Development June 2019

development@lists.ipfire.org

14 participants
77 discussions

Current 'next' won't build
by Matthias Fischer 08 Jun '19

08 Jun '19

Hi, today building current 'next' failed with the following error: ***SNIP*** ... # Compress root filesystem # Reason for this tar+untar+tar is removing of entries listed two or more in src/ROOTFILES tar -c --exclude='#*' --exclude='proc/*' --exclude='dev/pts/*' --exclude='tmp/ROOTFILES' \ -C / --files-from=/tmp/ROOTFILES -f /ipfire.tar tar: You may not specify more than one '-Acdtrux', '--delete' or '--test-label' option Try 'tar --help' or 'tar --usage' for more information. make: *** [cdrom:158: /usr/src/log/cdrom] Error 2 ***SNAP*** Can anyone confirm? Best, Matthias

2 4

IPFire 2.23 - Core Update 132 released
by Michael Tremer 07 Jun '19

07 Jun '19

https://blog.ipfire.org/post/ipfire-2-23-core-update-132-released The next version of IPFire is ready: IPFire 2.23 - Core Update 132. This update contains various security fixes and improvements to secure systems that are vulnerable to recently-published problems in Intel processors. Intel Vulnerabilities: RIDL, Fallout & ZombieLoad Two new types of vulnerabilities [1] have been found in Intel processors. They cannot be fixed unless the hardware is changed, but can be somewhat mitigated through some changes in the Linux kernel (4.14.120) and an update microcode (version 20190514). Both is shipped in this release. Additionally, to mitigate this bug which cannot be fixed at all, SMT is disabled by default [2] on all affected processors which has significant performance impacts. Please note, that Intel unfortunately is not releasing microcode for all processors any more and so you might still be vulnerable. To apply the fixes, please reboot your system. There is a new GUI which will show you for which attacks your hardware is vulnerable and if mitigations are in place: https://nopaste.ipfire.org/raw/gLhF11dD VLAN Configuration Florian Bührle has contributed a UI to configure VLAN interfaces for zones. This way, it can be done graphically and the system needs to be rebooted to apply the changes. The GUI also allows to set up a zone in bridge mode which is helpful for advanced users who need some custom configuration. https://nopaste.ipfire.org/raw/PmFWLMCH Misc. This update also contains a number of various bug fixes: • The new IPS now starts on systems with more than 16 CPU cores • For improved security of the web UI, the web service now prefers ciphers in GCM mode over CBC. This is because CBC seems to be weakened by new attack vectors. • OpenVPN has received some changes to the UI and improvements of its security. • Alexander Koch sent in some changes around the wpad.dat handling: It is now possible to define a list of exceptions to this file on the web UI and all VPN networks are included by default. • Captive Portal: A stored cross-site scripting vulnerability has been fixed in the argument handling of the title; an uploaded logo file can now be deleted • The same type of stored cross-site scripting attack was resolved in the static routing UI • Log entries for Suricata now properly show up in the system log section • Updated packages (all from Matthias Fischer): bind 9.11.6-P1, dhcpcd 7.2.2, knot 2.8.1, libedit 20190324-3.1 Add-ons Wireless AP The wireless AP add-on has received some new features: • For hardware that supports it, Automatic Channel Selection can be enabled, which scans the environment and automatically selects the best channel for the wireless access point. When it is activated, 80 MHz channel bandwidth will be enabled for 802.11ac networks doubling throughput. • DFS is supported (on hardware that supports it, too) which is needed to use higher channels in the 5 GHz spectrum • Management Frame Protection can optionally be enabled to encrypt messages between the station and the access point. This prevents a rogue attacker to deauthenticate stations from the wireless LAN or other denial-of-service attacks. Updates • igmpproxy 0.2.1, tor 0.4.0.5, zabbix_agentd 4.2.1 • Qemu is now being hardened with libseccomp which is a "syscall firewall". It limits what actions a virtual machine can perform and is enabled by default Please support our project with your donation: https://www.ipfire.org/donate [1] https://mdsattacks.com/ [2] https://blog.ipfire.org/post/security-announcement-disabling-smt-by-default…

