Bug 56580 - Nagios check "check_ldap" removed -y password file argument
Summary: Nagios check "check_ldap" removed -y password file argument
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Monitoring (Prometheus or Nagios)
Version: UCS 5.1
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.1
Assignee: Florian Best
QA Contact: Philipp Hahn
URL:
Keywords:
Depends on:
Blocks: 55829
  Show dependency treegraph
 
Reported: 2023-09-13 15:22 CEST by Florian Best
Modified: 2025-02-05 15:08 CET (History)
1 user (show)

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2023-09-13 15:22:47 CEST
The nagios check "check_ldap" provided the "-y" password_file option, which has been removed upstream.
Instead a environment variable LDAP_PASSWORD can be used.

We have to adjust /usr/lib/nagios/plugins/check_univention_ldap so that the environment variable is used instead.
Comment 2 Florian Best univentionstaff 2023-09-20 14:46:43 CEST
 22_nagios/07suidwrapper shows the error (already in UCS 5.1):
[2023-09-20 02:45:48.765303] /usr/lib/nagios/plugins/check_univention_ldap_suidwrapper
(2023-09-20 02:45:49.076824) /usr/lib/nagios/plugins/check_ldap: invalid option -- 'y'
[2023-09-20 02:45:49.076948] Usage:
[2023-09-20 02:45:49.076958]  check_ldap -H <host> -b <base_dn> [-p <port>] [-a <attr>] [-D <binddn>]
[2023-09-20 02:45:49.076962]        [-P <password>] [-w <warn_time>] [-c <crit_time>] [-t timeout]
[2023-09-20 02:45:49.076967]        [-2|-3] [-4|-6]
[2023-09-20 02:45:49.077905] /usr/lib/nagios/plugins/check_univention_nscd_suidwrapper
Comment 3 Florian Best univentionstaff 2023-10-05 17:46:18 CEST
Actually "-y" was added by a patch of ourself to check_ldap.
Nevertheless since UCS 5.2 the LDAP_PASSWORD environment is available, so we prefer this.
In UCS 5.1 we still use the patch with "-y password".
Comment 4 Philipp Hahn univentionstaff 2023-10-09 12:03:34 CEST
[preview/5.2-0] d4d0ab0f72 fix(nagios): nagios check_ldap -y has been replaced with LDAP_PASSWORD environment variable
 monitoring/univention-nagios/usr/lib/nagios/plugins/check_univention_ldap | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

debian/changelog:
  * Bug #56580: Pass LDAP credentials via environment variable

doc/changelog/index.rst
  * LDAP credentials are now passes via the environment variable :envvar:`LDAP_PASSWORD` instead of using the deprecated option ``-y`` (:uv:bug:`56580`).
Comment 5 Florian Best univentionstaff 2024-03-08 10:46:36 CET
univention-nagios (15.0.2)
b46f9eda1064 | fix(nagios): nagios check_ldap -y has been replaced with LDAP_PASSWORD environment variable