Improve security with Nagios-Monitor-Server - Revision history

Malyhass at 09:16, 7 January 2018

2018-01-07T09:16:07Z

← Older revision		Revision as of 12:16, 7 January 2018
Line 8:		Line 8:
	Page Created: 25 November 2017		Page Created: 25 November 2017

	‎Last modified: ~~‎25 November~~ 2017		‎Last modified: ‎07 January 2017

Malyhass: /* References */

2018-01-07T09:15:20Z

References

@@ Line 441: / Line 441: @@
 - [https://www.youtube.com/channel/UChHzqszXw_5edX-9DOK4JxA Cyber-Tech-Tips]
 ------
 [[Category:Monitoring]]

Malyhass: /* Enable the encryption between the server and the agent */

2018-01-07T09:11:27Z

Enable the encryption between the server and the agent

← Older revision		Revision as of 12:11, 7 January 2018
Line 389:		Line 389:

	<code> /usr/local/nagios/libexec/check_nrpe -A /usr/local/nagios/etc/ssl/ca/ca_cert.pem -C /usr/local/nagios/etc/ssl/nagios_server_certs/nagios_server.pem -K /usr/local/nagios/etc/ssl/nagios_server_certs/nagios_server.key -H yourIPaddress </code>		<code> /usr/local/nagios/libexec/check_nrpe -A /usr/local/nagios/etc/ssl/ca/ca_cert.pem -C /usr/local/nagios/etc/ssl/nagios_server_certs/nagios_server.pem -K /usr/local/nagios/etc/ssl/nagios_server_certs/nagios_server.key -H yourIPaddress </code>

			<span style="color:#FF0000">
			* To make the handshake:

			<code> nano /usr/local/nagios/etc/services </code>

			* add the following next to the chech_nrpe services
			<code> -A /usr/local/nagios/etc/ssl/ca/ca_cert.pem -C /usr/local/nagios/etc/ssl//client_certs/client_cert.pem -K /usr/local/nagios/etc/ssl/client_certs/client_cert.key </code>

			<code> service nagios restart </code>

			To check the logs from the agent side

			<code> tail -f /var/log/syslog </code>

			Make sure that server IP address in the nrpe.cfg

			<code> cd /usr/local/nagios/etc </code>
			<code> nano nrpe.cfg </code>

			In line 106
			Put the server IP address

	=Summary=		=Summary=

Malyhass: /* Setting up Nagios */

2018-01-07T09:09:12Z

Setting up Nagios

← Older revision		Revision as of 12:09, 7 January 2018
Line 208:		Line 208:

	<code> systemctl enable /etc/systemd/system/nagios.service </code>		<code> systemctl enable /etc/systemd/system/nagios.service </code>

	<code> service nagios start </code>		<code> service nagios start </code>

Malyhass: /* See also */

2018-01-07T09:08:03Z

Malyhass: /* See also */

2018-01-07T09:06:52Z

Malyhass: /* Enable the encryption between the server and the agent */

2018-01-07T09:05:52Z

Enable the encryption between the server and the agent

← Older revision		Revision as of 12:05, 7 January 2018
Line 309:		Line 309:

	=Enable the encryption between the server and the agent=		=Enable the encryption between the server and the agent=
			<span style="color:#FF0000">
	The connection need to be secure between the server and the agent, it's not easy and it's not hard to make it for the security.		The connection need to be secure between the server and the agent, it's not easy and it's not hard to make it for the security.

Malyhass: /* Enable the encryption between the server and the agent */

2018-01-07T09:05:22Z

Enable the encryption between the server and the agent

← Older revision		Revision as of 12:05, 7 January 2018
Line 311:		Line 311:

	The connection need to be secure between the server and the agent, it's not easy and it's not hard to make it for the security.		The connection need to be secure between the server and the agent, it's not easy and it's not hard to make it for the security.

	* Setup Directories:


	* Setup Directories:		* Setup Directories:

Malyhass: /* Enable the encryption between the server and the agent */

2018-01-07T09:05:07Z

Enable the encryption between the server and the agent

← Older revision		Revision as of 12:05, 7 January 2018
Line 309:		Line 309:

	=Enable the encryption between the server and the agent=		=Enable the encryption between the server and the agent=

			The connection need to be secure between the server and the agent, it's not easy and it's not hard to make it for the security.

