Hello,
I’m using Checkmk Ultimate (formerly Cloud) 2.3 and use several rules to build various agents.
My problem is that colleagues see “Default configuration” on top and end up downloading the vanilla agent that’s missing all security settings and other customizations.
How can I hide the vanilla agent in that list for all users?
There is no way to “hide” any agent configuration in the bakery.
And the “vanilla” agent is an important baseline, so one should not hide it.
I would recommend either educating your colleagues, or providing them with an agent package of your choice instead of self-service. Ideally that agent contains the agent updater, then you only need to make sure, they register for updates and the updater takes care of the rest.
the vanilla agent isn’t a baseline in our environment. it’s effectively a security problem, as it doesn’t restrict the IPs of the checkmk server and has no encryption settings configured.
This is an open live power wire problem. Yes, I put up a sign to not touch the blank wire and it’s probably going to be fine, or I can increase my workload and distribute the agents myself.
But why can’t I just cover the blank wires?
In recent versions the agent refuses any communication by default and only answers to servers, which it was registered against (for TLS encryption). I recommend using these features instead of legacy encryption and legacy IP whitelisting.
I appreciate a good analogy, but I cannot agree with this one. I see it more like a toolbox with elaborate tools. You can either lock it properly and only hand out tools individually, or you can educate people, which tools to use and how.
That’s good to know and mostly eleminates the security angle. Though the IP filter still adds another layer around it that we welcome.
We use TLS registration already.
Again: Our TLS encryption basically implements an IP whitelist. The upside is, you do not need to maintain a static list of IPs, you rather register the agent to all releveant Checkmk servers and that is it. 