[Pkg-nagios-devel] Bug#939056: icinga-cgi: Broken Apache authentication config

[Dominic Hargreaves]

Package: icinga-cgi
Version: 1.14.2+ds-3
Severity: important

On Thu, Jul 04, 2019 at 12:38:02PM +0200, Bas Couwenberg wrote:
> fixed 892628 icinga/1.14.2+ds-1
> thanks
> 
> Hi Jan,
> 
> On 2019-07-04 11:52, Jan Wagner wrote:
> > Am 11.03.18 um 19:20 schrieb Bas Couwenberg:
> > >    * Update Apache configuration for 2.4 syntax.
> > >      (closes: #892628)
> > 
> > after upgrading to buster I did run into the problem, that there was no
> > authenticating when accessing icinga. Looking into 98d8eb16 show, that
> > you added
> > 
> > Require all granted
> > 
> > Seems that is not what you whated, cause requireing authentication it
> > has to be "Require all denied".
> 
> No, "Require all granted" is the Apache 2.4 equivalent of "Allow From All".
> Which is what this issue is about.
> 
> When authentication is configured, you need "Require valid-user". Which the
> configuration also uses. "Require all granted" should probably be dropped
> instead.
> 
> That being said, Icinga 1.x is EOL upstream and as documented in the
> release-notes you should migrate to Icinga 2.
> 
> I'm not going to fix this issue in buster, if you cannot migrate to icinga2
> soon, you can try the above to see if it fixes your issue.
> 
> Users who encounter this issue will have to fix the configuration
> themselves, or you or someone else needs to be willing to prepare as stable
> update for it.

I'm copying this to a new bug report to accurately reflect that's
still a bug, even if you don't plan to fix it.

Thanks,
Dominic.