<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:3.0cm 2.0cm 3.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText"><a name="_MailEndCompose">Hello John<o:p></o:p></a></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">Please let me know if I should send to mailinglist. This my first call for help.<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">I'm having trouble with enadis. I'm not sure if it's completely the same as you describe here but it looks similar.<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">We have installed xymon-4.3.28-1.el7.x86_64.rpm (terabithia.org) If I need to play with changing cgi.c and recompiling will make install reinstall without need for changes?<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">When we try to run enadis from either info og from Enable/disable menu we get the following error in xymon-error.log<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">[Tue Mar 20 16:54:05.786245 2018] [cgi:error] [pid 9121] [client 172.28.56.243:60696] AH01215: 2018-03-20 16:54:05.786123 Enadis POST that is not coming from self or svcstatus
(referer=https://xxxyyy.dk/xymon-seccgi/enadis.sh). Ignoring., referer: https://</span><span lang="EN-US">
</span></span><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">xxxyyy.dk/xymon-seccgi/enadis.sh<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">I have tried to set XYMON_NOCSPHEADER="true" in either xymonserver.cfg or /etc/xymon/cgioptions.cfg but is doesn’t seem to make a difference<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">We have a httpd proxy in front were I had csp configured – but have tried to uncomment it and still gets the same error.<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">I have testet with Firefox 59.0 and Chrome (</span></span><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#757575">64.0.3282.186</span></span><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">)
where javascript doesn’t work with “Enable/disable menu” – and iexplorer (11.0.51)<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">(if I want to test directly without httpd/proxy I only have iexplorer v8)<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">(httpd/proxy )<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always set X-Frame-Options "SAMEORIGIN"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always set X-Content-Type-Options "nosniff"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always unset Content-Security-Policy<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always set Content-Security-Policy "xdwsscript-src 'self'"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always set X-XSS-Protection "1; mode=block"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header always set Referrer-Policy "no-referrer"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header unset Server<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #Header set X-Frame-Options "DENY"<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> SSLProxyEngine on<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> #ProxyPreserveHost On<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ServerName xxxyy.dk<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> SSLProxyVerify none<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> SSLProxyCheckPeerCN off<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> SSLProxyCheckPeerName off<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> SSLProxyCheckPeerExpire on<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ProxyPass /xymon https://xxxyyy.dk:443/xymon<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ProxyPassReverse /xymon https://xxx.xxx.xxx.xxx:443/xymon<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ProxyPass /xymon-cgi https://xxx.xxx.xxx.xxx:443/xymon-cgi<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ProxyPassReverse /xymon-cgi https://xxx.xxx.xxx.xxx:443/xymon-cgi<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ProxyPass /xymon-seccgi/ https://xxx.xxx.xxx.xxx:443/xymon-seccgi/<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US" style="color:#203864;mso-style-textfill-fill-color:#203864;mso-style-textfill-fill-alpha:100.0%"> ProxyPassReverse /xymon-seccgi/ https://xxx.xxx.xxx.xxx:443/xymon-seccgi/<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose">RENÉ HOIELT HANSEN<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose">Senior Prof. Middleware System Engineer (EA&I)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose">DXC Technology<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose">Retortvej 8, DK - 2500 Valby, Denmark, I-1-356<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose">Mobile: +45 2923 5807<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose">Email: rhansen21@dxc.com<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US">Leave information in advance: : Out of office both days included<o:p></o:p></span></span></p>
