Nut upsdev - Nov 2009 - Remote Monitoring From Web

Seems like remote monitoring of UPS from the Web UI is really porked.

Used to use ACL and ACCEPT in upsd.conf.  Since upgrading to Ubuntu 9.04
and the NUT that comes with it, all I get is whining about how ACL and
ACCEPT are no longer supported and I should use LISTEN.

When I use LISTEN, I see an error message about upsd not listening on
port 3493.  For example:

   LISTEN 192.168.1.1 3493

gives

   not listening on 192.168.1.1 port 3493

Any attempts to monitor this system's UPS from the Web UI is then met
with:

   error: Connection failure: Connection refused

Did anybody think this through before breaking it?  Apart from the fact
that LISTEN seems to be broken, how is one supposed to accept connections
from part of a network (e.g. 192.168.1.1/24) or reject connections from
a specific machine or range of machines.  LISTEN doesn't come even close
to the flexibility of ACL/ACCEPT.

Oh, and by the way.  Did anyone consider what rejecting previously
working options does for people who innocently upgrade their systems?
Most users would have spent a great deal of time setting up NUT and
getting it to work (having to get a half dozen configuration files right
is no simple task, not to mention udev, etc.).  Since release upgrades
are now merely a matter of clicking on a button in a GUI, it is quite
easy to do one by mistake -- no going back, though.  Then, all of a
sudden, everything stops working completely and there's no fixing it.

Old options should *never* be dropped, in my opinion.  Give some thought
to the poor schmuck who's just trying to keep his system up and running
and is only applying upgrades because he's worried about security.  He
neither wants nor needs new features.  And, he surely doesn't what to
spend a couple of days making something that worked yesterday work
again.  That ain't progress!

                                   Eric

Citeren Eric Wilde <ewilde at bsmdevelopment.com>:
> When I use LISTEN, I see an error message about upsd not listening on
> port 3493.  For example:
>
>   LISTEN 192.168.1.1 3493
>
> gives
>
>   not listening on 192.168.1.1 port 3493
Most likely, the port is already in use. What does 'netstat' say here.
> Any attempts to monitor this system's UPS from the Web UI is then met
> with:
>
>   error: Connection failure: Connection refused
>
> Did anybody think this through before breaking it?
Sure. And if you would have read the archives, you would also know why we did.
> Apart from the fact
> that LISTEN seems to be broken, how is one supposed to accept connections
> from part of a network (e.g. 192.168.1.1/24) or reject connections from
> a specific machine or range of machines.
Use a firewall and read the chapter on ACCESS CONTROL in 'man 8 upsd'.  
Together they will give you the same level of granularity.
> LISTEN doesn't come even close
> to the flexibility of ACL/ACCEPT.
There is nothing you can do with the previous ACL/ACCEPT mechanism  
that can't be done through LISTEN, tcp-wrappers and a firewall. And  
instead of giving you a false sense of security of the previous  
mechanism, this will actually work against attacks on your upsd server.

Best regards, Arjen
-- 
Please keep list traffic on the list