1 0

Re: Hyperscan crashes in build process
by ummeegge 07 Jun '19

07 Jun '19

On Mi, 2019-06-05 at 17:48 +0100, Michael Tremer wrote: > Can you upgrade? Currently, no. > > > On 5 Jun 2019, at 17:32, ummeegge <ummeegge(a)ipfire.org> wrote: > > > > On Mi, 2019-06-05 at 17:31 +0100, Michael Tremer wrote: > > > How much memory does your build machine have? > > > > 2GB :-) . > > > > > > > > > On 5 Jun 2019, at 16:40, ummeegge <ummeegge(a)ipfire.org> wrote: > > > > > > > > Hi all, > > > > just wanted to report that Hyperscan quits in the current > > > > origin/next > > > > build process with > > > > > > > > [ 78%] Building CXX object > > > > CMakeFiles/hs_compile_shared.dir/src/rose/rose_build_castle.cpp > > > > .o > > > > c++: fatal error: Killed signal terminated program cc1plus > > > > compilation terminated. > > > > make[3]: *** [CMakeFiles/hs_compile_shared.dir/build.make:1698: > > > > CMakeFiles/hs_compile_shared.dir/src/rose/rose_build_bytecode.c > > > > pp.o > > > > ] Error 1 > > > > make[3]: *** Deleting file > > > > 'CMakeFiles/hs_compile_shared.dir/src/rose/rose_build_bytecode. > > > > cpp. > > > > o' > > > > make[3]: *** Waiting for unfinished jobs.... > > > > make[3]: Leaving directory '/usr/src/hyperscan-5.1.1' > > > > make[2]: *** [CMakeFiles/Makefile2:251: > > > > CMakeFiles/hs_compile_shared.dir/all] Error 2 > > > > make[2]: Leaving directory '/usr/src/hyperscan-5.1.1' > > > > make[1]: *** [Makefile:130: all] Error 2 > > > > make[1]: Leaving directory '/usr/src/hyperscan-5.1.1' > > > > make: *** [hyperscan:80: /usr/src/log/hyperscan-5.1.1] Error 2 > > > > > > > > Best, > > > > > > > > Erik > > > > > > > > > > > > > > > > > > > >

2 3

[PATCH 1/5] suricata: correct rule actions in IPS mode
by Stefan Schantl 06 Jun '19

