Bug 469530

Oops! Only the nagios package creates the nagios user (the nrpe creates the nrpe account).

This bug appears to have been reported against 'rawhide' during the Fedora 10 development cycle.
Changing version to '10'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

We could simply copy the user creation from nagios.spec, but I have no ideas, which side-effects this may have. Any ideas ?

*** Bug 471481 has been marked as a duplicate of this bug. ***

What about creating a nagios-common package that would

  i) create the nagios account
 ii) own the /etc/nagios directory

and have nagios, nrpe, and some of the nagios-plugins (the ones that have setuid scripts) require it?

This change would require that the nrpe daemon stopped being run under the nrpe account and started being run under the nagios account. Does anyone knows any problem that this change would cause?

Possible problem: as I have never configured a ncsa daemon, I don't know if it 
needs to be executed under a different account (e.g. nagios).

Other small changes that I would like to see:
 * rename the nrpe package to nagios-nrpe
 * rename the ncsa package to nagios-ncsa


/jpo

Ethan promised me for 3.1 an Apache style config-file (recursive cfg_dir includes) to make packaging addons (pnp4nagios...) more easy.

When this happens nearly all Nagios related stuff has to be modified, as the config-files should go into something like /etc/nagios/conf.d .

Perhaps we can do this for 3.1 ?

Nagios 3.1.0 is out.

Changelog:
http://www.nagios.org/development/history/nagios-3x.php

I wonder if this is related.   I upgraded to fc10 and all of a now check_dhcp doesn't work.   It says it is not getting an offer, when it is not sending out a request.

*** Bug 506024 has been marked as a duplicate of this bug. ***

*** Bug 499446 has been marked as a duplicate of this bug. ***

This message is a reminder that Fedora 10 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 10.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '10'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 10's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 10 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

This bug still affects Fedora 12, on a system without Nagios installed but with NRPE:

# yum install nagios-plugins-ide_smart
...
  Installing     : nagios-plugins-ide_smart-1.4.13-17.fc12.x86_64           1/1 
warning: group nagios does not exist - using root

Installed:
  nagios-plugins-ide_smart.x86_64 0:1.4.13-17.fc12

Fedora 10 changed to end-of-life (EOL) status on 2009-12-17. Fedora 10 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.

As per comment 12, this bug still exists in Fedora 12. I am, however, unable to change the "version" field of this bug.

(In reply to comment #14)
> As per comment 12, this bug still exists in Fedora 12. I am, however, unable to
> change the "version" field of this bug.  

Done (it is now targeting Fedora 12).

/jpo

I'll try to fix all this mess with nagios-related packages. including this particular issue.

nagios-plugins-1.4.14-2.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.el5

nagios-plugins-1.4.14-2.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.fc11

nagios-plugins-1.4.14-2.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.fc12

nagios-plugins-1.4.14-2.el4 has been submitted as an update for Fedora EPEL 4.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.el4

nagios-plugins-1.4.14-2.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.fc13

nagios-plugins-1.4.14-2.fc11 has been pushed to the Fedora 11 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.fc11

nagios-plugins-1.4.14-2.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.fc12

nagios-plugins-1.4.14-2.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.fc13

nagios-plugins-1.4.14-2.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.el5

nagios-plugins-1.4.14-2.el4 has been pushed to the Fedora EPEL 4 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-2.el4

nagios-plugins-1.4.14-2.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

nagios-plugins-1.4.14-2.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

nagios-plugins-1.4.14-2.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

The fix incorporated for this problem in nagios-plugins 1.4.14-2.fc12 is *not* the correct one - the package now requires nagios. Since this is not installed on my systems, updating the package results in extra packages (including a web server!) being installed on my workstations.

nagios-plugins should not pull in nagios - rather it should pull in either nagios or nrpe, and the setuid plugins should be owned by *either* the nagios or nrpe users. Please revert.

I'm experiencing here the same busted and broken behaviour! Ben, please add 
negative Karma in Bodhi.

The "nagios-plugins" tries to pull in "nagios" (including "httpd"), which
is fully fucked up - sorry.

I would suggest that the nagios package be modifed to add a nagios-user package that only performs the useradd/userdel for user nagios. The nagios and nagios-plugins packages should then be modified to require nagios-user.

