- observium - lists.observium.org

LDAP / LDAPS Authentication with Observium
by Valerie Lim 12 May '22

12 May '22

Hi Graeme Thanks! Also just want to check with you: 1. Other than getting LDAP to work, did you manage to get LDAPS to work as well? If so, could you provide the every step on how your team did it? 2. What OS & version is both your host Observium & LDAP server running on? 3. For LDAP, other than setting up Observium in the host & LDAP service in the server itself, were there any additional packages / steps you did to make it work? [cid:image001.png@01D865EB.87CC6930] Best Regards Valerie Lim

1 0

LDAP / LDAPS Authentication with Observium
by Valerie Lim 12 May '22

12 May '22

Hi I've configured my config.php based on recommended advice. However, when I try logging in, it only refreshes the page and shows me the following logs: [cid:image001.jpg@01D86528.E1F50CA0] I'm running my Observium on Ubuntu Desktop 20.04 and my LDAP server on Windows Server 2019. Here is my config.php configuration: // Authentication Model $config['auth_mechanism'] = "ldap"; // default, other options: ldap, http-auth, please se> $config['auth_ldap_binddn'] = "cn=Administrator,cn=Users,dc=domain01,dc=com"; $config['auth_ldap_bindpw'] = "XXXXXXXX"; $config['auth_ldap_attr']['uid'] = "sAMAccountName"; $config['auth_ldap_attr']['uidNumber'] = "objectSid"; $config['auth_ldap_attr']['cn'] = "name"; $config['auth_ldap_attr']['dn'] = "distinguishedName"; $config['auth_ldap_objectclass'] = "person"; $config['auth_ldap_version'] = 3; $config['auth_ldap_server'] = "ldap://192.168.1.234"; $config['auth_ldap_port'] = 389; $config['auth_ldap_starttls'] = TRUE; $config['auth_ldap_bindanonymous'] = FALSE; $config['auth_ldap_prefix'] = "CN="; $config['auth_ldap_suffix'] = ",OU=ACCLIVIS,DC=domain01,DC=com"; $config['auth_ldap_group'] = array("CN=grouping,OU=ACCLIVIS,DC=domain01,DC=com"); $config['auth_ldap_groupbase'] = "CN=grouping,OU=ACCLIVIS,DC=domain01,DC=com"; $config['auth_ldap_groupmembertype'] = "nodn"; $config['auth_ldap_groupmemberattr'] = "member"; unset($config['auth_ldap_groups']); $config['auth_ldap_groups']['CN=grouping,OU=ACCLIVIS,DC=domain01,DC=com']['level'] = 10; $config['web_debug_unprivileged'] = TRUE; I am able to run a successful LDAP query from my host to my LDAP server. Thus, please advice on what else I can be missing. I'm reverting back from LDAPS to LDAP as I would like to fix the basic LDAP connection first before moving to a secured LDAP. Best Regards Valerie Lim

3 4

observium secondary IP
by Toky ANDRIANASOLO 10 May '22

10 May '22

Hello, Can we configure a secondary IP address for the observium server and use this to add devices? the primary IP will be routed on the primary link based on tunneling technology and the secondary IP will be routed on the backup MPLS link. Thank you and Regards, Toky, -- <https://app.livestorm.co/comdata-group/services-financiers-comment-optimise…>

4 3

need for a new support system, email lists are too limiting
by Tony Guadagno 06 May '22

06 May '22

Hi, as the recent 2 questions have shown (ldaps auth and ping only device monitoring) users have the same questions over and over. Currently, this system Observium uses for email lists (imho) is not cutting it. There is no place (that I now of) that we can search for old solutions, the emails don't seem to be archived anywhere. Have you considered switching off this to a discussion board software? I think it would be better for all. Just my 2 cents. tony