06 Jun '19

From: Tim FitzGeorge <ipfr(a)tfitzgeorge.me.uk> In IPS mode rule actions need to be have the action 'drop' for the protection to work, however this is not appropriate for all rules. Modify the generator for oinkmaster-modify-sids.conf to leave rules with the action 'alert' here this is appropriate. Also add a script to be run on update to correct existing downloaded rules. Fixes #12086 Signed-off-by: Tim FitzGeorge <ipfr(a)tfitzgeorge.me.uk> Tested-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/cfgroot/ids-functions.pl | 44 +++++++++-- config/rootfiles/common/configroot | 1 + config/rootfiles/core/133/update.sh | 3 + config/suricata/convert-ids-modifysids-file | 84 +++++++++++++++++++++ html/cgi-bin/ids.cgi | 22 +++++- lfs/configroot | 1 + 6 files changed, 148 insertions(+), 7 deletions(-) create mode 100644 config/suricata/convert-ids-modifysids-file diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index 88734a3ca..e1caa6e58 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -243,7 +243,7 @@ sub downloadruleset { # Load perl module to deal with temporary files. use File::Temp; - # Generate temporay file name, located in "/var/tmp" and with a suffix of ".tar.gz". + # Generate temporary file name, located in "/var/tmp" and with a suffix of ".tar.gz". my $tmp = File::Temp->new( SUFFIX => ".tar.gz", DIR => "/var/tmp/", UNLINK => 0 ); my $tmpfile = $tmp->filename(); @@ -293,6 +293,9 @@ sub downloadruleset { # Overwrite existing rules tarball with the new downloaded one. move("$tmpfile", "$rulestarball"); + # Set correct ownership for the rulesdir and files. + set_ownership("$rulestarball"); + # If we got here, everything worked fine. Return nothing. return; } @@ -726,8 +729,8 @@ sub write_used_rulefiles_file(@) { # ## Function to generate and write the file for modify the ruleset. # -sub write_modify_sids_file($) { - my ($ruleaction) = @_; +sub write_modify_sids_file($$) { + my ($ruleaction,$rulefile) = @_; # Open modify sid's file for writing. open(FILE, ">$modify_sids_file") or die "Could not write to $modify_sids_file. $!\n"; @@ -737,8 +740,39 @@ sub write_modify_sids_file($) { # Check if the traffic only should be monitored. unless($ruleaction eq "alert") { - # Tell oinkmaster to switch all rules from alert to drop. - print FILE "modifysid \* \"alert\" \| \"drop\"\n"; + # Suricata is in IPS mode, which means that the rule actions have to be changed + # from 'alert' to 'drop', however not all rules should be changed. Some rules + # exist purely to set a flowbit which is used to convey other information, such + # as a specific type of file being downloaded, to other rulewhich then check for + # malware in that file. Rules which fall into the first category should stay as + # alert since not all flows of that type contain malware. + + if($rulefile eq 'registered' or $rulefile eq 'subscripted' or $rulefile eq 'community') { + # These types of rulesfiles contain meta-data which gives the action that should + # be used when in IPS mode. Do the following: + # + # 1. Disable all rules and set the action to 'drop' + # 2. Set the action back to 'alert' if the rule contains 'flowbits:noalert;' + # This should give rules not in the policy a reasonable default if the user + # manually enables them. + # 3. Enable rules and set actions according to the meta-data strings. + + my $policy = 'balanced'; # Placeholder to allow policy to be changed. + + print FILE <<END; +modifysid * "^#?(?:alert|drop)" | "#drop" +modifysid * "^#drop(.+flowbits:noalert;)" | "#alert\${1}" +modifysid * "^#(?:alert|drop)(.+policy $policy-ips alert)" | "alert\${1}" +modifysid * "^#(?:alert|drop)(.+policy $policy-ips drop)" | "drop\${1}" +END + } else { + # These rulefiles don't have the metadata, so set rules to 'drop' unless they + # contain the string 'flowbits:noalert;'. + print FILE <<END; +modifysid * "^(#?)(?:alert|drop)" | "\${1}drop" +modifysid * "^(#?)drop(.