Repository navigation
creating a contact named "omdadmin" makes site unusable #131
Description
Activity
I am wondering if this might be a case of sort of "downgrading" the omdadmin from site admin with full privileges to an app-level user (within omd, that is) with limited privileges.
If so, thruk and the omd system should not allow this, or somehow warn the user they are about to shoot themselves in the leg BEFORE they attempt the update.
For now, I will just avoid using omdadmin as a contact.
the reason is the "authentication tab" when creating a (new) contact:
It is set to no permission by default, so if you create a contact for something which is already in the cgi.cfg but no contact yet,
it will get the new permissions.
Not sure if its easy to fix. Two things would need to change:- the authentication settings should not immediately apply, instead be used when doing the "save" step.
- the authentication tab should load the existing settings somehow, although it does not know which user you want to create
- or it should have a flag whether the settings have been changed and keep it like before unless actively changed
Sounds like a conflict between (1) the set of id's that can be OMD admins, and (2) the set of id's that can be OMD contacts. Apparently, the one context can "clobber" the other context if the id's match.
Perhaps these sets can be unified, somehow, for the purposes of these checks.
Another possibility -- maybe not a good one, idk -- is to create omdadmin as a contact in the installation process. I am assuming a dup is not permitted.
Doing the following:
omd create newsite
omd start newsite
(log in to newsite)
Config Tool->Object settings->Contacts->Create a new contact
save to: contacts.cfg
contact_name: omdadmin
alias: OMD Admin
email: someone@localhost
apply
Note that even if I select the radio button for submitting commands, the following error appears:
missing backend configuration
'please specify at least one backend in your thruk_local.conf
Please read the setup instructions.'
After this, the site is largely unusable, particularly the Config Tool
In addition, selecting Process Info gives me this error:
It appears as though you do not have permission to view process information...
'If you believe this is an error, check the HTTP server authentication requirements for accessing this CGI
and check the authorization options in your CGI configuration file.'
the thruk.log gives the same error info
I have not been able to figure out how to recover from this. One suspicion I have is the change from debian to devuan. I realize mostly this change should not be consequential, except if OMD and its subsidiary systems are detecting a distro called "devuan" and not matching on a case statement, or the like. Otherwise, I would think that in the context of omd and its subsystems, devuan should behave and look and feel pretty much like debian or any debian derivative.
Environment:
Devuan Beowulf (Debian Buster sans systemd)
omd labs 4.20
firefox 78.14.0esr (but also tried with recent chromium browser, with same result)
naemon.log
apache.log