Nagios Fusion Changelog

Added

• Initial Release

Fixed

- Fixed issue where self-signed SSL certificates were not being accepted when getting XI user information [GL:FSN#160] - AC
- Fixed issue where the "only poll logged in" setting was not working properly [GL:FSN#158] - AC

Added

• Added Centralized Management, the ability to copy users from one XI server and push them to others [GL:FSN!154] – AC
• Added the ability to generate a diagnostic profile for support tickets directly from the UI – [GL:FSN#45] – DN

Fixed

• Fixed issue where the server polling interval was not being updated properly [GL:FSN#144] – AC
• Fixed issue where the Administrator and User Guides were not being displayed correctly [GL:FSN#147] – AC
• Fixed issue where the "ssl_hostname_verify" parameter was not being passed when adding a server via the API [GL:FSN#152] – AC
• Fixed issue where users located in AD groups would not show up in the "Add User from AD/LDAP" page [GL:FSN#18] – AC

Security

• Fixed session validation to force users to re-authenticate when enabling two-factor authentication [GL:FSN#92] – AC

Updated

• Updated feedback when changing the “Internal URL” setting for clarity [GL:FSN#23] – RP
• Updated the title of the “Home Page Settings” for individual users for clarity [GL:FSN#128] – RM

Removed

• Removed the “Signup for Nagios Fusion News” link in the Getting Started help section [GL:FSN#108] – RM

Added

• Added verbiage to the search bar on the “Find Objects” page for clarity [GL:FSN#139] – RM
• Added account lockout if too many failed two-factor authentication attempts are made [GL:FSN#93] – AC

Fixed

• Fixed a broken “Privacy Policy” link in the “Send Us Feedback” form [GL:FSN#101] – AC
• Fixed issue where sometimes the Account Information page would be the wrong color after changing a setting [GL:FSN#102] – AC
• Fixed issue where clicking the “Add new user accounts” link would erroneously open a new tab [GL:FSN#122] – RM
• Fixed issue where dashboards would erroneously appear in the left menu [GL:FSN#119] – RM
• Fixed issue where the “Cancel” button in “Home Page Settings” wouldn’t properly close the page [GL:FSN#132] – RM
• Fixed several issues with the chart context menu in the top right of graphs [GL:FSN#106] – RM
• Fixed issue where Health Summary graph data wasn’t being updated properly if the fused server went down [GL:FSN#129] – RP
• Fixed form validation for the “Default Interval Settings” in Admin System Settings to only accept valid values [GL:FSN#125] – RP
• Fixed form validation when adding a Dashlet [GL:FSN#136] – RP
• Fixed form validation when adding a Dashboard [GL:FSN#135] – RP
• Fixed issue where graphs would display as the wrong color in PDF exports [GL:FSN#105] – RP
• Fixed issue where the Fusion Subsystem Status “Clear Polling Locks” tooltip wouldn’t close properly [GL:FSN#143] – RM
• Fixed several issues encountered when sending test emails [GL:FSN#32, #126] – RM, DN
• Fixed where radio buttons in “Deploy Dashboards” couldn’t be repeatedly toggled properly [GL:FSN#123] – RP
• Fixed the background color not being properly set when adding a Dashboard [GL:FSN#124] – JJ
• Fixed issue where some dashlets weren’t resizing properly [GL:FSN#127] – RM
• Fixed several issues with tooltips across the application [GL:FSN#131, #133] – DN
• Fixed issue with “Fusion Subsystem Status” Dashlet that causes the “Clear Polling Locks” tooltip to be hidden by other dashlets [GL:FSN#138] – DN
• Fixed issue where the “Purchase a license now” link on License Information page was routing users to the wrong URL [GL:FSN#110] – RM
• Fixed issue where the “Number Format” option in Account Information couldn’t be changed [GL:FSN#121] – DN
• Fixed issue where some URLs were breaking the Custom URL Dashlet [GL:FSN#137] – JJ

Updated

• Improved communication between Fusion and its Fused Servers [GL:FSN!114] – AC

Added

• Added Debian 12 support [GL:FSN#71] – AC
• Added the ability to see more than the 15 most recent alerts and also filter them [GL:FSN!117] – AC

Fixed

• Fixed timezones not always updating to US/* timezones [GL:FSN#90] – AC

Added

• Added two factor email authentication support [GL:FSN#89] – AC

Updated

• Updated username character restrictions to standardize with Nagios XI [GL:FSN#85] – AC

Deprecated

• Deprecated Debian 10 [GL:FSN!109] – AC

Fixed

• Fixed issue where Recent and Top Alerts tables would sometimes be malformed [GL:FSN!104] – AC
• Fixed issue where installation would sometimes not finish due to an invalid timestamp conversion [GL:FSN#82] – AC
• Fixed issue where upgrade script would run previous database version migrations [GL:FSN#87] – AC
• Fixed issue where testing fused server would not honor proxies [GL:FSN#21] – AC

Deprecated

• Deprecated CentOS 8 Stream – AC

Added

• Added Ubuntu 24 support [GL:FSN#72] – AC
• Added search capability when adding users from AD/LDAP [GL:FSN#8] – AC
• Added configurable page refresh setting for the server status pages [GL:FSN#42] – AC
• Added ability for users to customize the email sent to new users [GL:FSN#11] – AC

Fixed

• Fixed issue where LDAP would not show users properly – AC
• Fixed issue where an error was sometimes thrown when sending emails on Debian 10/11 [GL:FSN#16] – AC

Deprecated

• Deprecated Ubuntu 18 [GL:FSN#73] – AC

Added

• Added fusing option to toggle hostname validation for SSL-enabled servers [GL:FSN#5] – AC
• Added a warning banner to alert users that FIPS is not supported and may negatively impact their experience [GL:FSN#43] – AC

Fixed

• Fixed an issue where the system status background job was reporting invalid hardware metrics [GL:FSN#2] – AC
• Fixed an issue where the polling background job was causing the system hard drive to run out of space [GL:FSN#24] – AC
• Fixed an issue where dashlets would display a login page if the session expires [GL:FSN#27] – AC
• Fixed an issue where the core host/servicegroups would not appear in dashlet configurations [GL:FSN#79] – AC
• Fixed an issue where enabling debug mode would cause database errors [GL:FSN#81] – AC

Fixed

• Fixed an issue where MariaDB would cause installs to fail on CentOS 9 [GL:FSN#77] – AC
• Fixed an issue where Nagios Fusion was not able to poll host and service status data from Nagios Core – AC

Updated

• Fixed the ability to use numeric values as the server name [GL:FSN#69] – AC

Fixed

• Fixed issues with Open Service Problems and Open Host Problems dashlets being cutoff [GL:FSN#14] – AC
• Fixed use of deprecated PHP functions in AD/LDAP integration [GL:FSN#63] – SAW
• Fixed the Available Dashlets dashboard breaking if dashlets are added too quickly [GL:FSN#67] – AC
• Fixed the styling for LDAP/AD for the modern dark theme [GL:FSN#74] – AC
• Fixed rendering multiple NNA bandwith dashlets on the dashboard [GL:FSN#70] – AC

Updated

• Updated the navbar to align with the XI design standards for a more modern look and improved user experience [GL:FSN#54] -SG
• Updated the login page to align with the XI design standards for a more modern look and improved user experience [GL:FSN#57] – AC

Added

• Added dark theme and theme switching [GL:FSN#37], [GL:FSN#51] – AC
• Added Nagios Network Analyzer integration and dashlets [GL:FSN#64] – AC

Security

• Fixed XSS in Admin->LDAP/AD Integration (Thanks Tisha Manandhar for reporting this) [GL:FSN#58] – AC
• Fixed XSS in Admin->License Information (Thanks Tisha Manandhar for reporting this) [GL:FSN#59] – AC
• Fixed XSS in Admin->Email Settings (Thanks Tisha Manandhar for reporting this) [GL:FSN#60,61] – AC

Updated

• Updated jQuery to 3.6.0 [GL:FSN#41] – AC

Deprecated

• Deprecated support for Debian 9 and Ubuntu 16 due to end of life – AC

Removed

• Removed the Nagios World Conference link from the login page [GL:FSN#49] – AC

Added

• Added support for CentOS/RHEL 9, Ubuntu 22, and Debian 11 [GL:FSN#29], [GL:FSN#30], [GL:FSN#31] – AC
• Added support for PHP 8 – AC
• Added a home screen notification that shows the number of failed login attempts [GL:FSN#3] – AC

Fixed

• Fixed an issue where users were unable to Auto-Login to XI [GL:FSN#20] – AC
• Fixed an issue where a whitescreen would occur if license activation failed – AC
• Fixed an issue where Authentication Type gets stuck as Session Authentication and has to be manually reset [GL:FSN#1] – AC
• Fixed an issue where the log files were not being rotated properly [GL:FSN#35] – AC
• Fixed an issue where the Home page would be blank when set as a dashboard – AC
• Fixed an issue where the last successful and failed login times would not update [GL:FSN#3] – AC
• Fixed an issue where the Service Status dashlet would perpetually load – AC
• Fixed an issue where no ip was returned when upgrading on CentOS 8 [GL:FSN#19] – AC
• Fixed an issue where users were being redirected after applying component settings [GL:FSN#62] – AC
• Fixed an issue where the menu bar system status server links would redirect to an empty edit page [GL:FSN#28] – AC
• Fixed an issue where dashlets would vanish if background was set as transparent [GL:FSN#47] – AC
• Fixed an issue where TLS was automatically enabled when sending email alerts [GL:FSN#15] – AC
• Fixed an issue where timezones were not always being set properly [GL:FSN#38] – AC
• Fixed an issue where users were not being sorted alphabetically when selecting user mappings [GL:FSN#12] – AC
• Fixed an issue where languages were not being set properly [GL:FSN#44] – AC

Security

• The following vulnerabilities were mitigated: (Thanks to Shahar Zini and Samir Ghanem from Skylight Cyber Security for reporting them)
• Fixed XSS in several dashlets when attacker has control over fused server (CVE-2020-28903) – SAW
• Fixed authenticated remote code execution (from the context of a low-privilege user) (CVE-2020-28905) – SAW
• Fixed privilege escalation from apache to nagios via command injection in cmd_subsys.php (CVE-2020-28902) – SAW
• Fixed privilege escalation from apache to nagios via command injection in cmd_subsys.php (CVE-2020-28901) – SAW
• Fixed privilege escalation from nagios to root via upgrade_to_latest.sh (CVE-2020-28900) – SAW
• Fixed privilege escalation from apache to root via upgrade_to_latest.sh and modification of proxy config (CVE-2020-28907) – SAW
• Fixed privilege escalation from nagios to root via modification of fusion-sys.cfg (CVE-2020-28906) – SAW
• Fixed privilege escalation from nagios to root via modification of scripts sudoers scripts (CVE-2020-28909) – SAW
• Fixed privilege escalation from apache to nagios via command injection in cmd_subsys.php (CVE-2020-28908) – SAW
• Fixed information disclosure – low-privilege user can discover passwords used to authenticate to fused servers (CVE-2020-28911) – SAW

Updated

• Updated the supported OS systems for RHEL/CentOS 8, CentOS Stream, Ubuntu 20.04 LTS, and Debian 10 -JO

Fixed

• Fixed issue where TLS/SSL wasn’t showing in LDAP/AD Integration page for servers with encryption selected [TPS#14734] -JO
• Fixed issue where Service Status dashlet would not show data unless users had access to host data [TPS#15420] -SAW

Security

• Updated SourceGuardian loaders to now support PHP versions up to 7.3 -JO
• Updated jQuery to a patched version 1.12.4 to fix CVE-2019-11358 -JO

Added

• Added option to stop polling when users are not logged in to stop large systems polling unnecessarily causing slowdowns -JO
• Added missing fullscreen button to most pages like in other products [TPS#12316] -SAW

Fixed

• Fixed wording for encryption STARTTLS in LDAP/AD Integration -JO
• Fixed bug causing ?brevity=1 to be appended (and ignored) when building polling URLs -BH,SW
• Fixed issue with LDAP/AD certificate management when binary data is in the certificate [TPS#14690] -JO
• Fixed issue with mapped user list not displaying when setting the current users mapped users [TPS#14561] -JO

Fixed

• Fixed bug preventing # in usernames and passwords of linked Nagios XI servers [TPS#13812] -SW
• Fixed forgot password link always giving an error about AD/LDAP when entering even a local user [TPS#13902] -SW
• Fixed issue with newer Debian 9 os-release not passing as a valid OS for install -JO
• Fixed problems with backup/restore script errors for apache cron jobs [TPS#13885] -JO
• Fixed admins not able to remove synced deploayed dashboards from themselves [TPS#14016] -JO

Updated

• Major performance increases with large number of mapped users -BH

Fixed

• Fixed new user created email to show actual username [TPS#13680] -JO
• Fixed link color to be easier to read in dashlets [TPS#12596] -SW

Security

• Fixed XSS in fusionwindow parameter [TPS#13368] -JO

Updated

• Change Custom URL dashlet to not be a core dashlet allowing it to be removed [TPS#13412] -SW

Fixed

• Fixed BPI dashlet showing broken data when only one BPI group exists on the XI server [TPS#13380] -JO
• Fixed adding new users with AD/LDAP from the API [TPS#13467] -JO
• Fixed allowing local auth login for AD/LDAP users when local auth login checkbox has not been checked [TPS#13469] -JO
• Fixed performance graph dashlet not working with XI 5.5+ systems [TPS#13457] -JO