+flowbits:noalert;)" | "\${1}alert\${2}" +END + } } # Close file handle. diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index a7f27fe55..56b0257bc 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -3,6 +3,7 @@ usr/sbin/convert-outgoingfw usr/sbin/convert-portfw usr/sbin/convert-snort usr/sbin/convert-xtaccess +usr/sbin/convert-ids-modifysids-file usr/sbin/firewall-policy #var/ipfire var/ipfire/addon-lang diff --git a/config/rootfiles/core/133/update.sh b/config/rootfiles/core/133/update.sh index 9d708f092..a05ad0741 100644 --- a/config/rootfiles/core/133/update.sh +++ b/config/rootfiles/core/133/update.sh @@ -62,6 +62,9 @@ telinit u # Regenerate /etc/ipsec.conf sudo -u nobody /srv/web/ipfire/cgi-bin/vpnmain.cgi +# Modify suricata modify-sids file +/usr/sbin/convert-ids-modifysids-file + # Start services /usr/local/bin/ipsecctrl S /etc/init.d/suricata restart diff --git a/config/suricata/convert-ids-modifysids-file b/config/suricata/convert-ids-modifysids-file new file mode 100644 index 000000000..8b70aa0fc --- /dev/null +++ b/config/suricata/convert-ids-modifysids-file @@ -0,0 +1,84 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/ids-functions.pl"; + +# Hash which contains the IDS (suricata) settings. +my %idssettings; + +# Hash which contains the RULES settings. +my %rulessettings; + +# +## Step 1: Read IDS and rules settings. +# + +exit unless(-f $IDS::ids_settings_file and -f $IDS::rules_settings_file); + +# Read IDS settings. +&General::readhash("$IDS::ids_settings_file", \%idssettings); + +# Read rules settings. +&General::readhash("$IDS::rules_settings_file", \%rulessettings); + +# +## Step 2: Generate and write the file to modify the ruleset. +# + +my $IDS_action = "drop"; + +# Check if the traffic only should be monitored. +if ($idssettings{"MONITOR_TRAFFIC_ONLY"} eq "on") { + # Switch IDS action to alert only. + $IDS_action = "alert"; +} + +# Call subfunction and pass the desired IDS action. +&IDS::write_modify_sids_file($IDS_action, $rulessettings{RULES}); + +# Set correct ownership. +&IDS::set_ownership("$IDS::modify_sids_file"); + +# +## Step 3: Call oinkmaster to extract and setup the rules structures. +# + +# Check if a rulestarball is present. +if (-f $IDS::rulestarball) { + # Launch oinkmaster by calling the subfunction. + &IDS::oinkmaster(); + + # Set correct ownership for the rulesdir and files. + &IDS::set_ownership("$IDS::rulespath"); +} + +# +## Step 4: Start the IDS if enabled. +# + +# Check if the IDS should be started. +if($idssettings{"ENABLE_IDS"} eq "on") { + # Call suricatactrl and reload the rules. + &IDS::call_suricatactrl("reload"); +} diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 00db6a0c3..1791e9beb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -359,7 +359,7 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { $errormessage = "$Lang::tr{'could not download latest updates'} - $Lang::tr{'system is offline'}"; } - # Check if enought free disk space is availabe. + # Check if enough free disk space is availabe. if(&IDS::checkdiskspace()) { $errormessage = "$Lang::tr{'not enough disk space'}"; } @@ -370,6 +370,22 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # a new ruleset. &working_notice("$Lang::tr{'ids working'}"); + &General::readhash("$IDS::ids_settings_file", \%idssettings); + + # Temporary variable to set the ruleaction. + # Default is "drop" to use suricata as IPS. + my $ruleaction="drop"; + + # Check if the traffic only should be monitored. + if($idssettings{'MONITOR_TRAFFIC_ONLY'} eq 'on') { + # Switch the ruleaction to "alert". + # Suricata acts as an IDS only. + $ruleaction="alert"; + } + + # Write the modify sid's file and pass the taken ruleaction. + &IDS::write_modify_sids_file($ruleaction, $cgiparams{'RULES'}); + # Call subfunction to download the ruleset. if(&IDS::downloadruleset()) { $errormessage = $Lang::tr{'could not download latest updates'}; @@ -609,8 +625,10 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { $ruleaction="alert"; } + &General::readhash("$IDS::rules_settings_file", \%rulessettings); + # Write the modify sid's file and pass the taken ruleaction. - &IDS::write_modify_sids_file($ruleaction); + &IDS::write_modify_sids_file($ruleaction, $rulessettings{'RULES'}); # Check if "MONITOR_TRAFFIC_ONLY" has been changed. if($cgiparams{'MONITOR_TRAFFIC_ONLY'} ne $oldidssettings{'MONITOR_TRAFFIC_ONLY'}) { diff --git a/lfs/configroot b/lfs/configroot index d4eb545f0..227d09239 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -135,6 +135,7 @@ $(TARGET) : # Install snort to suricata converter. cp $(DIR_SRC)/config/suricata/convert-snort /usr/sbin/convert-snort + cp $(DIR_SRC)/config/suricata/convert-ids-modifysids-file /usr/sbin/convert-ids-modifysids-file # Add conntrack helper default settings for proto in FTP H323 IRC SIP TFTP; do \ -- 2.20.1

