Windows 2008 and 2003 servers. Would like to monitor server health remotely over internet. The monitoring computer may change IP(non-static IP). Trying to decide SNMP or WMI. SNMP seems to only allow all hosts or selected hosts that must be named. Since this is from the Internet side is WMI more secure in that it uses Windows accounts to login ? Pros and cons for each ?
Thanks, Ron
SNMP gives the least vulnerable information. Presumably the community name will be a read-only community, so the disclosed information shouldn't be useful for further access. WMI requires Windows login information, which is more useful to an interceptor/attacker.
Regardless of what you pick, you'll still have to specify which Internet hosts are allowed to connect through the firewall. SNMP just adds another layer to this, you'll have to enter the list twice. WMI is more generous, in that it relies on the existing firewall infrastructure to mediate connections. Which is to say, if you're looking to avoid entering a lot of IP addresses or having to constantly change it, you're going to have to do it one way or the other.
Unless you're encrypting the information somehow, SNMP potentially reveals much less interesting information. Kerberos would be very secure, but you'd also have to expose your KDCs (the Domain Controllers) to make it work. NTLMv2 is pretty strong, but is vulnerable (I believe) to replay attacks.
WMI uses DCOM which works over Windows RPC. RPC is a favorite of worms and hackers, so I'd recommend AGAINST opening those ports directly to the Internet.
There are other solutions for monitoring remote servers across the Internet without opening ports like this. Google for "monitor remote windows office"
