define command{
    command_name negate_check_tcp
    command_line $USER1$/negate $USER1$/check_tcp -H $HOSTADDRESS$ -p $ARG1$ $ARG2$
}

2026-11-06

Ubuntu snap munin

$ df -h
Filesystem       Size  Used Avail Use% Mounted on
/dev/root         29G  6.7G   23G  23% /
tmpfs            3.8G     0  3.8G   0% /dev/shm
tmpfs            1.6G  924K  1.6G   1% /run
tmpfs            5.0M     0  5.0M   0% /run/lock
/dev/nvme1n1      40G  1.6G   36G   5% /www/docs
/dev/nvme0n1p15  105M  6.1M   99M   6% /boot/efi
tmpfs            774M  4.0K  774M   1% /run/user/1313
tmpfs            1.0M     0  1.0M   0% /var/snap/lxd/common/ns

$ losetup -a
/dev/loop1: []: (/var/lib/snapd/snaps/amazon-ssm-agent_13349.snap)
/dev/loop8: []: (/var/lib/snapd/snaps/snapd_28332.snap)
/dev/loop6: []: (/var/lib/snapd/snaps/core22_2437.snap)
/dev/loop4: []: (/var/lib/snapd/snaps/core20_2866.snap)
/dev/loop2: []: (/var/lib/snapd/snaps/core18_2999.snap)
/dev/loop0: []: (/var/lib/snapd/snaps/amazon-ssm-agent_13009.snap)
/dev/loop9: []: (/var/lib/snapd/snaps/lxd_40911.snap)
/dev/loop7: []: (/var/lib/snapd/snaps/core22_2955.snap)
/dev/loop5: []: (/var/lib/snapd/snaps/core20_2922.snap)
/dev/loop12: []: (/var/lib/snapd/snaps/lxd_41283.snap)
/dev/loop3: []: (/var/lib/snapd/snaps/core18_3084.snap)
/dev/loop10: []: (/var/lib/snapd/snaps/snapd_28254.snap)

df /var/snap以下は除外

[df*]
env.exclude_re ^(/run/user|/var/snap)

diskstats /dev/loop* は除外

[diskstats]
env.exclude loop

2026-11-03

CVE-2026-98432 nftables iptables 緩和策

iptables 版 (nftables 環境でも iptables-nft 互換レイヤが入っていれば利用可)
sudo iptables -t raw -I PREROUTING 1 -p tcp -m u32 --u32 '0>>24&0x0F=0x06:0x0F' -j DROP
nftables 版 (推奨: counter で遮断数を観測できる。ファイルに保存して sudo nft -f ファイル名で読込む)
table inet cve_2026_98432 {
chain pre { type filter hook prerouting priority -310; policy accept;
ip protocol tcp ip hdrlength gt 5 counter drop; }
}
https://dnobori.cyber.ipa.go.jp/ppt/download/20261031/261031-HowToProtect-Linux-Kernel-CVE-2026-98432.pdf

nftables

sudo nft -f - <<'EOF'
add table ip cve_2026_98432
delete table ip cve_2026_98432
table ip cve_2026_98432 {
    chain prerouting {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength > 5 counter drop
    }
}
EOF
The nft command comes from the nftables package, which is installed together with firewalld. If it is missing, install it with sudo dnf install -y nftables first.
The rule does not survive a reboot. If you reboot before you can install the patched kernel, run the command again.
Check that the rule is active. The counter shows how many packets it has dropped:
sudo nft list table ip cve_2026_98432
https://almalinux.org/blog/2026-10-30-cve-2026-98432/

永続化はされない

iptables

Customers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:
iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP
https://aws.amazon.com/jp/security/security-bulletins/2026-160-aws/

ufw

/etc/ufw/before.rules

# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
の後に
# CVE-2026-98432 mitigation: drop TCP packets carrying IPv4 extended options
-A ufw-before-input -p tcp -m u32 --u32 "0>>24&0x0f=6:15" -j DROP
を追加して

sudo ufw reload

2026-11-02

nagios セミコロン

nagios

NOTE: You may not include a semicolon (;) in a
command_line directive, because everything after it will be ignored as a .cfg
file comment. You can work around this by calling a wrapper shell script that
does what you want, or you can set one of the $USER$ macros in your resource file to a semicolon and use it in place of the semicolon.

I discovered a different workaround for semicolons in command_line directives:
in resource.cfg:
$USER9$=;
then in the command definition I can use:
	command_line	$USER1$/contrib/check_oracle_instance.pl -ufoo -pbar
-c"host=host_foo$USER9$sid=oracle_sid_foo" -a
https://sourceforge.net/p/nagios/mailman/message/10111816/

2026-11-01

CVE-2026-98432

Linux Kernelの脆弱性(Critical: CVE-2026-98432) - SIOS SECURITY BLOG

Linuxカーネルの脆弱性 CVE-2026-98432 についてまとめてみた - piyolog

2026 年 10 月 31 日追記: Amazon Linux Security Center の情報が更新されました。
Amazon の CVSS スコアが 7.0 から 8.1 に変わりました。
Amazon Linux 2023 の kernel（6.1）、Amazon Linux 2 の Advisory がリリースされ、Status が Fixed になりました。
Amazon Linux 2023 で CVE-2026-98432 のカーネル更新を確認してみた（Linux カーネルの TCP の脆弱性） | DevelopersIO

AWS

https://explore.alas.aws.amazon.com/CVE-2026-98432.html

Fixed

AL2 kernel-4.14.355-287.758.amzn2.x86_64
AL2023 (6.1) kernel-6.1.189-236.400.amzn2023.x86_64
AL2023 6.12 kernel6.12-6.12.113-138.209.amzn2023.x86_64
AL2023 6.18 kernel6.18-6.18.56-125.164.amzn2023.x86_64

Ubuntu

https://ubuntu.com/security/CVE-2026-98432

AlmaLinux

Patched kernel versions
AlmaLinux 8: kernel-4.18.0-553.180.2.el8_10
AlmaLinux 9: kernel-5.14.0-687.61.2.el9_8
AlmaLinux 10: kernel-6.12.0-211.69.2.el10_2
https://almalinux.org/ja/blog/2026-10-30-cve-2026-98432/

~~almalinux-testing を一時利用~~

~~almalinux-testing でないと kernel-5.14.0-687.61.1.el9_8 (11/2時点)~~

2026-11-02: The CVE-2026-98432 fix is now included in the regular AlmaLinux kernel updates in the production repositories for AlmaLinux 8, 9, and 10. You no longer need to enable the testing repo. Just run:

almalinux-testing 使わなくてOK

2026-10-28

ftpaccess XServer

ファイルマネージャのIPアドレス（127.0.0.1）

追加FTPアカウントに対する制限方法とご注意
追加FTPアカウントの「ディレクトリ」設定でFTPへのログインディレクトリを設定されている場合、該当するディレクトリに「.ftpaccess」を設置する必要があります。
「/home/サーバーID/ドメイン名/」というように、ディレクトリを個別に指定されている場合、「.ftpaccess」を同一ディレクトリへと設置してください。
https://www.xserver.ne.jp/manual/man_ftp_ftpaccess.php