3 7

[PATCH] knot: Update to 2.8.2
by Matthias Fischer 06 Jun '19

06 Jun '19

For details see: https://www.knot-dns.cz/2019-06-05-version-282.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/knot | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/knot b/lfs/knot index 804d3bcc2..be3991689 100644 --- a/lfs/knot +++ b/lfs/knot @@ -24,7 +24,7 @@ include Config -VER = 2.8.1 +VER = 2.8.2 THISAPP = knot-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 14e67b33ed409f92259dbdbaf0e5ade7 +$(DL_FILE)_MD5 = 7b2e9d44070e0559b13dac575547845b install : $(TARGET) -- 2.18.0

1 0

[PATCH] suricata: Enable EVE logging
by Erik Kapfer 06 Jun '19

06 Jun '19

The EVE output facility outputs alerts, metadata, file info and protocol specific records through JSON. for further informations please see --> https://suricata.readthedocs.io/en/suricata-4.1.2/output/eve/index.html . Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- lfs/suricata | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lfs/suricata b/lfs/suricata index 310920606..6f779d875 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -80,6 +80,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-nfqueue \ --disable-static \ --disable-python \ + --with-libjansson-libraries=/usr/lib \ + --with-libjansson-includes=/usr/include \ --disable-suricata-update cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.12.2