Here is a first crack at a patch for both nagios.spec and nagios-plugins.spec:
--- nagios.spec.3.2.1	2010-03-13 01:50:43.000000000 -0500
+++ nagios.spec	2010-04-21 09:25:35.817864780 -0400
@@ -1,6 +1,6 @@
 Name: nagios
 Version: 3.2.1
-Release: 1%{?dist}
+Release: 1.1%{?dist}
 Summary: Host/service/network monitoring program
 
 Group: Applications/System
@@ -32,6 +32,7 @@
 Requires(preun): initscripts, chkconfig
 Requires(post): initscripts, chkconfig, shadow-utils
 Requires(postun): initscripts
+Requires: nagios-user
 
 Summary: Nagios monitors hosts and services and yells if somethings breaks
 Summary(de): Nagios überwacht Dienste und Rechner und meldet Ihnen Ausfälle
@@ -79,6 +80,15 @@
 This package provides include files that Nagios-related applications
 may compile against.
 
+%package user
+Group: Applications/System
+Summary: Provide the nagios user without requiring all of nagios.
+
+%description user
+The nagios-user package is responsible for adding and removing the 
+nagios user without requiring all of the overhead of a full-blown 
+nagios installation.
+
 %prep
 %setup -q
 %patch1 -p1 -b .fedora
@@ -155,7 +165,7 @@
 %clean
 rm -rf %{buildroot} > /dev/null 2>&1
 
-%pre
+%pre user
 %{_sbindir}/useradd -d %{_localstatedir}/spool/%{name} -r -s /sbin/nologin nagios 2> /dev/null || :
 
 %preun
@@ -172,6 +182,9 @@
 %postun
 /sbin/service httpd condrestart > /dev/null 2>&1 || :
 
+%post user
+%{_sbindir}/userdel -r nagios 2> /dev/null || :
+
 %files
 %defattr(-,root,root,-)
 %dir %{_sysconfdir}/%{name}
@@ -209,7 +222,13 @@
 %defattr(-,root,root)
 %{_includedir}/%{name}
 
+%files user
+
 %changelog
+* Wed Apr 21 2010 Murray Anderegg <anderegg.edu> - 3.2.1-1.1
+- Add nagios-user package that adds and removes the user. This can
+  then be required by the setuid plugins...
+
 * Sat Mar 13 2010 Peter Lemenkov <lemenkov> - 3.2.1-1
 - Upgrade to 3.2.1 (#572587).
 - Fixed SELinux patch (#573119).
--- nagios-plugins.spec.1.4.14-2	2010-04-12 08:21:26.000000000 -0400
+++ nagios-plugins.spec	2010-04-21 09:34:07.000000000 -0400
@@ -1,6 +1,6 @@
 Name: nagios-plugins
 Version: 1.4.14
-Release: 2%{?dist}
+Release: 2.1%{?dist}
 Summary: Host/service/network monitoring program plugins for Nagios
 
 Group: Applications/System
@@ -36,8 +36,8 @@
 #BuildRequires: %{_bindir}/quakestat
 BuildRequires: qstat
 
-Requires: nagios
-Requires(pre): nagios
+Requires: nagios-user
+Requires(pre): nagios-user
 
 %global reqfilt sh -c "%{__perl_requires} | sed -e 's!perl(utils)!nagios-plugins-perl!'"
 %define __perl_requires %{reqfilt}
@@ -827,6 +827,9 @@
 %{_libdir}/nagios/plugins/utils.sh
 
 %changelog
+* Wed Apr 21 2010 Murray Anderegg <anderegg.edu> - 1.4.14-2.1
+- Change requires nagios to requires nagios-user.
+
 * Mon Apr 12 2010 Peter Lemenkov <lemenkov> - 1.4.14-2
 - Added missing Requires - nagios (see rhbz #469530).
 - Fixed path to qstat -> quakestat (see rhbz #533777)

(In reply to comment #33)
> I would suggest that the nagios package be modifed to add a nagios-user
> package that only performs the useradd/userdel for user nagios.

The only problem with that solution is that the plugins can be installed either on a system with Nagios installed, or on a system with the NRPE daemon installed. Nagios runs as the 'nagios' user and group, and NRPE as the 'nrpe' user and group.

setuid plugins are typically installed with
-rwsr-x---. 1 root nrpe
permissions and ownership, so they will run as root, but can be run only by the NRPE daemon. If Nagios is installed instead of NRPE, they have root.nagios ownership instead. So the proposed patch would not resolve things on an NRPE system.

Obviously, this is difficult to encode for in an RPM (and wouldn't work at all on a system that has both Nagios and NRPE installed, such as a Nagios server that also acts as a client for other redundant or backup Nagios servers). I therefore manually set the ownership of the setuid plugins on my systems (to root.nrpe on NRPE clients, root.nagios on Nagios servers, and I work around it on systems that have both Nagios and NRPE installed).

