We commonly receive requests to be able to view configurations, config change reports, and inventory reports from the Cirrus Configuration Manager from the Orion web console.
This feature has been available in the Additional Components section of the Customer Area for quite some time but many users were not aware of its existence. To make it easier, I have included links to the two additional components below.
View Configs from the Orion Website:
ftp://ftp.solarwinds.net/cmb03/cirrus/ConfigListing.zip
View Cirrus Reports from the Orion Website:
ftp://ftp.solarwinds.net/cmb03/cirrus/Cirrus-Reports-View.zip
How does this work when your Cirrus server and Orion server are separate boxes? Furthermore in our design the server running the Orion web site is in a DMZ.TIA.BB
(1) Orion V9.1 SLX running Web Site(4) Orion V9.1 SLX remote pollers (2) NCM (Cirrus) V5.0 SLX MS SQL2005 x64 EE VoIP Monitor NetFlow Traffic Analysis 13000+ elements
This may not be as cool, or it might be ever cooler, depending on your point of view. You can create a custom link in Orion to view the running or startup configuration of any Cisco device running the http daemon with the following links, no Cirrus needed
https://${nodename}/level/15/exec/-/show/running-config/CR
https://${nodename}/level/15/exec/-/show/startup-config/CR
Have a look here for more info on configuring your Cisco devices to allow HTTP(S) uploads & downloads.You can even configure your devices using this method.
-=Cheers=-NG
---Orion V8.1 SLX, SLX secondary poller, SQL2005 x64 SE, 14GB Ram, 12k+ elements and counting--- ---Orion V9.1 SP2 SL2000, SQL2005 Express 866 elements and counting---
Mithrilhall:So, can this work if Cirrus & Orion are on different boxes?
That's what I want to know. We have 2 Cirrus boxes, 1 Orion NPM and 4 Orion pollers. All of them connect to 1 DB server but they have seperate DBs.BB
Is there any way to get the reports to show up without having to download the files everyday? We only download the files when there is a change.
Great News...
How would you do that so it shows the last downloaded config?
Haley: We commonly receive requests to be able to view configurations, config change reports, and inventory reports from the Cirrus Configuration Manager from the Orion web console. This feature has been available in the Additional Components section of the Customer Area for quite some time but many users were not aware of its existence. To make it easier, I have included links to the two additional components below. View Configs from the Orion Website: ftp://ftp.solarwinds.net/cmb03/cirrus/ConfigListing.zip View Cirrus Reports from the Orion Website: ftp://ftp.solarwinds.net/cmb03/cirrus/Cirrus-Reports-View.zip
I downloaded the Config listing enhancement and followed the install instructions. It was working fine and then I noticed that adding this code creates an ENORMOUS security hole in Orion. I hope the Solarwinds engineers take notice of this and fix it immediately.
First off, the page accepts un-validated strings to display files on the local server using the permissions of the user running IIS. This allows you to trivially modify the path to the config to something more interesting like the Windows SAM, the hosts file, or any number of XSS vulnerabilites. The page will happily display it.
EVEN WORSE, there is no validation being done that the user is even logged into ORION. So esentially it opens up annonymous file browsing of the entire server and all of the configs you have stored on it.
I have made some changes to the ConfigListing.asp that will validate that the user is logged in and validate the input at least matches the first 5 levels of the directory tree where the configs exist. As you read the code please keep in mind I am not a developer so this is probably very ugly, and may itself have it's own flaws but it at least addresses the problems I outlined above.(not 100% sure this resolves all XSS though)
Save this text into ConfigListing.asp and use it instead of the one provided by SolarWinds. Alter the variables used in the "vpath" array to match the first 5 levels of where you are storing your configs. In this it will expect the configs to be in d:\Program Files\SolarWinds\Configuration Management\Config-Archive
<!--#include Virtual=/NetPerfMon/scripts/NetPerfMon.asp -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Cirrus Device Configuration</title>
</head>
<body>
<pre>
<%
dim fs,f,ts,passedstring,pathArray,vpath(5)
set fs=Server.CreateObject("Scripting.FileSystemObject")
passedstring=(request.querystring)
pathArray=Split(passedstring,"\")
vpath(0)="file=D:"
vpath(1)="Program%20Files"
vpath(2)="SolarWinds"
vpath(3)="Configuration%20Management"
vpath(4)="Config-Archive"
SelectWeb("NetPerfMon")
If pathArray(0)<>vpath(0) Then
Response.Write("Invalid Filename!")
Else
If pathArray(1)<>vpath(1) Then
If pathArray(2)<>vpath(2) Then
If pathArray(3)<>vpath(3) Then
If pathArray(4)<>vpath(4) Then
If Not NetPerfMon.IsLoggedIn Then
If Not NetPerfMon.AutoLogin Then
Response.Redirect "/NetPerfMon/Login.asp"
End If
If (fs.FileExists(request.querystring("file")))=true Then
Set f=fs.GetFile(request.querystring("file"))
Set ts=f.OpenAsTextStream(1)
Response.Write(ts.ReadAll)
ts.Close
set ts=nothing
set f=nothing
Response.Write("File does not Exist.")
Response.End
set fs=nothing
%>
</pre>
</body>
</html>
I just tried out the Cirrus Report viewer that is being distributed by Solarwinds and found the same issues in it as in the Config viewer which are detailed in my above post. The Changes I used to fix it are below. I hope Solarwinds notices this thread and fixes the packages they are distributing.
To ensure the user is logged in and to perform input validation to the page follow the steps provided by SolarWinds to setup viewing Cirrus Reports. Once that is complete replace the CirrusReportAction.asp file with the text below. It assumes that the path for the reports is d:\InetPub\SolarWinds\NetPerfMon\Reports. If that is not how it is in your environemnt alter the variables loaded into the vpath array to match your path.(it is case sensitive)
<title>Cirrus Report</title>
set re=Server.CreateObject("VBScript.RegExp")
vpath(1)="InetPub"
vpath(3)="NetPerfMon"
vpath(4)="Reports"