8

Nagios is a wonderful too for monitoring servers. Their web interface is not bad, either. However I am not crazy about using the HTTP Authentication that comes standard.

Is there a way to use another method of authentication? (and I don't mean restricting access by IP address in the .htaccess file) Something with a form-based login would be wonderful, but perhaps there is no such thing. I'm hoping you guys have found something I haven't.

Improve this question
4
  • Not directly related to the question, but maybe you would like to have a look at Icinga which started as a Nagios fork. It has (among other things) a pretty AJAX-based web UI and an extended CGI interface.
    – Holger Just
    Dec 8, 2011 at 22:22
  • interesting. are you a developer for them? i thought nagios was sort of industry standard and also open source - what are the big advantages of icinga?
    – cwd
    Dec 8, 2011 at 23:10
  • httpd.apache.org/docs/2.3/mod/mod_auth_form.html
    – quanta
    Dec 9, 2011 at 4:33
  • I guess what I really want to know is can I change the way the authentication is enforced - using a PHP session instead of basic authentication or something like that - not the actual verification of credentials. I've accepted the current answer though as it is accurate - just like the honeybadger, nagios doesn't care how you protect the webpage.
    – cwd
    Dec 15, 2011 at 23:29

4 Answers 4

Reset to default
6

Nagios doesn't care how you have the webserver handle the authentication. Nagios simply takes the authenticated user passed from the webserver to compare against the configuration. You could also disable authentication within Nagios itself and handle authentication in the webserver directly. Doing this would either allow all authenticated users the same access level or would require separate configurations to restrict/limit access to Nagios features.

Here's the link to the Nagios 3.0 CGI Auth documentation.

Improve this answer
2
  • Disabling authentication at the nagios level will break the ability for anyone to issue commands via the web interface, iirc.
    – Keith
    Dec 28, 2011 at 22:41
  • You then have to enable the default user in the nagios config and update the config to allow that user to issue commands via the web UI. You can then configure the web server to handle the authentication in whatever manner you wish separate from Nagios but you won't be able to have separate access levels within Nagios.
    – Jeremy Bouse
    Dec 29, 2011 at 14:27
2

Nagios doesn't do its own authentication, as others have mentioned; it relies on httpd to pass the authentication through.

Therefore, you can use any of the dozens of auth modules for apache's httpd, including many that use form-based logins (WebAuth, CAS, OpenID, probably SAML, etc.). These are only practical if you already have some sort of SSO available where you are. If not, authing to a directory service (AD, LDAP) or a database might be more practical.

Improve this answer
1

I don't use forms based authentication but I have found that mod_auth_radius from the FreeRadius project works well in my environment to provide single sign on.

You could also look into direct LDAP authentication if you have something in place.

Improve this answer
0

If you end up on this post, as I have.

I have got nginx using oauth2-proxy to auth to my keycloak server and hand the email on to nagios, nagios will use the email as the username.

fastcgi_param REMOTE_USER $email; is the magic in nginx.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .