Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are the dangers of a public organization, like a college or university, publishing monitoring services like Nagios in a publicly available read only format?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

I think the biggest risk to providing public interface to Nagios is that the Nagios CGIs haven't been written in a hardened fashion (at least they've never claimed to be). A raw Nagios interface leaks internal information like a sieve.

There's nothing inherently insecure about sharing the information (as long as you take into account the value of the information you're giving away), and you're aware of decreasing your security-through-obscurity.

The best solution may be to use NagVis (http://www.nagvis.org/) to create a user-friendly page where people can see status updates in a way that's more meaningful to them than the raw service list from Nagios.

If you do decide to just display the output, make sure to read the Nagios security considerations page (http://nagios.sourceforge.net/docs/3_0/security.html)

share|improve this answer
    
+1. Nice aspects on the CGI, and obscurity is worth absolutely zero anyway. Attackers are usually automated, so who cares about the info on that page? =) –  Commander Keen May 28 '09 at 19:15
add comment

When I was in college, they used to provide Big Brother as a public read-only service, so it's not unheard of. Knowing the topology of the network could open up risk if the machines are not all secure, and if you're also reporting version numbers, that piece of information is useful for determining possible vulnerabilities.

You can, and should, limit the information available to the public, but we found knowing what services were down and when they came back up valuable for our support staff in communicating with the rest of the college.

share|improve this answer
add comment

I think it might be easier from a security standpoint as well as a user standpoint to have a script generate a static HTML page with the status of the services / servers that are important to users. This would be much simpler for most people to understand -- I think many will find soft and hard states etc confusing. Also this way none of the Nagios interface will be exposed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.