Checkmk 2.1 security highlights

Owned by Anastasios Thomaidis
Last updated: Sept 19, 2024 by Matthew Hierholzer

New security features and improvements in Checkmk 2.1.

LAST TESTED ON CHECKMK 2.1.0P1

Table of Contents

Communication between Server and Agent

Password Store

  • The password store holds the passwords you use in your checks and special agents in a central place. Please note that this password store is no kind of password safe. Your passwords will not be encrypted.

    All the passwords you store in your monitoring configuration, including this password store, are needed in plain text to contact remote systems for monitoring. So all those passwords have to be stored readable by the monitoring.

  • With Checkmk 2.1, the password store is storing the passwords obfuscated, which still is no encryption → https://checkmk.com/werk/13633

User and role concept

Within Checkmk, you can define your own roles and restrict them to specific permissions (https://docs.checkmk.com/latest/en/wato_user.html#roles)

Distributed Monitoring

  • Communication from the central to a remote site via TLS is possible and recommended.
  • Centralized configuration via HTTPS is possible and recommended.
  • Restriction of IP addresses allowed querying remote sites is possible and recommended.
  • If your remote site is not directly accessible via the central Server, you can push the data from the remote to the central Server (https://docs.checkmk.com/latest/en/distributed_monitoring.html#cmcdump)
    • This is only for viewing. No actions/Notifications are possible on the central site for this remote site.

Distributed Notifications

  • The remote site and (notification-)central notification spoolers communicate with each other via TCP. Notifications are sent from the remote site to the central site. The central site acknowledges to the remote site that the notifications have been received, which prevents notifications from being lost even if the TCP connection is broken.

  • There are two alternatives for the construction of a TCP-connection:

    1. A TCP-connection is configured from the central site to a remote site: Here, the remote site is the TCP-server.

    2. A TCP-connection is configured from a remote site to the central site: Here, the central site is the TCP-server.

  • Notification spooler connections can be encrypted with Checkmk 2.1 → https://checkmk.com/werk/13610

Distributed Event Console

The Event Console processes syslog-messages, SNMP traps, and other types of events of asynchronous nature.

Checkmk Distributed Agent Bakery

You can enable automatic agent updates not only from the central site but also through the remote sites. This can be useful if the central site is not accessible directly from hosts monitored on a remote site. The remote site acts as a caching proxy here, which receives connections from the hosts and forwards them through HTTPS to the central site unless the requested agent is already present in the remote site's cache. This enables secure agent updates in distributed environments while still being efficient on bandwidth.

Checkmk GUI

You can secure your Checkmk GUI with HTTPS (https://docs.checkmk.com/latest/en/omd_https.html)

User management with LDAP (e.g., Active Directory)

Securing LDAP connections with SSL (https://docs.checkmk.com/latest/en/ldap.html#ssl)

Automatic Disk space cleanup

We have now added the functionality to clean up the host-related files to the disk space cleanup mechanism. This mechanism is enabled by default and cleans up all files of not existing hosts that are older than one month by default. Suppose you want to disable this automatic deletion or customize the time horizon. In that case, you can configure it in the global settings of the Setup using the "Automatic disk space cleanup" option.

SSO & 2FA


https://checkmk.com/application/files/6516/0034/8003/checkmk2019_-_How_to_set_up_your_checkmk_securely.pdf

Used Checkmk Ports

Network ports used by Checkmk