eloyd wrote:I'm jumping in here because we get asked this all the time. You can't simply follow someone else's directions for hardening a system without knowing what the results will be for your specific installation. For instance, "Remove HTTP server" will pretty much kill any chance of you being able to use Nagios XI, as it is configured, managed, and used through a web server.
So you need to understand what steps are required for your configuration that would override any generic hardening document. In a nutshell, Nagios is a web application that makes use of databases, filesystem pipes, outbound connections to other machines, and various third-party software for tasks like graphing, reporting, and capacity monitoring. Anything that impedes its ability to use these broad categories of topics should not be done.
Edit: Even if they were written specifically by your company, it still would make no sense to disable a web server for a web app.
Some of them is pretty obvious to get exemption for like httpd. Since nagios instance has compilers etc in it, exec access to the world writable directories like /tmp is certainly a no no. However nagios seems to need it enable as highlighted by tmcdonald. No way security folks will budge on this considering the risks.
It is up to us to update the security folks what cannot be implemented for their consideration. You can see the challenge in this.
To cut the long story short, I convinced them to let me install nagiosxi first and then let them harden the server part by part and checking at each checkpoint.
Good thing it is running in a VM and we can use snapshots.
Do your guys have any health checklist to verify nagiosxi functionality in OK?
SETUP COMPLETED
===============
Nagios XI base files installed OK
RESULT=0
Running './C-cronjobs'...
Crontabs installed OK
RESULT=0
Running './D-chkconfigalldaemons'...
Daemons configured to start OK
RESULT=0
Running './E-importnagiosql'...
httpd: no process killed
Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 10.17.19.228 for Ser verName
[ OK ]
Sleeping...
NOTE: If prompted, enter the MySQL root password
NagiosQL database appears OK - continuing...
NDOUtils database appears OK - continuing...
Found config files to import - continuing...
URL: http://localhost/nagiosxi/includes/components/ccm/
CMDLINE
/usr/bin/wget --save-cookies nagiosql.cookies --keep-session-cookies http://localhost/nagiosxi/includes/components/ccm/ --no-check-certificate --post-data 'submit=Login&hidelog=true&loginSubmitted=true&username=nagiosxi&password=n@gweb' -O nagiosql.login--2016-03-25 05:56:32-- http://localhost/nagiosxi/includes/components/ccm/
Connecting to 172.16.19.95:8080... connected.
Proxy request sent, awaiting response... 404 Not Found
2016-03-25 05:56:32 ERROR 404: Not Found.
NAGIOSQL LOGIN FAILED!
RESULT=1
===================
INSTALLATION ERROR!
===================
install.log
You do not have the required permissions to view the files attached to this post.
Even if we did have such a checklist, it would have been generated against a clean, minimal, unmodified install of CentOS, and in a hardened environment your XI could be running fine and the checks come back dirty, or worse, vice-versa.
Even if we did have such a checklist, it would have been generated against a clean, minimal, unmodified install of CentOS, and in a hardened environment your XI could be running fine and the checks come back dirty, or worse, vice-versa.