<p class="MsoPlainText"><span style="mso-bookmark:_MailEndCompose"><span lang="EN-US"><o:p> </o:p></span></span></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<p class="MsoPlainText"><span lang="EN-US" style="mso-fareast-language:DA">-----Original Message-----<br>
From: Xymon [mailto:xymon-bounces@xymon.com] On Behalf Of John Thurston<br>
Sent: 9. november 2017 20:26<br>
To: xymon@xymon.com<br>
Subject: Re: [Xymon] Problems with Content Security Policy in Safari, Chrome, and IE</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 11/8/2017 7:40 PM, Jonathan Trott wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Xymon 4.3.28-1.el7.terabithia with Safari 11 on High Sierra and Safari on iOS 11.<o:p></o:p></p>
<p class="MsoPlainText">> Problem occurs on the trends page.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <a href="https://xymon.domain.com.au/xymon-cgi/svcstatus.sh?HOST=host.com.au&SE">
<span style="color:windowtext;text-decoration:none">https://xymon.domain.com.au/xymon-cgi/svcstatus.sh?HOST=host.com.au&SE</span></a><o:p></o:p></p>
<p class="MsoPlainText">> RVICE=trends<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> If you click on any of the time based buttons, 48hrs for example, the requested page doesn't load.<o:p></o:p></p>
<p class="MsoPlainText">> Safari on macOS look like it's loading a page but doesn't get anywhere.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'm able to duplicate this failure when building 4.3.28 from source on Solaris 10. It looks to me like the fix is to add "allow-same-origin" in lib/cgi.c to line 278<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> else if (strncmp(str, "svcstatus-trends", 16) == 0) csppol =
<o:p></o:p></p>
<p class="MsoPlainText">> strdup("script-src 'self' 'unsafe-inline'; connect-src 'self';
<o:p></o:p></p>
<p class="MsoPlainText">> form-action 'self'; sandbox allow-forms allow-scripts <o:p>
</o:p></p>
<p class="MsoPlainText">> allow-same-origin;");<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">How many other pages are broken in a similar manner? I'm not a big user of Google Chrome, so depend on my customers to report these breaks to me.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Each of the following pages gets a specif CSP:<o:p></o:p></p>
<p class="MsoPlainText">> "enadis"<o:p></o:p></p>
<p class="MsoPlainText">> "useradm"<o:p></o:p></p>
<p class="MsoPlainText">> "chpasswd"<o:p></o:p></p>
<p class="MsoPlainText">> "ackinfo"<o:p></o:p></p>
<p class="MsoPlainText">> "acknowledge"<o:p></o:p></p>
<p class="MsoPlainText">> "criticaleditor"<o:p></o:p></p>
<p class="MsoPlainText">> "svcstatus-trends<o:p></o:p></p>
<p class="MsoPlainText">> "svcstatus-info"<o:p></o:p></p>
<p class="MsoPlainText">> "svcstatus"<o:p></o:p></p>
<p class="MsoPlainText">> "historylog"<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">svcstatus-info and -trends are special cases of the general purpose svcstatus case.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I've done spot-checks of these other pages with my copy of Chrome and they seem to behave correctly. Anyone else wanna check their browser/OS combinations and report back?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText"> Do things because you should, not just because you can.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">John Thurston 907-465-8591<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:John.Thurston@alaska.gov"><span style="color:windowtext;text-decoration:none">John.Thurston@alaska.gov</span></a><o:p></o:p></p>
<p class="MsoPlainText">Department of Administration<o:p></o:p></p>
<p class="MsoPlainText">State of Alaska<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Xymon mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Xymon@xymon.com"><span style="color:windowtext;text-decoration:none">Xymon@xymon.com</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://lists.xymon.com/mailman/listinfo/xymon"><span style="color:windowtext;text-decoration:none">http://lists.xymon.com/mailman/listinfo/xymon</span></a><o:p></o:p></p>
</div>
<br>
CSC Danmark A/S - Registered Office: Retortvej 8, DK - 2500 Valby, Denmark - Registered in Denmark No: 15231599.
<br>
DXC Technology Company -- This message is transmitted to you by or on behalf of DXC Technology Company or one of its affiliates. It is intended exclusively for the addressee. The substance of this message, along with any attachments, may contain proprietary,
confidential or privileged information or information that is otherwise legally exempt from disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient of this message, you are not authorized to
read, print, retain, copy or disseminate any part of this message. If you have received this message in error, please destroy and delete all copies and notify the sender by return e-mail. Regardless of content, this e-mail shall not operate to bind DXC Technology
Company or any of its affiliates to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.
</body>
</html>