[Release] Checkmk stable release 2.5.0p13

Announcements
, , , ,
1

Dear friends of Checkmk,

the new stable release 2.5.0p13 of Checkmk is ready for download.

This stable release ships with 24 changes affecting all editions of Checkmk,
4 changes for all commercial editions, 3 Ultimate specific,
0 Ultimate with multi-tenancy specific and 0 Cloud specific changes.

Support periods can be found here: Checkmk versions

Changes in all Checkmk editions:

BI

  • 22091 FIX: bi: time out slow aggregation state requests…

Checks & agents

  • 20255 Monitor CPU, memory and module state on all HPE/H3C Comware switches…
  • 22275 Plug-in API cmk.password_store: allow hyphen in secret option…
  • 19921 FIX: CRIT state of ‘automation helpers’ service after update to 2.5…
  • 19725 FIX: MQTT: Fix missing services and UNKNOWN state for zero values…
  • 16930 FIX: OVS bonding: bonds not discovered on recent Open vSwitch versions…
  • 20199 FIX: Redfish: monitor rack PDUs that omit PowerEquipment from the service root…
  • 20198 FIX: Redfish: monitoring could stop after an interrupted agent run…
  • 22230 FIX: Redis databases: instance names with a hyphen were ignored…
  • 22197 FIX: agent_mobileiron: don’t crash when password store file is missing…
  • 18762 FIX: ups_capacity: Fix crash on negative remaining battery time…
  • 18763 FIX: ups_in_voltage, ups_out_voltage: Fix crash when UPS reports a non-numeric voltage…

Configuration generation

  • 19969 FIX: Auto-generated PING services can be disabled…
    NOTE: Please refer to the migration notes!

Event console

  • 19970 FIX: Event Console: find the events of a host whose messages arrive with an IP address…

Livestatus

  • 19591 FIX: Fixed crashes while reading Livestatus commands…

Notifications

  • 19724 FIX: “Do not match Event Console alerts” matched only Event Console alerts…
    NOTE: Please refer to the migration notes!

REST API

  • 18241 FIX: REST API: permission denials now return 403 instead of 401 on some endpoints…
    NOTE: Please refer to the migration notes!
  • 20025 FIX: Fix crash when saving custom user attribute sync settings for an LDAP connection via the REST API…

Reporting & availability

  • 22107 FIX: product_usage: Cron job should not write to STDOUT…

Setup

  • 18761 FIX: Site connections: Reject site IDs that cannot be an OMD site name…
    NOTE: Please refer to the migration notes!
  • 20221 FIX: Host and service name translation: correct regular expression help…
  • 22253 FIX: LDAP: first login of a user who does not exist in Checkmk yet failed…

User interface

  • 20085 FIX: Bearer token authentication no longer starts a GUI session…
  • 20197 FIX: Widget wizard: state the real reason a visualization is unavailable…

Changes in Checkmk commercial editions:

Agent Bakery

  • 16469 FIX: MTR agent bakery rule: allow IPv6 addresses as destination…

Checks & agents

  • 20075 FIX: Agent controller: Renew agent certificates rejected by Checkmk 3.0…
    NOTE: Please refer to the migration notes!

REST API

  • 22263 New: MCP server lets AI agents query Checkmk monitoring data (experimental feature)…

User interface

  • 22264 New: built-in OAuth 2.0 authorization server (experimental feature)…

Changes in Checkmk Ultimate:

Relay

  • 19543 FIX: Fixed relay certificate renewal that silently failed since 2.5.0p9…

Setup

  • 20222 FIX: Agent registration: correct regular expression help…

Telemetry

  • 19746 FIX: OTel: Fix aborted update on invalid collector configurations…

Changes in Checkmk Cloud:

NO CHANGES

Changes in Checkmk Ultimate with multi-tenancy:

NO CHANGES

You can download Checkmk from our download page: https://checkmk.com/download

List of all changes: https://checkmk.com/werks?product=cmk&version=2.5.0p13

We greatly thank you for using Checkmk and wish you a successful monitoring,

Your Checkmk Team

1 Like
2

In case you experience

Checkmk: Site not started

after the update (and despite the site running), please run

omd update-apache-config sitename

as root to update the site related system Apache configuration. This is most likely when you are running a vanilla Apache without HTTPS. In case you have configured HTTPS as described here, you probably do not experience any issues.

1 Like
3

Why on earth would one want a monitoring solution to become an authorization server ?
This is (IMHO) mixing roles on a server that should not be mixed.

Instead (again IMHO) next to SAML(2) an implementation of OIDC should have been developed to connect to a/an IDP/authorization source.

In most organizations there is an agreement/understanding to have one authoritative source, and common solution is to have this as a dedicated solution (keycloak, fusionauth, NetIQ/Opentext AccessManager.. etc)

So introducing this authorization feature is from my point of view a complete miss, and to put it more harsh, even unwanted as its staining the purpose of a ‘monitoring-solution’

Instead please make CheckMK capable of CONNECTING/make use of an already in-place organizational Authentication/Authorization server via multiple protocols (SAML works, OIDC needs work)

  • Glowsome
4

If I remember correctly, this is necessary for the experimental MCP server that is also shipped with 2.5.0p13.

1 Like
5

We added an OAuth authorization server mainly because our new MCP server needs it. The MCP protocol requires OAuth2.1 for self-service signup.

OAuth’s role next to OIDC and SAML often causes confusion, so a quick clarification:

  • OAuth delegates access; it doesn’t manage identity. It mints access tokens for the REST API so a user can let an external app act on their behalf, without handing over a password.
  • It works with your existing identity provider, not around it. If you use LDAP or SAML today, that doesn’t change. The OAuth server checks your identity there first, then issues the token.

MCP is why we built this now, but not the only reason. An OAuth server also gives us room to simplify some of our older authorization mechanisms later.

1 Like