[Xymon] 3 issues on new build of 4.3.21 on CentOS 6

[Root, Paul T]

Thanks, I'll give these a try.

-----Original Message-----
From: J.C. Cleaver [mailto:cleaver at terabithia.org]
Sent: Wednesday, October 28, 2015 2:36 PM
To: Root, Paul T
Cc: 'xymon'
Subject: Re: [Xymon] 3 issues on new build of 4.3.21 on CentOS 6

On Wed, October 28, 2015 9:25 am, Root, Paul T wrote:
> Hi all,
>                 I'm building the latest xymon into my own RPM, and on
> CentOS 6. The client works fine, but I have some issues
> with the server.
>
>                 There are a lot of variables, that may be influencing my
> issues. My current environment is RHEL 5 and CentOS 5. But
> I want to get more up to date. Building an RPM for 4.3.21
> on CentOS 5 proved impossible too much work for too little
> benefit because of rrdtools newer versions not compiling
> on CentOS5 and such. Thus the move to newer OS.
>
>                 I'm also trying to use selinux. I'd always had it off or
> in permissive before, because I didn't want to deal with
> it. I'm making the effort now. We'll see how that goes.
>
>                 So sorry for the roll up. Here are the issues:
>
>
> 1)      Disabled tests do not have the blue icon. The non-green page is
> showing the tests that are red or yellow. But if you click on the test,
> the page displays properly, blue background and the disable message is
> there. Also on the main pages, the icon remains red or yellow.

Hmm. This speaks to an issue with permissions for xymongen (unless you're
using static HTML page generation for the status pages themselves). IIRC
SELinux will require privs for altering/removing the files in the layout
distinctly from the initial write. This is especially true if the
timestamp of the gen'd pages isn't updating.


> 2)      Some pages, notably on the new server, I get "Status not
> available" on a number of tests. They range from my own scripts to
> xymonnet. Other tests do work, like the client built in ones.

That's strange. There really shouldn't be any distinction from an SELinux
perspective between the various kinds of tests. You will need to enable
CGIs to make port connections, but that would lead to failure to pick up
any svcstatus at all.


> 3)      Cleared tests aren't clearing. This may well be the same issue as
> disable tests. I have a couple of tests that were red, but came green. But
> the page icon remains red.

Could be the same issue.



SELinux was pretty tricky to get up and running at first. The policy files
in the Terabithia RPMs are below, which *should* work when combined with
the directory contexts indicated, modified as needed for your install
layout.

Using xymoncmd and alterations to the initscript were somewhat tied in
with this also, but some of the details escape me slightly there, to be
honest. It was quite a while ago...

HTH,
-jc



 /usr/sbin/semanage fcontext -a -t initrc_var_run_t '/var/run/xymon(/.*)?'
 /usr/sbin/semanage fcontext -a -t httpd_cache_t '/var/cache/xymon(/.*)?'
 /usr/sbin/semanage fcontext -a -t httpd_sys_script_exec_t
'/usr/share/xymon/cgi-bin(/.*)?'
 /usr/sbin/semanage fcontext -a -t httpd_sys_script_exec_t
'/usr/share/xymon/cgi-secure(/.*)?'
 /usr/sbin/semanage fcontext -a -t httpd_sys_script_exec_t
'/usr/libexec/xymon/cgiwrap'
 /usr/sbin/semanage fcontext -a -t httpd_sys_content_t '/var/lib/xymon(/.*)?'
 /usr/sbin/semanage fcontext -a -t tmp_t '/var/lib/xymon/tmp(/.*)?'

/sbin/restorecon -R /usr/libexec/xymon/cgiwrap /usr/share/xymon/cgi-*
/var/cache/xymon /var/run/xymon /var/lib/xymon /var/lib/xymon/tmp

for selinuxvariant in targeted strict; do
   /usr/sbin/semodule -s ${selinuxvariant} -i
/usr/share/selinux/${selinuxvariant}/xymon.pp
   /usr/sbin/semodule -s ${selinuxvariant} -i
/usr/share/selinux/${selinuxvariant}/xymon-client.pp
done

/usr/sbin/setsebool -P httpd_can_network_connect on
This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.