Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I need to monitor network traffic and EtherApe seems to be nice graphical utility. But the Wikipedia entry says sth like this :
Security:
EtherApe requires root privileges to run. As such, there can be risks to the machine(s) running EtherApe when connected to the internet.
I am not getting this , we need to be connected to internet to monitor it, we do not need it at all if we are offline , don't we ?
If there is security risk what it could be and how to use it properly ?
The security risk is that if someone hacks you and manages to shell it, they will have a root shell. Unfortunately, this is the case with quite a lot of things.
There isn't really a way to definitively protect against this, but a reverse proxy might be a good start, as well as keeping up with patches. Additionally, use a dedicated server or VM for this which has no other function, and keep it firewalled off (in a DMZ) from everything it doesn't need access to.
It doesn't need to run as root, it just needs to be able to perform some network-related tasks that exceed the usual user permissions. Just use the linux capabilites to only confer these permissions without giving superuser rights:
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/etherape
Of course its still a slight risk to allow users to monitor all network traffic, but then that is what you are asking for.
