Comments on: Roadmap for Future Nagstatus Releases http://nagstatus.com/pages/nagstatus-roadmap-v20 Windows Sidebar/Desktop Gadget Fri, 22 Mar 2013 21:26:45 +0000 hourly 1 http://wordpress.org/?v=3.0.4 By: Jouko Markkanen http://nagstatus.com/pages/nagstatus-roadmap-v20/comment-page-1#comment-5765 Jouko Markkanen Fri, 07 Sep 2012 19:34:59 +0000 http://www.markkanen.net/wptest/articles/nagstatus-roadmap-v20#comment-5765 It should be possible, although I've never tried this myself. Nagios itself does not handle the authentication, it is the http server that does it (like apache), Nagios then authorized the user based on the headers passed to Nagios by the http server. So, in order to accomplish ssl authentication (using x.509 cert), your client (ie. the Windows certificate store) must have a certificate from the CA the http server is configured to trust, and the http server must map the certificate to the Nagios username. Also the http server must be set to require ssl client authentication. The certificate to username mapping might be a bit tricky, as AFAIK, the Nagios only checks the HTTP_AUTH_USER header, which Apache does not set when using ssl client authentication. EDIT: Using ssl client authentication should require no configuration on the Nagstatus gadget. But you might need to check your IE security settings and the Nagios server security zone mapping in IE settings that it allows SSL client auth. It should be possible, although I’ve never tried this myself. Nagios itself does not handle the authentication, it is the http server that does it (like apache), Nagios then authorized the user based on the headers passed to Nagios by the http server.

So, in order to accomplish ssl authentication (using x.509 cert), your client (ie. the Windows certificate store) must have a certificate from the CA the http server is configured to trust, and the http server must map the certificate to the Nagios username. Also the http server must be set to require ssl client authentication. The certificate to username mapping might be a bit tricky, as AFAIK, the Nagios only checks the HTTP_AUTH_USER header, which Apache does not set when using ssl client authentication.

EDIT: Using ssl client authentication should require no configuration on the Nagstatus gadget. But you might need to check your IE security settings and the Nagios server security zone mapping in IE settings that it allows SSL client auth.

]]> By: stephan http://nagstatus.com/pages/nagstatus-roadmap-v20/comment-page-1#comment-5755 stephan Thu, 06 Sep 2012 09:07:07 +0000 http://www.markkanen.net/wptest/articles/nagstatus-roadmap-v20#comment-5755 Hello, is there any possibility to use x509 certificates to authenticate at the nagios/icinga server by nagsstatus gadget - so i dont have to use usernamen and password or to use both authentication methodes? regards stephan Hello,

is there any possibility to use x509 certificates to authenticate at the nagios/icinga server by nagsstatus gadget – so i dont have to use usernamen and password or to use both authentication methodes?

regards
stephan

]]>