4 8

LDAPS Authentication with Observium
by Valerie Lim 05 May '22

05 May '22

Hi I need advice on how to authenticate my LDAP server (Windows Server 2019) with my Observium client (v22.4.11952) which runs on Ubuntu v20.04 Desktop. 1. I've configured LDAPs certificate in my LDAP server as an .pfx file. How do I allow Observium to read the certificate so as to get authenticated by my LDAP server? 1. I've configured LDAP settings in my Observium's config.php file accordingly as advised & installed php module. However, Observium is still unable to authenticate via LDAP. LDAP query between Observium client (Ubuntu) and LDAP server (Windows) is working. So please advice on what additional steps is required on setting up LDAP on regards to both client & server side. 1. Attached is my config.php configuration. // Authentication Model $config['auth_mechanism'] = "ldap"; // default, other options: ldap, http-auth, please s> $config['auth_ldap_binddn'] = "cn=Administrator,ou=acclivis,dc=domain01,dc=com"; $config['auth_ldap_bindpw'] = "xxxxxxxxxx"; $config['auth_ldap_attr']['uid'] = "sAMAccountName"; $config['auth_ldap_attr']['uidNumber'] = "objectSid"; $config['auth_ldap_attr']['cn'] = "name"; $config['auth_ldap_attr']['dn'] = "distinguishedName"; $config['auth_ldap_objectclass'] = "user"; $config['auth_ldap_version'] = 3; $config['auth_ldap_server'] = "server01.domain01.com"; $config['auth_ldap_port'] = 636; $config['auth_ldap_starttls'] = TRUE; $config['auth_ldap_prefix'] = "cn="; $config['auth_ldap_suffix'] = ",ou=acclivis,DC=domain01,DC=com"; $config['auth_ldap_group'] = array("cn=grouping,ou=acclivis,DC=domain01,DC=com"); $config['auth_ldap_groupbase'] = "cn=grouping,ou=acclivis,DC=domain01,DC=com"; $config['auth_ldap_groupmembertype'] = "nondn"; $config['auth_ldap_groupmemberattr'] = "member"; unset($config['auth_ldap_groups']); $config['auth_ldap_groups']['cn=grouping,ou=acclivis,DC=domain01,DC=com']['level'] = 10; Best Regards Valerie Lim

3 10

Phantom suppressed alerts
by Dale Chambers 05 May '22

05 May '22

Afternoon, I am hoping you might be able to help me. I seem to have issues with the alerts where I have quite a few marked as supressed, but when you look at the suppressed alerts, I only see 5, but I cannot see how I can clear these phantom alerts. Are you able to help me? I am currently on version 22.3.11925 and this has been going on for probably a year now. A screenshot is provided so that you can see what I have occurring. [cid:image001.jpg@01D86097.CBC408E0] Many Thanks Dale CONFIDENTIALITY AND PRIVACY POLICY This communication is private and the information contained in this email and any attachments may be privileged, commercially sensitive, confidential, proprietary to NSSLGlobal Limited or otherwise legally exempt from disclosure. If you are not the intended recipient or have been sent this in error, you are prohibited from using, copying, relying upon, or disseminating the information, and the sender disclaims any liability for such unauthorised use. Further, if you are not the intended recipient, please notify the sender immediately and delete all copies of this message. In accordance with our email policy, emails sent or received may be monitored. Thank you. We have recently updated our Privacy Policy, which can be accessed at https://www.nsslglobal.com/uploads/documents/NSSLGlobal_Privacy_Policy.pdf We will hold and manage personal data that you provide us with in accordance with this Privacy Policy.

1 0

LDAPS Authentication Observium
by Valerie Lim 05 May '22

05 May '22

Hi Is there a log file in Observium for me to troubleshoot when I log in via LDAP? I want to verify the LDAP details I've keyed in my config.php is correct as I am still unable to log in via LDAP as per Tony's advice on LDAPS. Please advise if I am missing out any additional steps / packages required to as I am still relatively new to configuring LDAP / LDAPS for Observium. Attached are some information I configured so far: 1. Config.php [cid:image001.jpg@01D86091.7DDD9E30] 1. /etc/ldap/ldap.conf [cid:image002.jpg@01D86091.7DDD9E30] 1. Certificate Information (Configured via Windows LDAP Server) [cid:image003.jpg@01D86091.7DDD9E30][cid:image004.jpg@01D86091.7DDD9E30] 1. Already configured LDAPS on Windows LDAP Server (If require more screenshots to show what settings I've configured, I can provide) 2. Made changes to /opt/observium/config.php accordingly as shown in 1st screenshot 3. Made changes to /etc/ldap/ldap.conf accordingly as shown in 2nd screenshot 4. Did ldapquery sucessfully before configuring LDAPS to ensure Ubuntu host can query to Windows LDAP server. Best Regards Valerie Lim

