View Configurations from Orion Website

We commonly receive requests to be able to view configurations, config change reports, and inventory reports from the Cirrus Configuration Manager from the Orion web console.

This feature has been available in the Additional Components section of the Customer Area for quite some time but many users were not aware of its existence. To make it easier, I have included links to the two additional components below.

View Configs from the Orion Website:

ftp://ftp.solarwinds.net/cmb03/cirrus/ConfigListing.zip

View Cirrus Reports from the Orion Website:

ftp://ftp.solarwinds.net/cmb03/cirrus/Cirrus-Reports-View.zip

Find more posts tagged with

cirrus

Security

download

config

customize

orion

Database

cirrus_reports_orion_security

Accepted answers

All comments

BryanBecker

How does this work when your Cirrus server and Orion server are separate boxes? Furthermore in our design the server running the Orion web site is in a DMZ.

TIA.

BB

aLTeReGo

This may not be as cool, or it might be ever cooler, depending on your point of view. You can create a custom link in Orion to view the running or startup configuration of any Cisco device running the http daemon with the following links, no Cirrus needed

https://${nodename}/level/15/exec/-/show/running-config/CR

https://${nodename}/level/15/exec/-/show/startup-config/CR

Mithrilhall

Nice aLTeReGo.

Network_Guru

Have a look here for more info on configuring your Cisco devices to allow HTTP(S) uploads & downloads.
You can even configure your devices using this method.

rdeprez

We commonly receive requests to be able to view configurations, config change reports, and inventory reports from the Cirrus Configuration Manager from the Orion web console.
This feature has been available in the Additional Components section of the Customer Area for quite some time but many users were not aware of its existence. To make it easier, I have included links to the two additional components below.
View Configs from the Orion Website:
ftp://ftp.solarwinds.net/cmb03/cirrus/ConfigListing.zip
View Cirrus Reports from the Orion Website:
ftp://ftp.solarwinds.net/cmb03/cirrus/Cirrus-Reports-View.zip

I downloaded the Config listing enhancement and followed the install instructions. It was working fine and then I noticed that adding this code creates an ENORMOUS security hole in Orion. I hope the Solarwinds engineers take notice of this and fix it immediately.

First off, the page accepts un-validated strings to display files on the local server using the permissions of the user running IIS. This allows you to trivially modify the path to the config to something more interesting like the Windows SAM, the hosts file, or any number of XSS vulnerabilites. The page will happily display it.

EVEN WORSE, there is no validation being done that the user is even logged into ORION. So esentially it opens up annonymous file browsing of the entire server and all of the configs you have stored on it.

I have made some changes to the ConfigListing.asp that will validate that the user is logged in and validate the input at least matches the first 5 levels of the directory tree where the configs exist. As you read the code please keep in mind I am not a developer so this is probably very ugly, and may itself have it's own flaws but it at least addresses the problems I outlined above.(not 100% sure this resolves all XSS though)

Save this text into ConfigListing.asp and use it instead of the one provided by SolarWinds. Alter the variables used in the "vpath" array to match the first 5 levels of where you are storing your configs. In this it will expect the configs to be in d:\Program Files\SolarWinds\Configuration Management\Config-Archive

<html>

<head>

<title>Cirrus Device Configuration</title>

</head>

<body>

<pre>

dim fs,f,ts,passedstring,pathArray,vpath(5)

set fs=Server.CreateObject("Scripting.FileSystemObject")

passedstring=(request.querystring)

pathArray=Split(passedstring,"\")

vpath(0)="file=D:"

vpath(1)="Program%20Files"

vpath(2)="SolarWinds"

vpath(3)="Configuration%20Management"

vpath(4)="Config-Archive"

SelectWeb("NetPerfMon")

If pathArray(0)<>vpath(0) Then

Response.Write("Invalid Filename!")

Else

If pathArray(1)<>vpath(1) Then

Response.Write("Invalid Filename!")

Else

If pathArray(2)<>vpath(2) Then

Response.Write("Invalid Filename!")

Else

If pathArray(3)<>vpath(3) Then

Response.Write("Invalid Filename!")

Else

If pathArray(4)<>vpath(4) Then

Response.Write("Invalid Filename!")

