Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have successfully installed nagios, and it provides authentication through apache2 which contacts a kerberos authentication server to authenticate users.

Now, users are authenticated, but they don't have any authorization as authorization is configured on cgi.cfg and I don't want to configure all my users one by one manually, or give all rights to each authenticated user.

I would like to know if groups can be set on the cgi.cfg file (such as nagios_reader, with right to watch web interface, host and services status, and nagios_writer, with the ability to run external commands) instead of on the user, and if these groups can be extracted from LDAP.

share|improve this question
up vote 3 down vote accepted

I would like to know if groups can be set on cgi.cfg file

I'm afraid that the answer is no. Nagios hasn't supported this feature yet. The value of authorized_ options must be a comma-delimited list of names of authenticated users. But if, as you said, "these groups can be extracted from a LDAP", so you can add every members in a group with a little shell script.

Nagios has the authorized_for_read_only option to configure a list of usernames that have read-only rights in the CGIs. Assuming that the nagios_reader.ldif contains:

# nagios_reader, it,
dn: cn=nagios_reader,ou=it,dc=domain,dc=com
cn: nagios_reader
member: cn=foo,ou=it,dc=domain,dc=com
member: cn=bar,ou=it,dc=domain,dc=com
objectClass: groupOfNames
objectClass: top

You can configure all the members of this group as a value of authorized_for_read_only variable by using:

$ ldapsearch -x -W -D "cn=manager,dc=domain,dc=com" "cn=nagios_reader" | \
    awk -F"=|," '/member: / { print $2 }' | \
    while read u; do sed -i "/^authorized_for_read_only/s/$/,$u/" cgi.cfg; done
share|improve this answer
Ok quanta thanks for your answer I have been looking around these last few days and found nothing simpler than the solution you propose. I maybe should have a closer look at shinken, base on Nagios, which may propose another authentication method to access its web interface. – philippe Aug 28 '12 at 13:15
@philippe, I'd not heard of Shinken. Looks pretty nice. If you're looking into nagios front-ends, be sure to check out Opsview as well. I've been digging into that lately. It has a fairly granular permissions setup. There is a free version. – JoshP Aug 31 '12 at 20:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.