- observium - lists.observium.org

Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert
by Tony Guadagno 17 Feb '22

17 Feb '22

Adam, I have the cert for my AD server, as I said, I am pretty familiar with this process as I use ldap often for application authentication….what I am not very familiar with is php. Other apps have config options to set the paths for the certs etc. What I need help with is where (specifically) to put the config so that Observium will use it. I have the certs, I just need the syntax You mentioned putenv…where would I put that? It must be somewhere in Observium? Thanks for your help Tony From: Adam Armstrong via observium<mailto:observium@observium.org> Sent: Wednesday, February 16, 2022 6:42 PM To: 'Observium'<mailto:observium@observium.org> Cc: Adam Armstrong<mailto:adama@observium.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Whoops: putenv(‘LDAPTLS_CACERT=/path/to/rootca.pem’); Note that this seems to want the CA’s cert, not your server’s cert. Our code doesn’t have any consideration for TLS at all as far as I can see, it should all be transparent to Observium if you get PHP/LDAP into the situation where it accepts your cert. Adam. From: observium <observium-bounces(a)observium.org> On Behalf Of Adam Armstrong via observium Sent: 16 February 2022 23:36 To: 'Observium' <observium(a)observium.org> Cc: Adam Armstrong <adama(a)observium.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Presumably you need to extract your certs in the correct format and direct the commands to them. The LDAP connection is done by PHP’s LDAP module. You just need to work out how to do it with PHP’s module. It’s probably that you could override this globally with the php.ini rather than putting it in the config.php, too. There seems to be half a dozen solutions for making this work, which isn’t uncommon with infrequently used PHP features. There’s also this: putenv('/path/to/rootca.pem'); Adam. From: Tony Guadagno <tonyg(a)guadagno.org<mailto:tonyg@guadagno.org>> Sent: 16 February 2022 21:57 To: Observium <observium(a)observium.org<mailto:observium@observium.org>> Cc: Adam Armstrong <adama(a)observium.org<mailto:adama@observium.org>> Subject: RE: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Adam, sorry for being dense, but do I just add these two lines directly (as is) to the config.php? ldap_set_option(null, LDAP_OPT_X_TLS_CACERTDIR, '/path/to'); ldap_set_option(null, LDAP_OPT_X_TLS_CACERTFILE, '/path/to/cert.pem'); I tried this with the paths to my certs and it had no affect. Do I need to wrap those command in some other syntax? thanks Tony From: Adam Armstrong via observium<mailto:observium@observium.org> Sent: Wednesday, February 16, 2022 4:25 PM To: 'Observium'<mailto:observium@observium.org> Cc: Adam Armstrong<mailto:adama@observium.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert https://andreas.heigl.org/2020/01/31/handle-self-signed-certificates-with-p… I’d assume that getting your cert and putting the two ldap_set_option() commands into config.php should suffice. This seems like a better solution that turning off cert verification. Adam. From: observium <observium-bounces(a)observium.org<mailto:observium-bounces@observium.org>> On Behalf Of Tony Guadagno via observium Sent: 16 February 2022 21:03 To: Observium <observium(a)observium.org<mailto:observium@observium.org>>; Brandon Lund <brandon(a)kansas.net<mailto:brandon@kansas.net>> Cc: Tony Guadagno <tonyg(a)guadagno.org<mailto:tonyg@guadagno.org>> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert I made a packet capture on the Observium server trying to login and if you look, you will see that it is indeed a self signed issue. How do I tell Observium to either trust the cert OR ignore the fact that it is self signed?? [cid:image002.png@01D82366.ADE67E70] Tony From: Tony Guadagno via observium<mailto:observium@observium.org> Sent: Wednesday, February 16, 2022 3:27 PM To: Brandon Lund<mailto:brandon@kansas.net>; Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Sorry, I should have been more specific…I already have other apps using ldap with tls hitting the server and they work…so I am confident my AD server is properly configured. I work a lot with ldap and I often find that some apps that integrate with ldap and tls get picky about the cert..thats why I think it might be the fact that I am using a self signed cert (which is common on AD servers). Usually, there is a way to tell the application “ignore the fact that it is self signed, accept it anyway” Tony From: Brandon Lund<mailto:brandon@kansas.net> Sent: Wednesday, February 16, 2022 3:08 PM To: Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: LDAP auth to MS AD with TLS Self Signed Cert looks like you need to enable tls for ad to start listing for ldaps no experience just a quick search. https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl… [Image removed by sender.]<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> Enable Lightweight Directory Access Protocol (LDAP) over Secure Sockets Layer (SSL) - Windows Server | Microsoft Docs<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> docs.microsoft.com Describes how to enable LDAP over SSL with a third-party certification authority. Thanks Brandon Lund KansasNet Internet Services 785-776-1452 From: observium <observium-bounces(a)observium.org<mailto:observium-bounces@observium.org>> on behalf of Tony Guadagno via observium <observium(a)observium.org<mailto:observium@observium.org>> Sent: Wednesday, February 16, 2022 1:49 PM To: Tony Guadagno via observium Cc: Tony Guadagno Subject: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Hi, I have ldap auth working mostly, if I set tls to false, I can authenticate. However, I want to be secure and when I enable tls, I get a debug error that says: Error binding to LDAP server: servername.local: Can’t contact LDAP server I am guessing the issue is the self signed cert that my server is using. My question is…how do I configure Observium to accept self signed certs for ldap? thanks Tony

