / my University) that sounded like they were having similar problems -- a bug possibly.

Thank you for looking at this,
Rob

Hello @murdock,

Want to take a look at the login and the AD configuration to examine both issues in tandem.

To start; want to have you look at the browser Dev Tools > in Network Tab > view the results as you log into the Nagios XI web console. You are looking for fail or rendering issues.

Next; we will GET system api user and authserver info:
Example results:

{
"records": 1,
"authservers": [
{
"id": "6148f11f754dd",
"enabled": 1,
"conn_method": "ldap",
"ad_account_suffix": "",
"ad_domain_controllers": "",
"base_dn": "DC=nagios,DC=com",
"security_level": "none",
"ldap_port": "398",
"ldap_host": "ldap.nagios.com"

And
Example results:

{
"records": 1,
"users": [

{
"user_id": "1",
"username": "nagiosadmin",
"name": "Nagios Administrator",
"email": "root@localhost",
"enabled": "1"

Please let me know how things look.

Thanks,
Perry