4 5

Hyperscan crashes in build process
by ummeegge 05 Jun '19

05 Jun '19

Hi all, just wanted to report that Hyperscan quits in the current origin/next build process with [ 78%] Building CXX object CMakeFiles/hs_compile_shared.dir/src/rose/rose_build_castle.cpp.o c++: fatal error: Killed signal terminated program cc1plus compilation terminated. make[3]: *** [CMakeFiles/hs_compile_shared.dir/build.make:1698: CMakeFiles/hs_compile_shared.dir/src/rose/rose_build_bytecode.cpp.o] Error 1 make[3]: *** Deleting file 'CMakeFiles/hs_compile_shared.dir/src/rose/rose_build_bytecode.cpp.o' make[3]: *** Waiting for unfinished jobs.... make[3]: Leaving directory '/usr/src/hyperscan-5.1.1' make[2]: *** [CMakeFiles/Makefile2:251: CMakeFiles/hs_compile_shared.dir/all] Error 2 make[2]: Leaving directory '/usr/src/hyperscan-5.1.1' make[1]: *** [Makefile:130: all] Error 2 make[1]: Leaving directory '/usr/src/hyperscan-5.1.1' make: *** [hyperscan:80: /usr/src/log/hyperscan-5.1.1] Error 2 Best, Erik

2 1

[PATCH] update-ids-ruleset: Run as unprivileged user.
by Stefan Schantl 05 Jun '19

05 Jun '19

Check if the script has been launched as privileged user (root) and drop all permissions by switching to the "nobody" user and group. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/scripts/update-ids-ruleset | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 956c3a1f5..dbe5b6849 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -20,11 +20,25 @@ ############################################################################### use strict; +use POSIX; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/ids-functions.pl"; require "${General::swroot}/lang.pl"; +# The user and group name as which this script should be run. +my $run_as = 'nobody'; + +# Get user and group id of the user. +my ( $uid, $gid ) = ( getpwnam $run_as )[ 2, 3 ]; + +# Check if the script currently runs as root. +if ( $> == 0 ) { + # Drop privileges and switch to the specified user and group. + POSIX::setgid( $gid ); + POSIX::setuid( $uid ); +} + # Check if the red device is active. unless (-e "${General::swroot}/red/active") { # Store notice in the syslog. -- 2.20.1

1 0

[PATCH] dhcp.cgi: Fix for bug #12050
by Bernhard Bitsch 05 Jun '19

05 Jun '19

Save fixed leases to file after addition of a new lease Signed-off-by: Bernhard Bitsch <bbitsch(a)ipfire.org> --- html/cgi-bin/dhcp.cgi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/html/cgi-bin/dhcp.cgi b/html/cgi-bin/dhcp.cgi index 675d80012..19c55eb6d 100644 --- a/html/cgi-bin/dhcp.cgi +++ b/html/cgi-bin/dhcp.cgi @@ -443,6 +443,9 @@ if ($dhcpsettings{'ACTION'} eq $Lang::tr{'add'}.'2') { $dhcpsettings{'FIX_ROOTPATH'} = &Header::cleanhtml($dhcpsettings{'FIX_ROOTPATH'}); if ($dhcpsettings{'KEY2'} eq '') { #add or edit ? unshift (@current2, "$dhcpsettings{'FIX_MAC'},$dhcpsettings{'FIX_ADDR'},$dhcpsettings{'FIX_ENABLED'},$dhcpsettings{'FIX_NEXTADDR'},$dhcpsettings{'FIX_FILENAME'},$dhcpsettings{'FIX_ROOTPATH'},$dhcpsettings{'FIX_REMARK'}\n"); + open(FILE, ">$filename2") or die 'Unable to open fixed lease file.'; + print FILE @current2; + close(FILE); &General::log($Lang::tr{'fixed ip lease added'}); # Enter edit mode -- 2.21.0.windows.1

