Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to monitoring tools. Recently our server with phpMyAdmin was attacked with botnet. So I want to do some monitoring on my server for any their health and also security. What I am worried is that nagios is also another web application like phpMyAdmin is there any security loop hole in it where hackes can intrude via it? Secondly if there is no problem what should I do to setup monitoring for mysql and web servers? Or if there is any other options then?

share|improve this question
2  
re nagios. imho, A hammer is dangerous if you hit yourself in the eye with it. It entirely depends on usage. –  Sirex May 11 '12 at 3:26
    
Two points you should consider. 1: Nagios is a great choice for system monitoring but not for security monitoring. 2: What you need to know about Nagios security is in the docs. –  John Gardeniers May 11 '12 at 11:01

4 Answers 4

The web interface you can protect with addional authentication at the web server layer (with an administrative, non public app there is hardly a reason to rely on builtin auth alone, same with phpmyadmin).

What you need to setup far more carefully is your remote plugin layer (nrpe, ssh, client-driven nsca...) since there are non interactive trusts involved, with some setups straight across the open internet.

share|improve this answer
    
how to add the additional protection authentication layer what should I be doing? –  user111196 May 11 '12 at 15:51
    
ssl and using htaccess style auth with everything whether it comes or doesn't come with its own login are a good start –  rackandboneman May 11 '12 at 16:53
    
How to set the ssl and .htaccess? I read for the .htacess I need a folder in my www to be .htaccess is it? What is next from there? –  user111196 May 11 '12 at 18:02
    
With "htaccess style" I meant "anything that throws an auth prompt BY THE BROWSER initiated BY THE WEBSERVER at the user, at HTTP protocol not application level". Find the term commonly used for that. Eg digest auth, basic auth (the latter really likes ssl ;). I'm afraid it does sound arrogant when I say you should learn the basics of HTTP authentication and setting up basic ssl when deploying a web based application ;), but I probably just expressed myself badly in the first place. –  rackandboneman May 11 '12 at 18:18
    
To explain: it is easier to keep an eye on vulnerabilities that might become known that will allow webserver level authentication to be bypassed, eg with apache that would most certainly make major security headlines!, than all the things that can happen with apps that bring their own auth system. –  rackandboneman May 11 '12 at 18:20

IMHO none of administrating www tools such as phpmyadmin and nagios should be accessible from internet, if the business does not explicitly request it.

But if you must do that protect such apps with additional passwords with .htaccess .

If you have to provide phpmyadmin for large number of users then protecting it with .htaccess is not such good idea(it's cumbersome to generate password for all users(clients), and users don't like double autentication).

You can always share it on uniqe url not https://yoursite/phpmyadmin all you have to do is to change alias in phpmyadmin visrtualhost file.

You should always share those apps over https!

Nagios is only for administrator, you can restrict access to it only for ips that should have accces with .htaccess.

You can serve phpmyadmin and on none standard port. If you share apps on none standart port (other than 80 and 443 ) you can restrict acces to it whith iptables.

Good idea is to protect those apps from brute force with fail2ban.

There are none idealy secured systems. There is always a risk but you must do all to minimize it.

share|improve this answer
    
I would like to learn further on the .htaccess setup I google it to how to setup and how does it protect? How to make my phpMyAdmin to be accessed via httpss. The problem why I need this tool over the internet as the server is on a no another location. Thank you. –  user111196 May 11 '12 at 15:49

Known security holes are usually not a problem because they get plugged. It is the ones you don't know about that are a problem. But then, asking if there are any unknown holes does not make sense, does it?

You don't have to have your nagios installation open to the public by the way. Keep the admin services on a different server with a different IP and you will be a tiny bit safer (botnets tend to focus on publicly visible sites).

Depending on what you want to monitor, Nagios may or may not be the right tool for the job. And there are also other companies that you can pay to do the monitoring for you. Then you don't have to worry about monitoring the monitoring system itself. The guys at monitis are even offerring MySQL monitoring.

share|improve this answer
    
I want to use this tool for both the health of mysql service and how the replication is running. Any good idea for that? Thank you. –  user111196 May 11 '12 at 15:50

There aren't any known security holes in Nagios. If there are unknown security holes, then you can't do much about it.

There are some security measures you can take:

  • first of all define on your NRPE, what IP your host is running. This can be done in /etc/nrpe.cfg look for allowed_hosts=. This will limit who can actually ask the NRPE what is happening. (or execute remote commands)
  • Make sure the timeout for your commands is reasonable (default values are ok)
  • To harden your host, I would prevent just any host to access it. So what you can do is bind it to 127.0.0.1. If you want to access it you will need to first tunnel to your host. If you are running VPN, you can assign an address in the VPN to your host and allow the whole VPN to access it. (so someone on the vpn can surf to it)

I presume you are running apache2, so to do this have a look at the file /etc/apache2/nagios.conf (or your equivalent apache2 configuration file if you have a compiled version). In the directory match block there is a like that says:

Allow from all

You can change this to:

Allow from IP/subnetmask

or

Allow from IP

share|improve this answer
    
so if I am newbie to nagios now I have download it ready. So what should be my next step then? Any good guide or tutorial some on google are a bit confusing? –  user111196 May 11 '12 at 15:53
    
I have some tutorials here: cloud101.eu/blog/tag/nagios –  Lucas Kauffman May 11 '12 at 15:55
    
I saw it for debian/ubuntu my evironment is centos so will it work too? What is your opinion about nagios for mysql and replication monitoring? What is this .htaccess setup? –  user111196 May 11 '12 at 16:30
    
I haven't got a lot of experience with centos, but besides installing the configuration will be very similar. I haven't had to monitor mysql replication yet. It is not a htaccess, but it can be implemented as one I think. It says that will only allow people connecting from a certain network or a specific IP. This prevents unauthorized access –  Lucas Kauffman May 11 '12 at 16:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.