icinga / check_by_powershell Goto Github PK

Who should be referenced in the Copyright Header? Icinga, NETWAYS GmbH or NETWAYS Professional Services GmbH? From the other repositories I think when moved to Icinga's github space it is normally changed to Icinga.

Hello,

we are using Just Enough Administration (JEA) to limit the powershell access of our monitoring user.
Could you please support an additional connection parameter for a JEA profile for something like this:

(powershell example)
enter-pssession -computername HOSTNAME -Credential $Cred -ConfigurationName 'Jea_IcingaMonitoring'

Hello,

i tested the check_by_powershell with the following commandline calls:

./check_by_powershell --host "hostname.fqdn" --auth NTLM --user "DOMAIN\domainuser" --password 'password' --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host "hostname.fqdn" --auth NTLM --user "hostname\localuser" --password 'password' --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host "hostname.fqdn" --auth NTML --user "DOMAIN\domainuser" --password 'password' --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host "hostname.fqdn" --user "hostname\localuser" --password 'password' --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host hostname.fqdn --auth NTML --user "DOMAIN\domainuser" --password 'password' --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host hostname.fqdn --auth NTML --user "domainuser@DOMAIN" --password "password" --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host hostname.fqdn --auth NTML --user "domainuser@DOMAIN" --password 'password' --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host xxx.xxx.xxx.xxx --auth "NTML" --user "domainuser" --password "password" --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host xxx.xxx.xxx.xxx --auth "NTML" --user "localuser" --password "password" --icingacmd Invoke-IcingaCheckCPU
./check_by_powershell --host xxx.xxx.xxx.xxx --auth NTML --user "DOMAIN\domainuser" --password "password" --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host xxx.xxx.xxx.xxx --auth NTML --user "domainuser" --password "password" --icingacmd "Invoke-IcingaCheckCPU"
./check_by_powershell --host xxx.xxx.xxx.xxx --auth NTML --user "domainuser@DOMAIN" --password "password" --icingacmd "Invoke-IcingaCheckCPU"

The result was the followng message:
UNKNOWN - "http response error: 401 - invalid content type"

ref/NC/649281

Hello,

we configured a few checks via check_by_powershell according to the provided command.conf and example.conf.
They are working fine (great work btw 👍), but unfortunately it is not possible to see the check configuration in IcingaWeb2 anymore:

Is it possible to fix this? Being able to see the check configuration is very helpful.

So it will be easier for first time users.

The plugin allows you to run any program, not just powershell scripts. For example, the name check_by_winrm describes how the plugin works like check_by_ssh. The plugin check_by_ssh also contains the protocol in the name and not one of the executable formats, e.g. check_by_bash.

Hi,
Is login with ssh keys not supported?

Cheers,
Marcus

If Authentication fails the Script only returns the message "401 - invalid content type".
Even in Debug mode there is no information what caused this error.

Maybe its possible to show the full response from the Server in Debug ?

WinRM and the plugin support authentication via a certificate instead of credentials.

• Check how much usable this is in a Windows world
• Does the implementation work correctly?
• Document usage

Hi!

I tested the different authentication methods.

This was my test:

Invoke-Command -Computername $fqdn -ScriptBlock $scriptblock -Credential $cred -Authentication $auth

Credentials used were

• user
  domain without domain suffix, user@domain also works
• password
  singlequoted, because of special characters

I used this source for the auth methods:
https://ss64.com/ps/invoke-command.html

Results:

• Default
  MI_RESULT_ACCESS_DENIED
• Basic
  Basic authentication is not supported over HTTP on Unix.
• Credssp
  MI_RESULT_ACCESS_DENIED
• Digest
  MI_RESULT_ACCESS_DENIED
• Kerberos
  OpenError: [%fqdn%] Connecting to remote server %fqdn% failed with the following error message : Kerberos verify cred with password failed No credentials were supplied, or the credentials were unavailable or inaccessible For more information, see the about_Remote_Troubleshooting Help topic.
• Negotiate
  works
• NegotiateWithImplicitCredential
  Cannot bind parameter 'Authentication' to the target. Exception setting "Authentication": "A Credential cannot be specified when NegotiateWithImplicitCredential is specified."

There is a typo in the check for the auth type, as it is looking for NTML and not for NTLM:

• Make port a config option
• Implement support for known_hosts / with trust on first use

See TODO comments from #9