1 0

Microsoft server 2022 listed as 2019
by Tony Guadagno 04 May '22

04 May '22

I just noticed that server 2022 is being reported on observium as 2019....could this be updated pls Thanks

2 5

Ubiquity Serial Numbers / Wireless (WLAN) mac
by Lyndon Labuschagne 27 Apr '22

27 Apr '22

Hi A few years ago we were able to pull the Ubiquiti Radio MAC / Serial numbers from the Observium DB. I no longer see any serial numbers listed for Ubiquiti devices if I query the device table in the DB directly, and it’s not shown on the device screen in the Observium interface. When running a manual poller.php run the serial number field is <empty>, Is there something that changed on the Observium or Ubiquiti side or is the a module that I may need to enable? Any ideas or input would be welcome. Regards Lyndon

3 5

FW: Observium LDAP Integration
by Valerie Lim 27 Apr '22

27 Apr '22

From: Valerie Lim Sent: Wednesday, 27 April 2022 10:07 am To: Adam Thompson <athompson(a)merlin.mb.ca> Cc: Ryan Tee <ryan.tee(a)acclivis.com>; Nirmolak Singh Bajaj <nirmolak.singhbajaj(a)acclivis.com> Subject: RE: Observium LDAP Integration Hi Adam Thanks for your response. I am able to successfully execute an LDAP query via command-line. Also, I will try to configure my LDAP server according to your advice & see the changes. Meanwhile, could you elaborate a bit more on what needs to be done on the client side for Observium? Currently, I am running Ubuntu Desktop 20.04 & have only enabled the base PHP module required for Observium to read LDAP settings. & other than enabling LDAP service on the server itself, is there any additional settings that needs to be done to allow client to reach LDAP server? I have attached below the command I've used for the LDAP query & some user details I've got via the query. Best Regards Valerie Lim Command used: ldapsearch -x -b "dc=domain01,dc=com" -H ldap://192.168.1.234 -D "cn=Administrator,ou=acclivis,dc=domain01,dc=com" -W "objectclass=user" Results: # extended LDIF # # LDAPv3 # base <dc=domain01,dc=com> with scope subtree # filter: objectclass=user # requesting: ALL # # Administrator, acclivis, domain01.com dn: CN=Administrator,OU= acclivis,DC=domain01,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Administrator description: Built-in account for administering the computer/domain distinguishedName: CN=Administrator,OU= acclivis,DC=domain01,DC=com instanceType: 4 whenCreated: 20220413051658.0Z whenChanged: 20220427015103.0Z uSNCreated: 8196 memberOf: CN=Group Policy Creator Owners,CN=Users,DC=domain01,DC=com memberOf: CN=Domain Admins,CN=Users,DC=domain01,DC=com memberOf: CN=Enterprise Admins,CN=Users,DC=domain01,DC=com memberOf: CN=Schema Admins,CN=Users,DC=domain01,DC=com memberOf: CN=Administrators,CN=Builtin,DC=domain01,DC=com uSNChanged: 36881 name: Administrator objectGUID:: zY3U88tQd0CIs1ncaHNQ9A== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 132949181574995316 pwdLastSet: 132942924570197446 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAL/6g3LnZPK6eKnuJ9AEAAA== adminCount: 1 accountExpires: 9223372036854775807 logonCount: 22 sAMAccountName: Administrator sAMAccountType: 805306368 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=domain01,DC=com isCriticalSystemObject: TRUE dSCorePropagationData: 20220420091258.0Z dSCorePropagationData: 20220413053253.0Z dSCorePropagationData: 20220413053253.0Z dSCorePropagationData: 20220413051743.0Z dSCorePropagationData: 16010714042016.0Z lastLogonTimestamp: 132954978631684796 # gt09, acclivis, domain01.com dn: CN=gt09,OU= acclivis,DC=domain01,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: gt09 givenName: gt09 distinguishedName: CN=gt09,OU= acclivis,DC=domain01,DC=com instanceType: 4 whenCreated: 20220420085359.0Z whenChanged: 20220420090537.0Z displayName: gt09 uSNCreated: 32997 memberOf: CN=grouping,OU= acclivis,DC=domain01,DC=com uSNChanged: 33031 name: gt09 objectGUID:: Q06xdIEFa0iWmks3+zuUTQ== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 pwdLastSet: 132949184398814009 