Thanks.<br><br>I tried that and started getting a lot of refused messages referencing the monitored systems. <br>I forgot to mention that this is release 4.2.3. If it is different in 4.3.x then I will have to wait a couple of months.<br>
<br> I see:<br><br>"... or if they are sent from the IP-address of<br>
the host that the updates pertains to (this is to allow Xymon clients<br>
to send in their own status updates, without having to list all<br>
clients here)<br><br>This seems to say that any value in --status-senders triggers this behavior (which is the way I interpreted it), but apparently that is not the case. At least not in 4.2.3. <br><br>Anything I'm missing? If there is some other value I need in there, like a network mask for all the networks all of my xymon clients are on (hundreds probably, I don't know), I don't think it will work for me.<br>
<br>Thanks,<br>Steve<br><br><div class="gmail_quote">On Wed, Dec 5, 2012 at 12:34 PM, <span dir="ltr"><<a href="mailto:cleaver@terabithia.org" target="_blank">cleaver@terabithia.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">> I have a customer who is concerned that anyone could send data messages to<br>
> the xymon server with one of his host names and Xymon would accept it as<br>
> real thus potentially masking an attack.<br>
><br>
> Note that this is in a university environment, so even if data can come<br>
> only from campus addresses we might not necessarily trust the data.<br>
><br>
> Is there a way to get Xymon to check the IP address on incoming data<br>
> packets to verify that it is coming from the host it claims to be?<br>
><br>
<br>
</div></div>--status-senders is the option you'd want to look into (though I've never<br>
actually used it myself); by default Xymon accepts reports from everything<br>
about everything (although it does record the source IP, for later<br>
investigation). This is key when you have -say- a network poller returning<br>
information about the http test for your <a href="http://www.example.com" target="_blank">www.example.com</a> host.<br>
<br>
Regards,<br>
-jc<br>
<br>
<br>
<br>
=== man xymond snippet below ===<br>
<br>
<br>
--status-senders=IP[/MASK][,IP/MASK]<br>
Controls which hosts may send "status", "combo", "config" and "query"<br>
commands to xymond.<br>
<br>
By default, any host can send status-updates. If this option is used,<br>
then status-updates are accepted only if they are sent by one of the<br>
IP-adresses listed here, or if they are sent from the IP-address of<br>
the host that the updates pertains to (this is to allow Xymon clients<br>
to send in their own status updates, without having to list all<br>
clients here). So typically you will need to list your servers running<br>
network tests here.<br>
<br>
The format of this option is a list of IP-adresses, optionally with a<br>
network mask in the form of the number of bits. E.g. if you want to<br>
accept status-updates from the host 172.16.10.2, you would use<br>
<br>
--status-senders=172.16.10.2<br>
whereas if you want to accept status updates from both 172.16.10.2 and<br>
from all of the hosts on the 10.0.2.* network (a 24-bit IP network),<br>
you would use<br>
<br>
--status-senders=172.16.10.2,<a href="http://10.0.2.0/24" target="_blank">10.0.2.0/24</a><br>
<br>
</blockquote></div><br><br clear="all"><br>-- <br><div><font face="arial, sans-serif"><span style="border-collapse:collapse"><span style="font-size:13px;background-color:rgb(255,255,255)">If they give you ruled paper, write the other way. -Juan Ramon Jimenez, poet, Nobel Prize in literature (1881-1958) </span><br>
</span></font><br>I prayed for freedom for twenty years, but received no answer until I
prayed with my legs. -Frederick Douglass, Former slave, abolitionist,
editor, and orator (1817-1895)
<br></div><br>