Security

• Fixed various XSS vulnerabilities [TPS#13332-13335] -JO

Updated

• Update initial install mysql settings [TPS#13160] -JO

Fixed

• Fixed issue where manage views listing was always limited to 10 views [TPS#13156] -JO

Security

• Fixed some XSS vulnerabilities [TPS #13001] -CN,BH

Fixed

• Fixed issue where AD/LDAP component displayed a blank screen when attempting to login with incorrect credentials [TPS #13023] -CN
• Fixed issue where fusing an NLS server would show a blank Tactical Overview dashlet on the home page [TPS #13066] -CN
• Fixed issue where the Host&Service Health dashlet would display incorrect data if a server returned an empty data set. [TPS #13081,13100] -CN,BH
• Fixed indefinite log rotate (*.gz.1.gz.1.gz.1, etc.) [TPS#13061] -BH,LM

Fixed

• Fixed some wording in updates section -JO
• Fixed some miscellaneous upgrade issues in the 4.1.0 -> 4.1.1 path -BH

Added

• Added message to NLS dashlets to indicate when there is no dashlet data to display -CN
• Added ability to scroll in the NLS Index Statistics dashlet -CN

Updated

• Now show the authentication type of any given user on the Manage Users page – BH

Added

• Added the ability to manage authentication types in the Add/Edit User pages -CN
• Added the ability to add AD/LDAP users through the API -CN

Updated

• Updated Views rotation timer to not use previous ‘internal clock’. [TPS#12589] -SAW
• Updated fusion to not rely on a ‘nagiosadmin’ user [TPS#12606] -SAW
• Updated custom home page to allow external sites [TPS#12553] -SAW

Added

• Added license activation and added activation from inside the license pages -JO
• Added check for upgrades page/dashlet like other products -JO
• Added upgrade from the GUI like other products -JO
• Added proxy configuration page for updates, activation, and maintenance checks -JO
• Added AD/LDAP authentication component [TPS #12510] – CN
• Added several dashlets for integration with Nagios Log Server [TPS #12805] -CN
• Added API & various endpoints [TPS #12856] -CN
• Added way to monitor and clear polling locks from the admin menu [TPS #12675] -CN
• Added fix for large mysql ibdata files -BH

Fixed

• Fixed administrators being able to be excluded (can no longer be excluded from seeing server data) [TPS#12569] -SAW
• Fixed nagiosadmin so it cannot be unset as admin. Admins also cannot unset themselves in general [TPS#12606] -SAW
• Fixed polling lock expiry time not being checked properly -BH
• Fixed NSP error on login and javascript errors in IE -JO

Security

• Fixed xss vulnerabilties in users/servers (+ some) [TPS#12246,12247] -BH
• Changed ‘Force password change’ default on edit user [TPS#12396] -BH
• Fixed upgrade issues with sourceguardian loader -BH

Updated

• Update debug log to output proper global_auth_interval -JO
• Add ability to use relative paths in sys generated URLs [TPS#12481] -BH

Added

• Added sanity testing script -BH
• Added sanity tests to upload component/dashlets to detect errors and prevent installation [TPS#12243] -BH

Fixed

• Fixed exclusions/server mappings working on newly created users [TPS#12395] -BH
• Fixed trial extension [TPS#12254] -BH
• Fixed locale being unable to reset to en_US after selecting another [TPS#12209] -BH
• Fixed home/screen overwrite issue with deployed dashboards [TPS#12212] -BH

Updated

• Initial re-write release -BH
• Completely rewrote Polling System, with configurable options in Admin/Settings (or per server) -BH
• Rewrote Network Operations Center component -BH
• Recreated existing dashlets -BH
• Built similar component/dashlet systems as in XI -BH
• Changed Manage Components / Manage Dashlets to be similar to XI -BH

Added

• Added Views functionality like in XI -BH
• Added user mapping (to allow for true multitenancies. User can only see what the mapped user can see) -BH
• Added poll callbacks (to hook functionality in to polling subsystem) -BH
• Added averages/deltas to numeric polled data (as a callback) -BH
• Added ability to track timezone per server, so that display times are accurate -BH,JO
• Added clickthru links to NOC dashlets, Alert dashlets, and Tactical dashlets -BH
• Added Custom Logo component -BH
• Added Custom Login component -BH
• Added Home Page Modification component -BH
• Added Deploy Dashboards component (with a ‘Deployed/Synced Dashboards’ page as well) -BH
• Added ‘Test Fusion Settings’ to Servers page -BH
• Added better auto-login functionality -BH,JO
• Added CSRF prevention when adding an XI server -JO
• Added better logging system and Admin/Log page -BH
• Added better Dashlet system (all dashlets have on-the-fly changeable settings, etc.) -BH
• Added static landing page -BH