2 8

[PATCH] monit: Some fixes for 'monitrc'
by Matthias Fischer 05 Jun '19

05 Jun '19

Just cosmetics: Removed all trailing spaces - there were a few... Activated 'monit' start delay: I activated this option to avoid running into a race condition while started through '/etc/init.d/monit start'. As mentioned in 'monit' manual: "...if a service is slow to start, Monit can assume that the service is not running and possibly try to start it [again] and raise an alert, while, in fact the service is already about to start or already in its startup sequence." This happened here during testing with (e.g.) Clamav. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/monit/monitrc | 74 ++++++++++++++++++++++---------------------- 1 file changed, 37 insertions(+), 37 deletions(-) diff --git a/config/monit/monitrc b/config/monit/monitrc index 9fee14aad..3c999d041 100644 --- a/config/monit/monitrc +++ b/config/monit/monitrc @@ -5,8 +5,8 @@ ## Comments begin with a '#' and extend through the end of the line. Keywords ## are case insensitive. All path's MUST BE FULLY QUALIFIED, starting with '/'. ## -## Below you will find examples of some frequently used statements. For -## information about the control file and a complete list of statements and +## Below you will find examples of some frequently used statements. For +## information about the control file and a complete list of statements and ## options, please have a look in the Monit manual. ## ## @@ -17,15 +17,15 @@ ## Start Monit in the background (run as a daemon): # set daemon 60 # check services at 1-minute intervals -# with start delay 240 # optional: delay the first check by 4-minutes (by + with start delay 240 # optional: delay the first check by 4-minutes (by # # default Monit check immediately after Monit start) # # ## Set syslog logging with the 'daemon' facility. If the FACILITY option is -## omitted, Monit will use 'user' facility by default. If you want to log to +## omitted, Monit will use 'user' facility by default. If you want to log to ## a standalone log file instead, specify the full path to the log file # -set logfile syslog facility log_daemon +set logfile syslog facility log_daemon # # ## Set the location of the Monit lock file which stores the process id of the @@ -34,7 +34,7 @@ set logfile syslog facility log_daemon set pidfile /var/run/monit.pid # ## Set the location of the Monit id file which stores the unique id for the -## Monit instance. The id is generated and stored on first Monit start. By +## Monit instance. The id is generated and stored on first Monit start. By ## default the file is placed in $HOME/.monit.id. # set idfile /var/lib/monit/id @@ -47,9 +47,9 @@ set idfile /var/lib/monit/id # set statefile /var/lib/monit/state # -## Set the list of mail servers for alert delivery. Multiple servers may be -## specified using a comma separator. If the first mail server fails, Monit -# will use the second mail server in the list and so on. By default Monit uses +## Set the list of mail servers for alert delivery. Multiple servers may be +## specified using a comma separator. If the first mail server fails, Monit +# will use the second mail server in the list and so on. By default Monit uses # port 25 - it is possible to override this with the PORT option. # # set mailserver mail.bar.baz, # primary mailserver @@ -57,10 +57,10 @@ set statefile /var/lib/monit/state # localhost # fallback relay # # -## By default Monit will drop alert events if no mail servers are available. -## If you want to keep the alerts for later delivery retry, you can use the -## EVENTQUEUE statement. The base directory where undelivered alerts will be -## stored is specified by the BASEDIR option. You can limit the queue size +## By default Monit will drop alert events if no mail servers are available. +## If you want to keep the alerts for later delivery retry, you can use the +## EVENTQUEUE statement. The base directory where undelivered alerts will be +## stored is specified by the BASEDIR option. You can limit the queue size ## by using the SLOTS option (if omitted, the queue is limited by space ## available in the back end filesystem). # @@ -69,11 +69,11 @@ set eventqueue slots 100 # optionally limit the queue size # # -## Send status and events to M/Monit (for more informations about M/Monit -## see http://mmonit.com/). By default Monit registers credentials with +## Send status and events to M/Monit (for more informations about M/Monit +## see http://mmonit.com/). By default Monit registers credentials with ## M/Monit so M/Monit can smoothly communicate back to Monit and you don't ## have to register Monit credentials manually in M/Monit. It is possible to -## disable credential registration using the commented out option below. +## disable credential registration using the commented out option below. ## Though, if safety is a concern we recommend instead using https when ## communicating with M/Monit and send credentials encrypted. # @@ -105,8 +105,8 @@ set eventqueue # set mail-format { from: monit(a)foo.bar }a # # -## You can set alert recipients whom will receive alerts if/when a -## service defined in this file has errors. Alerts may be restricted on +## You can set alert recipients whom will receive alerts if/when a +## service defined in this file has errors. Alerts may be restricted on ## events by using a filter as in the second example below. # # set alert sysadm(a)foo.bar # receive all alerts @@ -115,9 +115,9 @@ set eventqueue # set alert your-name(a)your.domain not on { instance, action } # # -## Monit has an embedded web server which can be used to view status of +## Monit has an embedded web server which can be used to view status of ## services monitored and manage services from a web interface. See the -## Monit Wiki if you want to enable SSL for the web server. +## Monit Wiki if you want to enable SSL for the web server. # set httpd port 2812 and use address localhost # only accept connection from localhost @@ -143,15 +143,15 @@ set httpd port 2812 and # if cpu usage (system) > 30% then alert # if cpu usage (wait) > 20% then alert # -# +# ## Check if a file exists, checksum, permissions, uid and gid. In addition -## to alert recipients in the global section, customized alert can be sent to -## additional recipients by specifying a local alert handler. The service may +## to alert recipients in the global section, customized alert can be sent to +## additional recipients by specifying a local alert handler. The service may ## be grouped using the GROUP option. More than one group can be specified by ## repeating the 'group name' statement. -# +# # check file apache_bin with path /usr/local/apache/bin/httpd -# if failed checksum and +# if failed checksum and # expect the sum 8f7f419955cefa0b33a2ba316cba3659 then unmonitor # if failed permission 755 then unmonitor # if failed uid root then unmonitor @@ -161,15 +161,15 @@ set httpd port 2812 and # } with the mail-format { subject: Alarm! } # group server # -# +# ## Check that a process is running, in this case Apache, and that it respond ## to HTTP and HTTPS requests. Check its resource usage such as cpu and memory, -## and number of children. If the process is not running, Monit will restart -## it by default. In case the service is restarted very often and the +## and number of children. If the process is not running, Monit will restart +## it by default. In case the service is restarted very often and the ## problem remains, it is possible to disable monitoring using the TIMEOUT ## statement. This service depends on another service (apache_bin) which ## is defined above. -# +# # check process apache with pidfile /usr/local/apache/logs/httpd.pid # start program = "/etc/init.d/httpd start" with timeout 60 seconds # stop program = "/etc/init.d/httpd stop" @@ -178,7 +178,7 @@ set httpd port 2812 and # if totalmem > 200.0 MB for 5 cycles then restart # if children > 250 then restart # if loadavg(5min) greater than 10 for 8 cycles then stop -# if failed host www.tildeslash.com port 80 protocol http +# if failed host www.tildeslash.com port 80 protocol http # and request "/somefile.html" # then restart # if failed port 443 type tcpssl protocol http @@ -187,8 +187,8 @@ set httpd port 2812 and # if 3 restarts within 5 cycles then timeout # depends on apache_bin # group server -# -# +# +# ## Check filesystem permissions, uid, gid, space and inode usage. Other services, ## such as databases, may depend on this resource and an automatically graceful ## stop may be cascaded to them before the filesystem will become full and data @@ -207,7 +207,7 @@ set httpd port 2812 and # group server # # -## Check a file's timestamp. In this example, we test if a file is older +## Check a file's timestamp. In this example, we test if a file is older ## than 15 minutes and assume something is wrong if its not updated. Also, ## if the file size exceed a given limit, execute a script # @@ -219,8 +219,8 @@ set httpd port 2812 and # if size > 100 MB then exec "/my/cleanup/script" as uid dba and gid dba # # -## Check directory permission, uid and gid. An event is triggered if the -## directory does not belong to the user with uid 0 and gid 0. In addition, +## Check directory permission, uid and gid. An event is triggered if the +## directory does not belong to the user with uid 0 and gid 0. In addition, ## the permissions have to match the octal description of 755 (see chmod(1)). # # check directory bin with path /bin @@ -229,8 +229,8 @@ set httpd port 2812 and # if failed gid 0 then unmonitor # # -## Check a remote host availability by issuing a ping test and check the -## content of a response from a web server. Up to three pings are sent and +## Check a remote host availability by issuing a ping test and check the +## content of a response from a web server. Up to three pings are sent and ## connection to a port and an application level network check is performed. # # check host myserver with address 192.168.1.1 -- 2.18.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2019