[Xymon] PSclient sending from intranet
Kris Springer
kspringer at innovateteam.com
Thu Nov 8 17:12:24 CET 2018
Thanks for the reply Zak. After my brain chewed on the problem for a
day I woke up at 2am and was able to figure it out. I did some Googling
regarding Apache and CGI scripts and all I needed to do was to edit the
default cgi-bin path in one of apache's conf files and restart Apache.
/etc/apache2/conf-enabled/serve-cgi-bin.conf defines /usr/lib/cgi-bin/
which is an empty directory on my server. I pointed it to my
/xymon/cgi-bin/ directory where the scripts live and everything suddenly
worked. I'm writing up my own how-to now. This feature is great for
sending remote system data over 443. I'll be using it a lot moving
forward. Thanks for the PSclient!
Kris Springer
On 11/8/18 2:25 AM, Beck, Zak wrote:
>
> Hi Kris
>
> Yes, I have it working. As you say, the URL needs to include the full
> path to xymoncgimsg.cgi.
>
> All xymoncgimsg.cgi does as far as I can tell is relay the message(s)
> received over HTTPS via TCP to localhost port 1984 (which is what the
> man page says as well). So you need that listening (which by default
> it will be).
>
> I don’t recall making any other config changes to make this work
> (aside from Apache etc to sort out the authentication).
>
> I suspect the time out is waiting for the response – when you submit
> data to Xymon, you normally get the client local config back from the
> server. This comes back via the HTTPS response. There is a timeout
> setting – sorry I forgot to document it in the table in the Word doc –
> serverHttpTimeoutMs – which defaults to 100000 milliseconds – i.e. 100
> seconds. This is the time it waits for the response from the server.
> 100 seconds is pretty generous unless you’re traversing particularly
> slow VPNs or saturated connections. You can override this in the
> xymonclient_config.xml file.
>
> I’m assuming you’re getting this message:
>
> " Connecting to $($url), body length $($body.Length), timeout
> $($script:XymonSettings.serverHttpTimeoutMs)ms"
>
> And then this one (with a timeout exception):
>
> " Exception connecting to $($url):`n$($_)"
>
> And not either of these:
>
> " FAILED, HTTP response code: $($response.StatusCode)
> ($statusCode)"
>
> or
>
> " Received $($output.Length) bytes from server"
>
> Zak
>
> *From:*Xymon <xymon-bounces at xymon.com> *On Behalf Of
> *kspringer at innovateteam.com
> *Sent:* Thursday, 8 November 2018 08:51
> *To:* Xymon MailingList <xymon at xymon.com>
> *Subject:* [External] Re: [Xymon] PSclient sending from intranet
>
> Anyone have xymoncgimsg.cgi functioning on their server and
> successfully receiving PSclient data over HTTPS? The documentation
> for this is vague and doesn't specify how to make it work. Any
> specifics would be greatly appreciated.
>
> Thanks,
> Kris Springer
>
>
> -----Original Message-----
> From: Timothy Williams <tlwilliams4 at vcu.edu <mailto:tlwilliams4 at vcu.edu>>
> To: kspringer at innovateteam.com <mailto:kspringer at innovateteam.com>
> Cc: xymon at xymon.com <mailto:xymon at xymon.com>
> Sent: Tue, 06 Nov 2018 2:22 PM
> Subject: Re: [Xymon] PSclient sending from intranet
>
> Alas, I am unable to help further, as my InfoSec allows port 1984, and
> not 80 or 443 to Xymon, so I don't have http running.
>
> Tim
>
> On Tue, Nov 6, 2018 at 3:29 PM Kris Springer
> <kspringer at innovateteam.com <mailto:kspringer at innovateteam.com>> wrote:
>
> I've configured one of my PSclients to test this HTTPS
> functionality, and it indeed does try to send data over port 443.
> But the client logs say that my Xymon server is timing out. Is
> there a specific server url path that I need to be using? The
> documentation doesn't give any example.
