Nagios Hardening

Question

I've been trying to look into hardening Nagios (if there is such a thing...), but haven't found anything too definitive on what to do or guidance on what to even look at.

I'm wary to keep Nagios running until I know more about its potential security vulnerabilities and how to best remove those vulnerabilities, or at least harden it so that it's less of a potential problem.

I currently have Nagios disabled, as far as I can tell, until I can find ways to harden it a bit. No Nagios processes are running, and I have run chkconfig nagios off.

My Configuration is as follows:

• CentOS 6.3 x64
• Nagios Core 3.4.1

Here are the questions that I have:

1. Is there anything else I need to check to make sure that Nagios is disabled?

2. What are the possible security vulnerabilities with running Nagios in the default configuration?

3. What are some steps that I can take to harden Nagios?

Answer 1

I found some tips in the Nagios documentation that deal specifically with security:

1. Use a Dedicated Monitoring Box.
2. Don't Run Nagios As Root.
3. Lock Down The Check Result Directory.
4. Lock Down The External Command File.
5. Require Authentication In The CGIs.
6. Implement Enhanced CGI Security Measures.
7. Use Full Paths In Command Definitions.
8. Hide Sensitive Information With $USERn$ Macros.
9. Strip Dangerous Characters From Macros.
10. Secure Access to Remote Agents.
11. Secure Communication Channels.

Answer 2

I know this is an older thread, but one thing I've done on my Nagios installation in addition to what the others have posted is to implement IPtables rules on each target host to only allow Nagios/NRPE traffic (port 5666) from the actual Nagios server. There's a directive in nrpe.conf that allows you to specify "allowed_hosts" that can connect to the target host. Even with that I still like to add a chain in IPtables to only allow Nagios/NRPE traffic from the actual Nagios server.

Other than that, what the others have posted will really harden your Nagios server.

Answer 3

Apart from the official Nagios recommendations, you should also always update to the latest version of Nagios Core. Nagios has done a lot of security fixes lately, please check the Nagios Core 4 Change Log fore more information. Apart from Nagios, you should also upgrade dependant components, such as your agents (nrpe-agent or NSClient++) and the used protocols such as NSCA and NRPE. NRPE in particular has got a major update lately. Check out the changelog here.

Answer 4

Nagios is implemented in parts; let's look at those individually.

There is the Nagios scheduler and plugin implementation. This does the actual work of Nagios determining state for various hosts/services. This can be done in many different ways. One in particular you may want to investigate is SSH. Nagios can SSH into remote hosts to check for example the disk utilization. This SSH account is typically setup with a private key on the Nagios host and a public key on all the target Linux machines to monitor.

There are other mechanisms that Nagios may use depending on the plugin. Such methods as SNMP, direct connection, and NRPE (Nagios Remote Plugin Executor). That is just an introduction to plugins, one area of investigation for Nagios security.

The next area to consider is the UI itself. The default UI is constructed with compile C CGI scripts. You have some authentication/authorization steps to configure on top of the default CGIs. To find out more about the CGI security, review cgi.cfg under the Nagios config directory, usually /etc/nagios, and/or read Nagios documenation on CGI Authentication.

To answer your specific questions:

1. ps -aux | grep -v grep | grep nagios

2. See above for general security concerns with plugins/web UI and review Nagios security documentation.

3. Review the above, consider how your network is laid out and what ports/protocols you'll need to open to the various Nagios plugins. Consider protecting the UI with iptables or other restrictions to access the UI.