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAL/6g3LnZPK6eKnuJOggAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: gt09 sAMAccountType: 805306368 userPrincipalName: gt09(a)domain01.com<mailto:gt09@domain01.com> objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=domain01,DC=com dSCorePropagationData: 16010101000000.0Z mail: valerie.lim(a)acclivis.com<mailto:valerie.lim@acclivis.com> From: Adam Thompson <athompson(a)merlin.mb.ca<mailto:athompson@merlin.mb.ca>> Sent: Tuesday, 26 April 2022 9:29 pm To: Observium <observium(a)observium.org<mailto:observium@observium.org>> Cc: Valerie Lim <valerie.lim(a)acclivis.com<mailto:valerie.lim@acclivis.com>> Subject: RE: Observium LDAP Integration That's very similar to what we're doing here successfully. The differences I see are: $config['auth_ldap_attr']['uid'] = "UserPrincipalName"; $config['auth_ldap_attr']['dn'] = "distinguishedname"; $config['auth_ldap_objectclass'] = "person"; $config['auth_ldap_server'] = "ldaps://xx.xx.xx"; $config['auth_ldap_groups']['CN=xx,OU=xx,DC=xx,DC=xx']['level'] = 10; $config['auth_ldap_port'] = 636; This lets us log in with our full UPN, which happens to also be our email address. You may want to keep sAMAccountName if you want to log in with bare userids instead of UPNs. Not sure if the "dn" line is required or not, I don't remember what that does. Objectclass might also trip you up - "person" is the standard LDAP ObjectClass for an AD userid. Are you able to successfully execute an LDAP query from the command-line using "ldapsearch" (typically found in the "openldap-clients" package or similar)? I would start there, to prove your Observium server can actually reach your DC and run a query successfully, before trying to enable LDAP in Observium. You can't do a non-TLS LDAP bind on 389 by default, which is why we use 636 and ldaps. IIRC, something has to be done on the client (Observium) side to allow OpenLDAP to accept the internal AD-generated TLS certificate the AD server offers, but I can't find it right now. -Adam Adam Thompson Consultant, Infrastructure Services [MERLIN] 100 - 135 Innovation Drive Winnipeg, MB, R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) athompson(a)merlin.mb.ca<mailto:athompson@merlin.mb.ca> www.merlin.mb.ca<http://www.merlin.mb.ca/> From: observium <observium-bounces(a)observium.org<mailto:observium-bounces@observium.org>> On Behalf Of Valerie Lim via observium Sent: Monday, April 25, 2022 9:16 PM To: observium(a)observium.org<mailto:observium@observium.org> Cc: Valerie Lim <valerie.lim(a)acclivis.com<mailto:valerie.lim@acclivis.com>> Subject: [Observium] Observium LDAP Integration Hi I am currently using professional v22.4.11952 for Observium. I am unable to authenticate my Observium via my LDAP server (Windows Server 2019). When 'ldap' is applied, authentication doesn't work. php module required for Observium has already been installed. Below is my config.php configuration: // Authentication Model $config['auth_mechanism'] = "ldap"; // default, other options: ldap, http-auth, please s> $config['auth_ldap_binddn'] = "cn=Administrator,cn=Users,dc=domain01,dc=com"; $config['auth_ldap_bindpw'] = "xxxxxxx"; $config['auth_ldap_attr']['uid'] = "sAMAccountName"; $config['auth_ldap_attr']['uidNumber'] = "objectSid"; $config['auth_ldap_attr']['cn'] = "name"; $config['auth_ldap_objectclass'] = "user"; $config['auth_ldap_version'] = 3; $config['auth_ldap_server'] = "server01.domain01.com"; $config['auth_ldap_port'] = 389; $config['auth_ldap_starttls'] = FALSE; $config['auth_ldap_prefix'] = "cn="; $config['auth_ldap_suffix'] = ",ou=acclivis,DC=domain01,DC=com"; $config['auth_ldap_group'] = array("cn=grouping,ou=acclivis,DC=domain01,DC=com"); $config['auth_ldap_groupbase'] = "cn=grouping,ou=acclivis,DC=domain01,DC=com"; $config['auth_ldap_groupmembertype'] = "nondn"; $config['auth_ldap_groupmemberattr'] = "member"; unset($config['auth_ldap_groups']); $config['auth_ldap_groups']['test']['level'] = 10; Is there something I missing out on my LDAP configuration? Please advise. Thanks Best Regards Valerie Lim

1 0