Nagios xi exploit

This support forum board is for support questions relating to Nagios xi, our flagship commercial network monitoring solution.
dchurch
Posts: 858
Joined: Wed Oct 07, 2020 12:46 pm
Location: Yo mama

Re: Nagios xi exploit

Post by dchurch »

None of those code snippets or logs indicate any attacks are going on.
MarkCampbell wrote:Does anyone have a checksum list for all of the files bundled in the nagiosxi 5.8.1 release? I'd like to compare mine to them, find any that might be different.
Depending on how you installed Nagios xi, it might be different. If you installed via yum install nagiosxi you can simply ask yum to reinstall Nagios xi from the package:

Code: Select all

yum reinstall nagiosxi
If you didn't get an 8% raise over the course of the pandemic, you took a pay cut.

Discussion of wages is protected speech under the National Labor Relations Act, and no employer can tell you you can't disclose your pay with your fellow employees.
MarkCampbell
Posts: 20
Joined: Tue Oct 16, 2018 4:29 pm

Re: Nagios xi exploit

Post by MarkCampbell »

I would have preferred to do it via yum, but in following the installation guide, I had to build it out with the tarball. Can I download the x-5.8.1.tar.gz and reinstall with the install script that way? Would that be safe?
dchurch
Posts: 858
Joined: Wed Oct 07, 2020 12:46 pm
Location: Yo mama

Re: Nagios xi exploit

Post by dchurch »

Unfortunately installing nagios xi on top of an existing xi installation isn't recommended.
Important: Nagios Enterprises highly recommends and will only support installing Nagios xi on a newly
installed, "clean" system (a bare minimal install with nothing else installed or configured).
Attempting to install Nagios xi on a pre-existing system with other applications already installed can cause
the Nagios xi installation process to fail, critical system components and settings (e.g. database servers) to
be modified in a way that negatively affects other applications, and previously installed applications to be
automatically upgraded or removed. While installing xi on a system with other applications is possible, it is
not recommended due to the possible interactions and complexity of multiple components that are required
for Nagios xi to function. If you choose to ignore these warnings, you do so at your own risk.
Other Nagios products (Network Analyzer, Log Server and Fusion) should not co-exist on the same server.
-- https://assets.nagios.com/downloads/nag ... -Linux.pdf
If you didn't get an 8% raise over the course of the pandemic, you took a pay cut.

Discussion of wages is protected speech under the National Labor Relations Act, and no employer can tell you you can't disclose your pay with your fellow employees.
MarkCampbell
Posts: 20
Joined: Tue Oct 16, 2018 4:29 pm

Re: Nagios xi exploit

Post by MarkCampbell »

So what are my options then? Can I switch over to yum after it's already been installed via tarball?
dchurch
Posts: 858
Joined: Wed Oct 07, 2020 12:46 pm
Location: Yo mama

Re: Nagios xi exploit

Post by dchurch »

What version of Nagios xi are you running?

The recommended process is to create a backup of xi, create a new VM/server, yum install xi on that machine, and restore the backup to the new machine.

After setting up a new CentOS machine, set up the Nagios repo using the instructions here.

Then the import process:
If you didn't get an 8% raise over the course of the pandemic, you took a pay cut.

Discussion of wages is protected speech under the National Labor Relations Act, and no employer can tell you you can't disclose your pay with your fellow employees.