Else

If Not NetPerfMon.IsLoggedIn Then

If Not NetPerfMon.AutoLogin Then

Response.Redirect "/NetPerfMon/Login.asp"

End If

Else

If (fs.FileExists(request.querystring("file")))=true Then

Set f=fs.GetFile(request.querystring("file"))

Set ts=f.OpenAsTextStream(1)

Response.Write(ts.ReadAll)

ts.Close

set ts=nothing

set f=nothing

Else

Response.Write("File does not Exist.")

End If

Response.End

set fs=nothing

</pre>

</body>

</html>

rdeprez

We commonly receive requests to be able to view configurations, config change reports, and inventory reports from the Cirrus Configuration Manager from the Orion web console.
This feature has been available in the Additional Components section of the Customer Area for quite some time but many users were not aware of its existence. To make it easier, I have included links to the two additional components below.
View Configs from the Orion Website:
ftp://ftp.solarwinds.net/cmb03/cirrus/ConfigListing.zip
View Cirrus Reports from the Orion Website:
ftp://ftp.solarwinds.net/cmb03/cirrus/Cirrus-Reports-View.zip

I just tried out the Cirrus Report viewer that is being distributed by Solarwinds and found the same issues in it as in the Config viewer which are detailed in my above post. The Changes I used to fix it are below. I hope Solarwinds notices this thread and fixes the packages they are distributing.

To ensure the user is logged in and to perform input validation to the page follow the steps provided by SolarWinds to setup viewing Cirrus Reports. Once that is complete replace the CirrusReportAction.asp file with the text below. It assumes that the path for the reports is d:\InetPub\SolarWinds\NetPerfMon\Reports. If that is not how it is in your environemnt alter the variables loaded into the vpath array to match your path.(it is case sensitive)

<html>

<head>

<title>Cirrus Report</title>

</head>

<body>

dim fs,f,ts,passedstring,pathArray,vpath(5)

set fs=Server.CreateObject("Scripting.FileSystemObject")

set re=Server.CreateObject("VBScript.RegExp")

passedstring=(request.querystring)

pathArray=Split(passedstring,"\")

vpath(0)="file=D:"

vpath(1)="InetPub"

vpath(2)="SolarWinds"

vpath(3)="NetPerfMon"

vpath(4)="Reports"

SelectWeb("NetPerfMon")

If pathArray(0)<>vpath(0) Then

Response.Write("Invalid Filename!")

Else

If pathArray(1)<>vpath(1) Then

Response.Write("Invalid Filename!")

Else

If pathArray(2)<>vpath(2) Then

Response.Write("Invalid Filename!")

Else

If pathArray(3)<>vpath(3) Then

Response.Write("Invalid Filename!")

Else

If pathArray(4)<>vpath(4) Then

Response.Write("Invalid Filename!")

Else

If Not NetPerfMon.IsLoggedIn Then

If Not NetPerfMon.AutoLogin Then

Response.Redirect "/NetPerfMon/Login.asp"

End If

Else

If (fs.FileExists(request.querystring("file")))=true Then

Set f=fs.GetFile(request.querystring("file"))

Set ts=f.OpenAsTextStream(1)

Response.Write(ts.ReadAll)

ts.Close

set ts=nothing

set f=nothing

set fs=nothing

Else

Response.Write("File does not Exist.")

End If

</body>

</html>

Haley

Thanks for posting your input and adjustments to the View Cirrus Configs and View Cirrus Reports resources that are available in Additional Components. We plan to evaluate and update the ability to view Cirrus Reports and Configs from the Orion website in the next major Cirrus release.

salparadise

THANKS!!!

Just noticed that. I can't believe they didn't release something.

salparadise

I need this link to be a folder listing of all the configurations below that caption folder. Is there any way to edit the ASP code to list the folder contents instead of the configuration backed up from the previous day?

Thanks

Haley

You can modify the any of the files listed within the "View Cirrus configs from the Orion website" zip to include the information you want to see. However, we do not currently have any documentation other than the setup instructions provided within the zip file.

chris.schear

Do all the possible variables work, as ${nodename}, including CustomProperties? I've wanted to add a resource to my Node Details, that has a link to a "Network Diagram" for that particular node, but didn't realize we could use variables in the URLs. I assume if you can use ${nodename}, there would be nothing precluding me from using <img src='http://...${CustomProperty#12345}.jpg'>, etc.

SamuelB

Has anyone currently found a way to restrict access to the Cirrus Config Listing resource depending on the user? I have some users that I want to give access to view node details, but not allow access to view/read the config, all while maintaining the ability for others to continue to view the configurations on those nodes.