How to correctly implement mitigation for werk 17348

Troubleshooting
1

CMK version: 2.3.0p30
OS version: RHEL9

Error message: none

Hello everyone,
I tried to implement the mitigation of Werk #17348: Disable access to check_mk/local/agents/, and created a config file with the code
Redirect gone /sitename/check_mk/local/agents
but the directory index is still displayed when I open https://servername/sitename/check_mk/local/agents/ in my browser.

Looks like the configuration I made is reactivated in a different configuration file again.
I tried to put 000_werk_17348.conf in
/opt/omd/sites/sitename/etc/apache/conf.d
/opt/omd/apache
/etc/httpd/conf.d
and restarted httpd every time.

What is the correct path to put the 000_werk_17348.conf configuration file?

2

Hi,

have you been restarting the httpd on your host or have you been restarting the apache of the checkmk site?

As per the location: the werk mentions the site dir, so it would be under /opt/omd/sites/name/etc/apache/conf.d/

3

Hi and thanks for your reply.

I tried both. First with omd restart sitename and after that systemctl restart httpd.

It’s currently there.

4

Didn’t solved my initial question, but I managed to get a workaround running:

Changed the file /opt/omd/sites/vwif/etc/check_mk/apache.conf

<Directory /omd/sites/vwif/share/check_mk/agents>
# https://checkmk.com/werk/17348
# Werk #17348: Disable access to check_mk/agents/
#
# Options +Indexes => Options -Indexes
  Options -Indexes
  Order deny,allow
  allow from all
</Directory>

# Same for the local hierarchy
Alias /vwif/check_mk/local/agents /omd/sites/vwif/local/share/check_mk/agents
<Directory /omd/sites/vwif/local/share/check_mk/agents>
# https://checkmk.com/werk/17348
# Werk #17348: Disable access to check_mk/local/agents/
#
# Options +Indexes => Options -Indexes
  Options -Indexes
  Order deny,allow
  allow from all
</Directory>