Security concerns with Checkmk Werk 14079

[mike1098 (Michael FRANK)]

Hello Moritz,

Thank you for this modifications.

@moritz

For cmk-agent-ctl register (registration of an agent controller to an existing host) the user needs to fulfill (at least) one of the following conditions:

• They have the “Register any existing host” permission

That should finally eliminate my initial concern.

@moritz

For cmk-agent-ctl register-new (triggering an automation that ultimately creates a host on the site, registers the agent to it, discovers the a host and activates the changes) the user needs to fulfill
(at least) one of the following conditions:

• They have the “Register any new host” permission

About this I have a question:
As far as I know only the site to which the agent is registered can poll the agent. In a distributed environment with disabled Setup this means the registration hast to be done with the remote site. Will then the host created twice on master and on remote site or how does that works?