>
>
> Kris Springer
>
>
>
>
>
> On 11/6/18 7:54 AM, Timothy Williams wrote:
>
> The Powershell client can connect to the Xymon server using
> TCP port 1984 as default, but can also connect using HTTP or
> HTTPS with/without user/password. You likely have port 80 or
> 443 open. Here are Word doc details:
>
> HTTP is an alternate method. It can be used if you have
> xymoncgimsg.cgi running on the web server on your Xymon server
> – see
> https://www.xymon.com/help/manpages/man8/xymoncgimsg.cgi.8.html
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.xymon.com_help_manpages_man8_xymoncgimsg.cgi.8.html&d=DwMGaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=S-aLwpx-PHBTBMIG_c2JczRC0SfuZCmsiH9Iams25FI&m=-OwMT0n637myRsiGrh2Ey_FyOjBckX9cnzeXB9ID_dw&s=nwg-TdqZw8dbasxkybIMrt8HKpuV-U4Z2HpC5Rbr1BM&e=>.
> The web server running the CGI can be configured for SSL (i.e.
> HTTPS) and / or authentication – XymonPSClient supports basic
> authentication and SSL. If you require authentication, the
> <serverHttpUsername> and <serverHttpPassword> elements should
> be configured.
>
> If you are using HTTP and transmitting over unsecure networks
> (e.g. the internet), it is strongly recommended to enable
> SSL, authentication and disallow HTTP connections.
>
> ServerHttpPassword encryption
>
> If <serverHttpPassword> is set, the Xymon client will encrypt
> the password if it is not encrypted and remove the plain text
> password from the configuration file, overwriting with the
> encrypted password. The Xymon client will prefix the encrypted
> password with ‘{SecureString}’, so it is easy to tell if the
> client has attempted to encrypt the password or not.
>
> This is done using the .NET SecureString functions, which
> means that the encryption is unique to the server and user.
> This means that once the password has been encrypted, you
> cannot use the same xymonclient_config.xml on another server.
> It also means that if you have been testing by running
> XymonPSClient from a command prompt, and this encrypts the
> password, when you run XymonPSClient as a service it will not
> be able to decrypt the password unless the service is running
> as the same user.
>
> In both scenarios, replacing the encrypted password with the
> plain text password and re-starting Xymon will cause the
> password to be re-encypted.
>
> Tim Williams
>
> On Tue, Nov 6, 2018 at 9:37 AM Rolf Schrittenlocher
> <schritte at ub.uni-frankfurt.de
> <mailto:schritte at ub.uni-frankfurt.de>> wrote:
>
> any possibility to send something from intranet to the
> world outside?
> creating webpage, send by sftp or scp? This could be done
> by cron and
> xymon could analyze this data then.
> > Anyone have an idea about how to collect client server
> stats using the
> > Powershell client on machines that are on an intranet
> that blocks port
> > 1984, and send it out to our external xymon server
> located in a
> > different part of the country? The intranet network
> doesn't want to
> > open any additional ports to allow the traffic out.
> >
>
> --
> Mit freundlichen Grüßen
> Rolf Schrittenlocher
>
> Lokales Bibliothekssystem Frankfurt
> Bockenheimer Landstr. 134-138, 60325 Frankfurt
> Tel LBS: (49) 69 - 798 28830
> Tel persönlich: (49) 69 - 798 28908
> LBS: lbs at ub.uni-frankfurt.de <mailto:lbs at ub.uni-frankfurt.de>
> Persönlich: schritte at ub.uni-frankfurt.de
> <mailto:schritte at ub.uni-frankfurt.de>
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com <mailto:Xymon at xymon.com>
> http://lists.xymon.com/mailman/listinfo/xymon
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwMGaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=S-aLwpx-PHBTBMIG_c2JczRC0SfuZCmsiH9Iams25FI&m=-OwMT0n637myRsiGrh2Ey_FyOjBckX9cnzeXB9ID_dw&s=F_2sRqz669yemQ4GbrwkTlh6D0HtrNX1wqu7RvAN1WE&e=>
>
>
> ------------------------------------------------------------------------
>
> This message is for the designated recipient only and may contain
> privileged, proprietary, or otherwise confidential information. If you
> have received it in error, please notify the sender immediately and
> delete the original. Any other use of the e-mail by you is prohibited.
> Where allowed by local law, electronic communications with Accenture
> and its affiliates, including e-mail and instant messaging (including
> content), may be scanned by our systems for the purposes of
> information security and assessment of internal compliance with
> Accenture policy. Your privacy is important to us. Accenture uses your
> personal data only in compliance with data protection laws. For
> further information on how Accenture processes your personal data,
> please see our privacy statement at
> https://www.accenture.com/us-en/privacy-policy.
> ______________________________________________________________________________________
>
> www.accenture.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20181108/b0c6be54/attachment.html>
More information about the Xymon
mailing list