Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been trying to look into hardening Nagios (if there is such a thing...), but haven't found anything too definitive on what to do or guidance on what to even look at.

I'm wary to keep Nagios running until I know more about its potential security vulnerabilities and how to best remove those vulnerabilities, or at least harden it so that it's less of a potential problem.

I currently have Nagios disabled, as far as I can tell, until I can find ways to harden it a bit. No Nagios processes are running, and I have run chkconfig nagios off.

My Configuration is as follows:

  • CentOS 6.3 x64
  • Nagios Core 3.4.1

Here are the questions that I have:

  1. Is there anything else I need to check to make sure that Nagios is disabled?

  2. What are the possible security vulnerabilities with running Nagios in the default configuration?

  3. What are some steps that I can take to harden Nagios?

share|improve this question
1  
"How do I harden XYZ" questions usually are putting the cart before the horse. While there are "good security practices" which might be a suitable fit for a number of common configurations, the question "is it secure?" always need the specification of the type of attacks where securing is needed from. –  syneticon-dj Jul 23 '12 at 23:47
add comment

2 Answers

up vote 2 down vote accepted

I found some tips in the Nagios documentation that deal specifically with security:

  1. Use a Dedicated Monitoring Box.
  2. Don't Run Nagios As Root.
  3. Lock Down The Check Result Directory.
  4. Lock Down The External Command File.
  5. Require Authentication In The CGIs.
  6. Implement Enhanced CGI Security Measures.
  7. Use Full Paths In Command Definitions.
  8. Hide Sensitive Information With $USERn$ Macros.
  9. Strip Dangerous Characters From Macros.
  10. Secure Access to Remote Agents.
  11. Secure Communication Channels.
share|improve this answer
add comment

Nagios is implemented in parts, let's look at those individually.

There is the nagios scheduler and plugin implementation. This does the actual work of Nagios determining state for various hosts/services. This can be done in many different ways. One in particular you may want to investigate is SSH. Nagios can ssh into remote hosts to check for example the disk utilization. This ssh account is typically setup with a private key on the Nagios host and a public key on all the target linux machines to monitor.

There are other mechanisms that Nagios may use depending on the plugin. Such methods as SNMP, direct connection, and NRPE (Nagios Remote Plugin Executor). That is just an introduction to plugins, one area of investigation for Nagios security.

The next area to consider is the UI itself. The default UI is constructed with compile C cgi scripts. You have some authentication/authorization steps to configure on top of the default CGIs. To find out more about the CGI security, review cgi.cfg under the nagios config directory, usually /etc/nagios, and/or read Nagios documenation on CGI Authentication.

To answer your specific questions:

  1. ps -aux | grep -v grep | grep nagios

  2. See above for general security concerns with plugins/web UI and review Nagios security documentation.

  3. Review the above, consider how your network is laid out and what ports/protocols you'll need to open to the various nagios plugins. Consider protecting the UI with iptables or other restrictions to access the UI.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.