XYMON-WEBACCESS(5)

💖 XYMON-WEBACCESS(5) 💖

okay bestie, so this is xymon-webaccess — it's the whole ~web-based access controls in Xymon~ situation, and it lives in the File Formats Manual section. let's get into it 🫶

✨ NAME ✨

xymon-webaccess — web-based access controls in Xymon 🌸

🎀 DESCRIPTION 🎀

okay so first thing's first, and this is kind of a big deal: Xymon does not ship with any built-in authentication (login) mechanism. none. zero. it's giving "figure it out yourself" energy 😭. Instead, it fully relies on the access controls that already exist in your web server — like, for example, the Apache mod_auth modules. outsourcing the vibes, love that for us 💅

So that gives you a pretty simple way to control access to the physical directories that make up the pages and subpages containing the hosts defined in your hosts.cfg(5) setup. you can use the Apache require setting to allow or deny access to information on any page — usually by using a Require group ... setting. and then that group name refers to one or more groups inside an Apache AuthGroupFile file. cute, right? ✨

but here's the tea 🍵 — this does not work for the Xymon CGI programs. why? because they're used to fetch information about all the hosts in Xymon, and there's only a single directory holding all of the CGI's. so here the most you can do is require that the user is logged in (that's the Apache Require valid-user directive). and like… a user with a login can, if he knows the hostname, manipulate the request sent to the webserver and fetch information about any status by using the Xymon CGI programs — even though he cannot see the overview webpages. yeah. yikes. 💀

To alleviate this whole situation, these Xymon CGI's support a --access=FILENAME option, where FILENAME is an Apache compatible group-definitions file:

• svcstatus.cgi(1)
• acknowledge.cgi(1)
• enadis.cgi(1)
• appfeed.cgi(1)

When it's invoked with this option, the CGI will read that Apache group-definitions file, and assume that an Apache group maps to a Xymon page, and then — based on the logged-in userid — determine which pages and hosts the user is allowed access to. Only information about those hosts will be made available by the CGI tool. slay 🔥 access control but make it ✨personalized✨

Members of the group root have access to all hosts. main character energy, honestly 👑

And access will also be granted if the user is a member of a group with the same name as the host being requested, or with the same name as the statuscolumn being requested. periodt 💅

🌈 SEE ALSO 🌈

The Apache "Authentication, Authorization and Access Control" documentation, http://httpd.apache.org/docs/2.2/howto/auth.html 🦋

and that's the whole page bestie!! this was Xymon, Version 4.3.30, dated 4 Sep 2019, and that's XYMON-WEBACCESS(5) — go forth and lock down your access controls, ily, bye!! 💖✨🎀