			* Setup Directories:


			* Setup Directories:

			<code> cd /usr/local/nagios/etc/ </code>

			<code> mkdir ssl </code>

			<code> chown root:nagios ssl </code>

			<code> mkdir ca nagios_server_certs client_certs </code>

			<code> chown root:nagios * </code>

			<code> mkdir ./demoCA </code>

			<code> mkdir ./demoCA/newcerts </code>

			<code> cd ./demoCA </code>

			<code> touch index.txt </code>

			<code> echo '1000' Angle brackets serial </code>

			* Create Certificate Authority
			<code> openssl req -x509 -newkey rsa:4096 -keyout ca_key.pem -out ca_cert.pem -utf8 -days 3650 </code>

			* NRPE Client Certificate
			<code> cd /usr/local/nagios/etc/ssl/client_certs/ </code>
			<code> openssl req -new -newkey rsa:2048 -keyout client_cert.key -out client_cert.csr -nodes </code>

			* Sign this certificate request by our CA:

			<code> openssl ca -days 365 -notext -md sha256 -keyfile ca/ca_key.pem -cert ca/ca_cert.pem -in client_certs/client_cert.csr -out client_certs/client_cert.pem </code>

			Copy NRPE Client Certificates to the agent:

			1- First you can make it with sftp://user@IP

			Or you can copy it with secure copy

			<code> scp root@IP:/usr/local/nagios/etc/ssl/ca/ca_cert.pem /usr/local/nagios/etc/ssl/ </code>

			<code> scp root@IP:/usr/local/nagios/etc/ssl/client_certs/client_cert.key /usr/local/nagios/etc/ssl/ </code>

			<code> scp root@IP:/usr/local/nagios/etc/ssl/client_certs/client_cert.pem /usr/local/nagios/etc/ssl/ </code>

			* Next the NRPE client config file needs updating so it knows to use the new certificate. In the file /usr/local/nagios/etc/nrpe.cfg

			<code> nano nrpe.cfg </code>

			* In line 238 uncomment:

			<code>
			ssl_cacert_file=/usr/local/nagios/etc/ssl/ca/ca_cert.pem
			ssl_cert_file=/usr/local/nagios/etc/ssl/client_certs/client_cert.pem
			ssl_privatekey_file=/usr/local/nagios/etc/ssl/client_certs/client_cert.key
			</code>

			* restart nrpe:
			<code> service nrpe restart </code>

			* Don't forgot to uncomment the follow:

			<code>
			1- ssl_logging=0xff
			2 ssl_client_certs=2
			</code>

			check_nrpe Plugin Certificate
			<code> cd /usr/local/nagios/etc/ssl/nagios_server_certs/ </code>
			<code> openssl req -new -newkey rsa:2048 -keyout nagios_server.key -out nagios_server.csr -nodes </code>
			<code> cd /usr/local/nagios/etc/ssl/ </code>
			<code> openssl ca -days 365 -notext -md sha256 -keyfile ca/ca_key.pem -cert ca/ca_cert.pem -in nagios_server_certs/nagios_server.csr -out nagios_server_certs/nagios_server.pem </code>

			* Using Certificates With check_nrpe Plugin

			<code> /usr/local/nagios/libexec/check_nrpe -A /usr/local/nagios/etc/ssl/ca/ca_cert.pem -C /usr/local/nagios/etc/ssl/nagios_server_certs/nagios_server.pem -K /usr/local/nagios/etc/ssl/nagios_server_certs/nagios_server.key -H yourIPaddress </code>

	=Summary=		=Summary=

Malyhass: /* Enable the encryption Front-end Web */

2018-01-07T08:57:06Z

Enable the encryption Front-end Web

← Older revision		Revision as of 11:57, 7 January 2018
Line 306:		Line 306:
	</VirtualHost>		</VirtualHost>
	</pre>		</pre>


			=Enable the encryption between the server and the agent=

	=Summary=		=Summary=

← Older revision		Revision as of 12:08, 7 January 2018
Line 407:		Line 407:

	6- [https://support.nagios.com/kb/article.php?id=519 NRPE - v3 Enhanced Security]		6- [https://support.nagios.com/kb/article.php?id=519 NRPE - v3 Enhanced Security]

			7- [https://support.nagios.com/kb/article/nrpe-check_nrpe-error-could-not-complete-ssl-handshake-615.html NRPE - CHECK_NRPE: Error - Could Not Complete SSL Handshake]

	=References=		=References=

← Older revision		Revision as of 12:06, 7 January 2018
Line 405:		Line 405:

	5- [https://www.youtube.com/watch?v=Kz-Z-dL0T_U&list=PLKAuFoXV02VqeLyddX-CIMcMdqWcI2UoP&index=5 Customize Nagios (Agent - Server) adding new services check (Swap - SSH) Final step]		5- [https://www.youtube.com/watch?v=Kz-Z-dL0T_U&list=PLKAuFoXV02VqeLyddX-CIMcMdqWcI2UoP&index=5 Customize Nagios (Agent - Server) adding new services check (Swap - SSH) Final step]

			6- [https://support.nagios.com/kb/article.php?id=519 NRPE - v3 Enhanced Security]

	=References=		=References=