Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Windows 2008 and 2003 servers. Would like to monitor server health remotely over internet. The monitoring computer may change IP(non-static IP). Trying to decide SNMP or WMI. SNMP seems to only allow all hosts or selected hosts that must be named. Since this is from the Internet side is WMI more secure in that it uses Windows accounts to login ? Pros and cons for each ?

Thanks, Ron

share|improve this question
1  
Are you really saying that you are going to allow monitoring of your kit directly from the Internet? For security reasons this would be a seriously bad idea no matter what method is used. It must surely be possible for a VPN to be set up from the monitoring station to the servers. –  blankabout May 24 '11 at 0:04
    
What tool are you using for monitoring? We use Zabbix, and faced with the exact same scenario, we ended up setting up a Zabbix proxy at the remote site, so all the SNMP/Perfmon data was collected by a machine locally, and then sent back when required to the "master" Zabbix server over a VPN. That VPN was encrypted, and was easy to set up because it was just one client connecting to our pre-existing VPN setup. –  Mark Henderson May 24 '11 at 4:57
    
yeah, I was seriously going to monitor the server over the Internet. Maybe a different question but: is it ok to do this? The two answers so far seem to imply it is ok-but mostly for SNMP. (Trying to use WhatsUp Gold for this-if it matters). Main issue is if Internet goes down, I need the monitor offsite so it can detect and alert - if its inside the line is down and cannot alert me. –  JoeJoe May 25 '11 at 15:46

2 Answers 2

SNMP gives the least vulnerable information. Presumably the community name will be a read-only community, so the disclosed information shouldn't be useful for further access. WMI requires Windows login information, which is more useful to an interceptor/attacker.

Regardless of what you pick, you'll still have to specify which Internet hosts are allowed to connect through the firewall. SNMP just adds another layer to this, you'll have to enter the list twice. WMI is more generous, in that it relies on the existing firewall infrastructure to mediate connections. Which is to say, if you're looking to avoid entering a lot of IP addresses or having to constantly change it, you're going to have to do it one way or the other.

Unless you're encrypting the information somehow, SNMP potentially reveals much less interesting information. Kerberos would be very secure, but you'd also have to expose your KDCs (the Domain Controllers) to make it work. NTLMv2 is pretty strong, but is vulnerable (I believe) to replay attacks.

share|improve this answer

WMI uses DCOM which works over Windows RPC. RPC is a favorite of worms and hackers, so I'd recommend AGAINST opening those ports directly to the Internet.

There are other solutions for monitoring remote servers across the Internet without opening ports like this. Google for "monitor remote windows office"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.