Skip to content

Add XUSER authentication for MaxDB (closes #2) #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Simon0Harms wants to merge 1 commit into
base: main
Choose a base branch
from
+84 −16
Open

Add XUSER authentication for MaxDB (closes #2) #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions SAP-MaxDB/lib/check_mk/base/cee/plugins/bakery/maxdb.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,14 +38,23 @@ def _get_maxdb_conf_lines(conf: dict[str, str]) -> list[str]:
i.replace("backup", "backup:sep(124)").replace("data", "data:sep(61)")
for i in item.get("modules", [])
]
db = [
f"[{item.get('dbname')}]",
f"user={item.get('user')}",
f"password={item.get('password')}",
db = [f"[{item.get('dbname')}]"]
# Authentication: an XUSER key avoids storing plaintext credentials in
# maxdb.cfg. If configured, it takes precedence over user/password.
# The WATO rule nests the credentials under "auth"; older rule versions
# stored user/password directly on the item, so support both layouts.
auth = item.get("auth", item)
xuser_key = auth.get("xuser_key")
if xuser_key:
db.append(f"xuser_key={xuser_key}")
else:
db.append(f"user={auth.get('user')}")
db.append(f"password={auth.get('password')}")
db.extend([
"cmd_tool=" + item.get("cmd_tool", f"/sapdb/{item.get('dbname')}/db/bin/dbmcli"),
f"timeout={item.get('timeout', 20)}",
f"modules={str(modules)}",
]
])
out.extend(db)
return out

Expand Down
12 changes: 11 additions & 1 deletion SAP-MaxDB/share/check_mk/agents/plugins/maxdb.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,17 @@ def main():
if not re.search(r"^\/[a-zA-Z_0-9_.-\/]*\/bin\/dbmcli$", cmd):
print(f"Stop Plugin, hence {cmd} does not match Regex")
sys.exit(2)
cmd_line = [cmd, "-d", key, "-u", f"{value.get('user')},{value.get('password')}"]
# Authentication: prefer an XUSER key (dbmcli -U <key>) so that no
# plaintext credentials are needed in maxdb.cfg. Fall back to the
# classic -d <db> -u <user,password> if no xuser_key is configured.
xuser_key = value.get("xuser_key")
if xuser_key:
if not re.search(r"^[A-Za-z0-9_.-]+$", xuser_key):
print(f"Stop Plugin, hence xuser_key {xuser_key} does not match Regex")
sys.exit(2)
cmd_line = [cmd, "-U", xuser_key]
else:
cmd_line = [cmd, "-d", key, "-u", f"{value.get('user')},{value.get('password')}"]
for check, queries in known_querys.items():
if check in run_checks:
print(f"<<<maxdb_{check}>>>")
Expand Down
69 changes: 59 additions & 10 deletions SAP-MaxDB/share/check_mk/web/plugins/wato/agent_bakery_maxdb.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
Integer,
Password,
ListOf,
Alternative,
)

from cmk.gui.i18n import _
Expand All @@ -37,18 +38,66 @@ def _valuespec_agent_config_maxdb():
TextInput(title=_("Name of Database"), help=_("MaxDB Name")),
),
(
"user",
TextInput(
title=_("Username"), help=_("User for Login into the MaxDB")
),
),
(
"password",
Password(
title=_("Password of User"),
"auth",
Alternative(
title=_("Authentication"),
help=_(
"Password for the user. Be careful the password is in clear text in the agent configuration."
"Choose how the plugin authenticates against the MaxDB. "
"Using an XUSER key (dbmcli -U &lt;key&gt;) is recommended, "
"as it avoids storing the password in clear text in the "
"agent configuration file maxdb.cfg. The XUSER key must be "
"created beforehand with <tt>xuser set</tt> for the OS user "
"that runs the Checkmk agent."
),
elements=[
Dictionary(
title=_("XUSER key (no plaintext password)"),
elements=[
(
"xuser_key",
TextInput(
title=_("XUSER key"),
regex="^[A-Za-z0-9_.-]+$",
regex_error=_(
"Only letters, digits and _.- are allowed."
),
help=_(
"Name of the XUSER entry to use with "
"dbmcli -U. Create it with e.g. "
"<tt>xuser set -U MONCSP -d CSP -u "
"MONITOR,secret</tt> as the agent's OS user."
),
allow_empty=False,
),
),
],
optional_keys=[],
),
Dictionary(
title=_("User and password (clear text in maxdb.cfg)"),
elements=[
(
"user",
TextInput(
title=_("Username"),
help=_("User for Login into the MaxDB"),
),
),
(
"password",
Password(
title=_("Password of User"),
help=_(
"Password for the user. Be careful the "
"password is in clear text in the agent "
"configuration."
),
),
),
],
optional_keys=[],
),
],
),
),
(
Expand Down