Possible solutions that come to mind:
1. Install setuid plugins non-setuid, and print a message at install time telling the sysadmin to sort it out. (But then rpm -V would complain.)
2. Run nrpe as the 'nagios' user (I don't like that so much, as an NRPE compromise on a system with both Nagios and NRPE could lead to an attacker messing with Nagios).
3. Make the nrpe user a member of the nagios group, rather than its own nrpe group, and have the nagios-user package set up the nagios and nrpe users, plus the nagios group.
4. Use POSIX ACLs to make setuid plugins executable by both the nagios and nrpe users.

I personally like (4) the best, but adding ACLs may be opening a can of worms (I don't know if all filesystems the RPM may be installed on support them, for example). I think (3) would work OK too since I doubt the Nagios package contains any nagios-group-writeable files.

> The nagios and nagios-plugins packages should then be modified to require
> nagios-user.

Also the nrpe package.

(In reply to comment #32)
> The "nagios-plugins" tries to pull in "nagios" (including "httpd"), which
> is fully fucked up - sorry.    

Folks, I would like to explain this situation a little. First, I would like to say, that I'm not a bad guy, who tries to create more and more issues to users. In fact, I like to solve issues rather than creating new.

Unfortunately, this new dependency is almost unavoidable - some plugins are requiring 'nagios' uid, which is created by nagios package. Unfortnately, while creating, its home directory is set to directory also owned by nagios package.

I'm sure, that from the user's PoV this is weird, and this should be fixed (and will be fixed soon, I hope - with your aid). But I'm also sure, that this new dependency on nagios cannot be simply dropped (reverted) right now.

Peter, the nagios-plugins package NEVER has to depend on the nagios main
page, because nagios main package at Fedora includes the nagios server having
much more dependencies (e.g. to httpd). This is broken and has to be fixed
somehow. PERIOD.

Peter, nobody is accusing you of being a "bad guy". But this is simply not the right fix. If plugins use the 'nagios' uid, then they should be fixed e.g. not to use it or to require a subpackage which does provide it. But pulling in all of the nagios server to install the nagios client is not the right way to do it - it is much worse than the minor breakage that existed before. And as I pointed out in comment 34, requiring the 'nagios' uid still results in broken plugins on NRPE systems, since those require the 'nrpe' uid instead. I made several proposals in comment 34 - are all of them unacceptable to you?

If you just need the user why not create a nagios subpackage called 'nagios-user' that creates it.  Then both nagios and nagios-plugins package can require 'nagios-user'  ick, but it'd work.

Don't think this would work.   At least as the packages are configured.

Right now if you are running nrpe then the plugins need a user nrpe and need to be owned by that user.   If you are the primary machine running nagios itself then the user nagios is needed, and the files need to be owned by this user.  So the plugin packages would need to be setup twice once for each type of run.   Not good.

But I do have to wonder why the two different users.  Why can't the nrpe systems run nrpe as the user nagios and have their plugins owned/accessible by this user and completely drop the nrpe user thing.

(In reply to comment #39)
> Right now if you are running nrpe then the plugins need a user nrpe and need to
> be owned by that user.

Close - they need to be owned by root, but be executable by nrpe or nagios. Otherwise you have a security hole.

> Why can't the nrpe systems run nrpe as the user nagios

I addressed that in (2) in comment 34. NRPE is a network service. If it runs as the nagios user and it is compromised, an attacker could mess with Nagios processes on the same machine (at a minimum they could shut down the monitoring system to hide their actions elsewhere on the network). Nagios could also potentially have all sorts of privileged access to other systems in order to monitor them (e.g. ssh keypairs and other shared secrets such as SNMP community strings) so this would concern me.

I have to wonder why one would be running both nagios and nrpe on the same system?   I certainly have no systems running nrpe that have nagios.

(In reply to comment #41)
> I have to wonder why one would be running both nagios and nrpe on the same
> system?

I already gave one example in comment 34 of a system that runs both Nagios and NRPE. Each of my Nagios servers runs NRPE so that the other Nagios servers can check it to make sure it's up.

(In reply to comment #41)
> I have to wonder why one would be running both nagios and nrpe on the same
> system?   I certainly have no systems running nrpe that have nagios.    

We don't treat the nagios server any differently from the other ones we monitor.  When we want to see if disk space on / is fine, we don't have one check command for all the servers except nagios, and then a special one for nagios.

Interesting.   I do pretty much specific commands on the nagios machines as they are different than the other machines and pretty much designed for the monitoring task and not much else.

Interesting problem, maybe one we need to find a solution to.

*** Bug 584856 has been marked as a duplicate of this bug. ***

Folks, anyone has objections against adding sub-package nagios-user, which will just provide nagios uid and gid? See comment #33 for details. From my PoV - this would be the most easiest way to fix all this mess.

(In reply to comment #46)
> Folks, anyone has objections against adding sub-package nagios-user, which will
> just provide nagios uid and gid? See comment #33 for details. From my PoV -
> this would be the most easiest way to fix all this mess.    

