whmcs-status: 403 error recieved

[scarecr0w12]

This issue respects the following points:

• This is a bug, not a question or a setup/configuration issue.
• This issue is not already reported on Github (I've searched it).
• I use the latest release of the Monitoring Plugins (https://github.com/Linuxfabrik/monitoring-plugins/releases).
• I agree to follow Monitoring Plugins's Code of Conduct.

Which variant of the Monitoring Plugins do you use?

• .rpm/.deb package from repo.linuxfabrik.ch
• Compiled for Linux from download.linuxfabrik.ch
• Compiled for Windows from download.linuxfabrik.ch
• Source Code from GitHub

Bug description

When trying to run the WHMCS-Status check, a 403 is returned to icinga2, however running the check manually via CLI returns expected responses.

Steps to reproduce - Plugin call

'/usr/lib64/nagios/plugins/whmcs-status' '--identifier' '' '--insecure' '--password' '' '--secret' '' '--timeout' '10' '--url' 'https://clientarea.thecorehosting.net/' '--username' ''

Steps to reproduce - Data

HTTP error "403 Forbidden" while fetching https://clientarea.thecorehosting.net//includes/api.php
Is returned when attempting to run the check via the Icinga2 Web

root@vin-mon-master:~/monitoring-plugins# '/usr/lib64/nagios/plugins/whmcs-status' '--identifier' '<api-Identifier>' '--insecure' '--password' '<user-password>' '--secret' '<api-secret>' '--timeout' '10' '--url' 'https://clientarea.thecorehosting.net/' '--username' '<username>'
There are 6 messages, ordered by severity.

* PHP: Your system is set to display errors. While this is useful for some debugging situations, it can interfere with some operations and is a security risk. For more information please refer to our documentation. (error) [WARNING]
* WHMCS: Your configuration file is writable. This can be a security risk. We recommend setting the permissions to read only.You can learn more about this in our documentation. (error) [WARNING]
* PHP: Your environment appears to be running a different PHP version (*8.1.32*) for the System Cron than the currently loaded PHP version (*8.2.28*). This may cause issues running your System Cron. Learn More (warning) [WARNING]
* WHMCS: Customising the default directory paths for some parts of WHMCS makes it more difficult for malicious users to find them. Your installation is currently using the following default paths: *templates_c*.  *crons*. Please refer to our Further Security Steps for information on how to change these. (warning) [WARNING]
* WHMCS: Module debugging is currently enabled. We recommend that you disable this when you finish debugging. Continuous use may degrade performance. For more information, see our documentation. (warning) [WARNING]
* PHP: Your PHP version *8.2.28* is supported by WHMCS. Your PHP version does not receive regular updates but is the latest supported by WHMCS. (info)

Environment

Linux vin-mon-master 6.8.0-53-generic #55-Ubuntu SMP PREEMPT_DYNAMIC Fri Jan 17 15:37:52 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Plugin Version

whmcs-status: v2025021501 by Linuxfabrik GmbH, Zurich/Switzerland

Python version

No response

List of Python modules

No response

Additional Information

No response

[markuslf]

I suspect this is not plugin related - the check tries to access WHCMS, but it is not allowed. What if you run the same command as user "icinga" with sudo -u icinga '/usr/lib64/nagios/plugins/whmcs-status' '--identifier' ...? Where does whmcs-status run on in IcingaWeb2?