2 2

Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert
by Tony Guadagno 17 Feb '22

17 Feb '22

Adam, sorry for being dense, but do I just add these two lines directly (as is) to the config.php? ldap_set_option(null, LDAP_OPT_X_TLS_CACERTDIR, '/path/to'); ldap_set_option(null, LDAP_OPT_X_TLS_CACERTFILE, '/path/to/cert.pem'); I tried this with the paths to my certs and it had no affect. Do I need to wrap those command in some other syntax? thanks Tony From: Adam Armstrong via observium<mailto:observium@observium.org> Sent: Wednesday, February 16, 2022 4:25 PM To: 'Observium'<mailto:observium@observium.org> Cc: Adam Armstrong<mailto:adama@observium.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert https://andreas.heigl.org/2020/01/31/handle-self-signed-certificates-with-p… I’d assume that getting your cert and putting the two ldap_set_option() commands into config.php should suffice. This seems like a better solution that turning off cert verification. Adam. From: observium <observium-bounces(a)observium.org> On Behalf Of Tony Guadagno via observium Sent: 16 February 2022 21:03 To: Observium <observium(a)observium.org>; Brandon Lund <brandon(a)kansas.net> Cc: Tony Guadagno <tonyg(a)guadagno.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert I made a packet capture on the Observium server trying to login and if you look, you will see that it is indeed a self signed issue. How do I tell Observium to either trust the cert OR ignore the fact that it is self signed?? [cid:image002.png@01D82356.3DB8A3E0] Tony From: Tony Guadagno via observium<mailto:observium@observium.org> Sent: Wednesday, February 16, 2022 3:27 PM To: Brandon Lund<mailto:brandon@kansas.net>; Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Sorry, I should have been more specific…I already have other apps using ldap with tls hitting the server and they work…so I am confident my AD server is properly configured. I work a lot with ldap and I often find that some apps that integrate with ldap and tls get picky about the cert..thats why I think it might be the fact that I am using a self signed cert (which is common on AD servers). Usually, there is a way to tell the application “ignore the fact that it is self signed, accept it anyway” Tony From: Brandon Lund<mailto:brandon@kansas.net> Sent: Wednesday, February 16, 2022 3:08 PM To: Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: LDAP auth to MS AD with TLS Self Signed Cert looks like you need to enable tls for ad to start listing for ldaps no experience just a quick search. https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl… [Image removed by sender.]<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> Enable Lightweight Directory Access Protocol (LDAP) over Secure Sockets Layer (SSL) - Windows Server | Microsoft Docs<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> docs.microsoft.com Describes how to enable LDAP over SSL with a third-party certification authority. Thanks Brandon Lund KansasNet Internet Services 785-776-1452 From: observium <observium-bounces(a)observium.org> on behalf of Tony Guadagno via observium <observium(a)observium.org> Sent: Wednesday, February 16, 2022 1:49 PM To: Tony Guadagno via observium Cc: Tony Guadagno Subject: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Hi, I have ldap auth working mostly, if I set tls to false, I can authenticate. However, I want to be secure and when I enable tls, I get a debug error that says: Error binding to LDAP server: servername.local: Can’t contact LDAP server I am guessing the issue is the self signed cert that my server is using. My question is…how do I configure Observium to accept self signed certs for ldap? thanks Tony

3 3

Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert
by Tony Guadagno 16 Feb '22

16 Feb '22

I made a packet capture on the Observium server trying to login and if you look, you will see that it is indeed a self signed issue. How do I tell Observium to either trust the cert OR ignore the fact that it is self signed?? [cid:image003.png@01D8234E.A5CB3950] Tony From: Tony Guadagno via observium<mailto:observium@observium.org> Sent: Wednesday, February 16, 2022 3:27 PM To: Brandon Lund<mailto:brandon@kansas.net>; Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Sorry, I should have been more specific…I already have other apps using ldap with tls hitting the server and they work…so I am confident my AD server is properly configured. I work a lot with ldap and I often find that some apps that integrate with ldap and tls get picky about the cert..thats why I think it might be the fact that I am using a self signed cert (which is common on AD servers). Usually, there is a way to tell the application “ignore the fact that it is self signed, accept it anyway” Tony From: Brandon Lund<mailto:brandon@kansas.net> Sent: Wednesday, February 16, 2022 3:08 PM To: Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: LDAP auth to MS AD with TLS Self Signed Cert looks like you need to enable tls for ad to start listing for ldaps no experience just a quick search. https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl… [https://docs.microsoft.com/en-us/media/logos/logo-ms-social.png]<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> Enable Lightweight Directory Access Protocol (LDAP) over Secure Sockets Layer (SSL) - Windows Server | Microsoft Docs<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> docs.microsoft.com Describes how to enable LDAP over SSL with a third-party certification authority. Thanks Brandon Lund KansasNet Internet Services 785-776-1452 From: observium <observium-bounces(a)observium.org> on behalf of Tony Guadagno via observium <observium(a)observium.org> Sent: Wednesday, February 16, 2022 1:49 PM To: Tony Guadagno via observium Cc: Tony Guadagno Subject: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Hi, I have ldap auth working mostly, if I set tls to false, I can authenticate. However, I want to be secure and when I enable tls, I get a debug error that says: Error binding to LDAP server: servername.local: Can’t contact LDAP server I am guessing the issue is the self signed cert that my server is using. My question is…how do I configure Observium to accept self signed certs for ldap? thanks Tony