+1 for adding this nagios-user.

But, please, require it only for packages, which need suid to nagios user, not for all packages.

And which sub-packages would that then be exactly?

nagios-plugins-1.4.14-3.fc12.1,nagios-3.2.1-2.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.fc12.1,nagios-3.2.1-2.fc12

nagios-plugins-1.4.14-3.fc13.1,nagios-3.2.1-2.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.fc13.1,nagios-3.2.1-2.fc13

nagios-plugins-1.4.14-3.fc11.1,nagios-3.2.1-2.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.fc11.1,nagios-3.2.1-2.fc11

Folks, please test these builds.

Tested upgrade on Fedora 12 and fresh install on Fedora 13. It worked fine. Thank you!

People, please add positive karma if these builds above works for you (and negative, if something goes wrong).

no EL build yet?

Peter,

The qstat rename mess is still around.

Using the EPEL-5 repos:
-----------------------

* qstat-2.11-3.el5 is already available in the *stable* repository and already provides /usr/bin/quaketat (the renamed file).

$ rpm -qpl qstat-2.11-3.el5.i386.rpm  | grep bin/
/usr/bin/quakestat

* meanwhile the *stable* repository only has nagios-plugins-game-1.4.14-1.el5
which still hardcodes the old /usr/bin/qstat file.

* the nagios-plugins-1.4.14-2.el5 that fixes the qstat file rename is only available in the *testing* repository.

* a better protection against this file rename problem was suggested in
https://bugzilla.redhat.com/show_bug.cgi?id=533777#c2  but appears to have been ignored (it would avoid problems for people rebuilding and using the latest nagios-plugins RPMS in older versions of RHEL/CentOS/Fedora distros).

/jpo

(In reply to comment #56)
> Peter,
> 
> The qstat rename mess is still around.
> 
> Using the EPEL-5 repos:
> -----------------------

This one is next in my TODO list. I plan to push both nagios and nagios-plugins into EL-[45] this weekend.

nagios-plugins-1.4.14-3.el5,nagios-2.12-7.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.el5,nagios-2.12-7.el5

nagios-plugins-1.4.14-3.el4,nagios-2.12-7.el4 has been submitted as an update for Fedora EPEL 4.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.el4,nagios-2.12-7.el4

nagios-plugins-1.4.14-3.fc13.1, nagios-3.2.1-2.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

nagios-plugins-1.4.14-3.el4, nagios-2.12-7.el4 has been pushed to the Fedora EPEL 4 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins nagios'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.el4,nagios-2.12-7.el4

nagios-plugins-1.4.14-3.el5, nagios-2.12-7.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins nagios'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-3.el5,nagios-2.12-7.el5

nagios-plugins-1.4.14-3.fc12.1, nagios-3.2.1-2.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

nagios-plugins-1.4.14-3.fc11.1, nagios-3.2.1-2.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

The update resolves the dependency problem for me, and also addresses part of the original problem (setuid plugins are owned by root.nagios, even on systems without nagios installed). But because the NRPE daemon runs as the nrpe user, the plugins still won't work correctly on NRPE systems. Personally, I can work around this by chown'ing the plugins, but some users may still be caught out.

nagios-plugins-1.4.14-4.el5,nagios-2.12-8.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el5,nagios-2.12-8.el5

nagios-plugins-1.4.14-4.el4,nagios-2.12-8.el4 has been submitted as an update for Fedora EPEL 4.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el4,nagios-2.12-8.el4

nagios-plugins-1.4.14-4.el4, nagios-2.12-8.el4 has been pushed to the Fedora EPEL 4 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins nagios'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el4,nagios-2.12-8.el4

nagios-plugins-1.4.14-4.el5, nagios-2.12-8.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins nagios'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el5,nagios-2.12-8.el5

nagios-plugins-1.4.14-4.el5,nagios-2.12-9.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el5,nagios-2.12-9.el5

nagios-plugins-1.4.14-4.el4,nagios-2.12-9.el4 has been submitted as an update for Fedora EPEL 4.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el4,nagios-2.12-9.el4

nagios-plugins-1.4.14-4.el4, nagios-2.12-9.el4 has been pushed to the Fedora EPEL 4 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins nagios'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el4,nagios-2.12-9.el4

nagios-plugins-1.4.14-4.el5, nagios-2.12-9.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins nagios'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-4.el5,nagios-2.12-9.el5

nagios-plugins-1.4.14-4.el4, nagios-2.12-9.el4 has been pushed to the Fedora EPEL 4 stable repository.  If problems still persist, please make note of it in this bug report.

nagios-plugins-1.4.14-4.el5, nagios-2.12-9.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.