<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Just wondering if anyone has played with this combination
before and if so maybe they could provide me a head start. Here’s
what I’ve got done so far:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I did a simple install of mod_auth_kerb (quick yum install),
and setup the authentication servers to my DCs, and set the module to load with
apache, the standard faire. Oddly enough, I found useful help on
Microsoft’s own knowledgebase here: <a
href="http://support.microsoft.com/kb/555092/en-us">http://support.microsoft.com/kb/555092/en-us</a><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I then modified /etc/httpd/conf.d/nagios.conf using the
guidelines laid out in the above link, including setting “Require
valid-user”. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Finally, a quick jump into cgi.cfg and a switch of rights
from “nagiosadmin” to * and bam everyone is in (assuming they can
authenticate of course).<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Here’s my complication:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>What I’d really like to do is filter the access down
to specific groups in AD, and utilize the access view filtering in nagios so
that sql administrators only see the status of sql servers (as an example).
I could probably use mod_auth_ldap, but is there a way to associate that LDAP
group with a NAGIOS contact group so that I can reference it in cgi.cfg?
The end goal would be that someone could manage all of the viewing/notification
of Nagios through AD groups and not have to touch the Linux box directly at all.
So anyone a member of “SQL Notifications” group would get
notifications as well as be able to browse the nagios website for SQL status.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Has anyone done anything like this?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Regards,<o:p></o:p></p>
<p class=MsoNormal>Justin King<o:p></o:p></p>
</div>
</body>
</html>