3 3

Re: [Observium] LDAP auth to MS AD with TLS Self Signed Cert
by Tony Guadagno 16 Feb '22

16 Feb '22

Sorry, I should have been more specific…I already have other apps using ldap with tls hitting the server and they work…so I am confident my AD server is properly configured. I work a lot with ldap and I often find that some apps that integrate with ldap and tls get picky about the cert..thats why I think it might be the fact that I am using a self signed cert (which is common on AD servers). Usually, there is a way to tell the application “ignore the fact that it is self signed, accept it anyway” Tony From: Brandon Lund<mailto:brandon@kansas.net> Sent: Wednesday, February 16, 2022 3:08 PM To: Observium<mailto:observium@observium.org> Cc: Tony Guadagno<mailto:tonyg@guadagno.org> Subject: Re: LDAP auth to MS AD with TLS Self Signed Cert looks like you need to enable tls for ad to start listing for ldaps no experience just a quick search. https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl… [https://docs.microsoft.com/en-us/media/logos/logo-ms-social.png]<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> Enable Lightweight Directory Access Protocol (LDAP) over Secure Sockets Layer (SSL) - Windows Server | Microsoft Docs<https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enabl…> docs.microsoft.com Describes how to enable LDAP over SSL with a third-party certification authority. Thanks Brandon Lund KansasNet Internet Services 785-776-1452 From: observium <observium-bounces(a)observium.org> on behalf of Tony Guadagno via observium <observium(a)observium.org> Sent: Wednesday, February 16, 2022 1:49 PM To: Tony Guadagno via observium Cc: Tony Guadagno Subject: [Observium] LDAP auth to MS AD with TLS Self Signed Cert Hi, I have ldap auth working mostly, if I set tls to false, I can authenticate. However, I want to be secure and when I enable tls, I get a debug error that says: Error binding to LDAP server: servername.local: Can’t contact LDAP server I am guessing the issue is the self signed cert that my server is using. My question is…how do I configure Observium to accept self signed certs for ldap? thanks Tony

1 0

LDAP auth to MS AD with TLS Self Signed Cert
by Tony Guadagno 16 Feb '22

16 Feb '22

Hi, I have ldap auth working mostly, if I set tls to false, I can authenticate. However, I want to be secure and when I enable tls, I get a debug error that says: Error binding to LDAP server: servername.local: Can’t contact LDAP server I am guessing the issue is the self signed cert that my server is using. My question is…how do I configure Observium to accept self signed certs for ldap? thanks Tony

2 1

Hosts
by Jacek.Dabrowski＠selgros.pl 16 Feb '22

16 Feb '22

Hello, I have a question Is it possible to export a list of all hosts in Observium to txt/csv file ? Regards Jacek Dąbrowski

4 4

Alert dependency
by Toky ANDRIANASOLO 09 Feb '22

09 Feb '22

Hello, Is it possible to set an alert dependency on observium? for example if there are 04 devices on the network: 01 router and 03 cascading switches.. If the router goes down, we do not need the 03 switches sending an alert anymore as they depends on the router. This will save us from flooding alert and make the alerting system more efficient. Thank You and Regards, Toky,

2 1

alert sensibility setting
by Toky ANDRIANASOLO 09 Feb '22

09 Feb '22

Hello, we are setting an alert based on device status metric, so if the device status is 0 (down), an alert will be sent to a group of mail destination.. Now we want to adjust the alert sensibility of observium in order to sent the mail if the device is down for 10 mn, in other words, if the device is down then up after 8mn for example, we don't want to be alerted. Thank you and Regads, Toky

2 2

poller overwrites manual sensor limits
by Joey Stanford 05 Feb '22

05 Feb '22

Hi, We’ve disabled service discovery in order to zero in on why custom sensor limits are being overwritten. As far as we can ascertain, it appears that the poller is doing this but we’re not sure when/how since it doesn’t reset on every poll. It’s so transient that we’re finding it very difficult to identify the actual culprit. Can anyone offer tips on how we can debug this further? Thanks, Joey

1 0

Sending device status to external status page
by Joey Stanford 30 Jan '22

30 Jan '22

Hi, Ideas wanted. As a service provider, I want to expose basic up/down status to my consumers, So they can self-discover if a portion of the network in their area is affected. In my case, I have emergency communication systems and I would love to make some of these visible in an up/down fashion to people. A status page or uptime robot basic presentation. Any ideas on how I might do this? Joey

2 1