CheckMK 2.1 - Site agent receiver listens on all interfaces/IP's

General
1

Hey there,

I have upgrade one of my CheckMK installations to CheckMK 2.1. I heard about the significant changes of the agent communication introduced with CheckMK 2.1 from the YouTube channel.

After updating my site to 2.1, CheckMK exposes port 8000 to ALL interfaces/IP’s on my machine:

image
image1914×632 53.8 KB

As this machine is exposed to public internet directly, my system-wide apache makes CheckMK available only on an dedicated internal IP interface via Virtual-Host definition.

So I went with omd config to check, If I’m able to change the listening address for the Agent Receiver service as well, but unfortunatly no success:

image

You can only change the port, but not the listening address.

Is there any way to change the listening address, as I don’t want to expose the agent receiver service to public internet? I did not found any information on this.

For now, I have disabled the agent receiver in omd config

Thank you

Best Regards
Markus

2

Currently limiting the agent receiver to certain IPs is only possible by editing its startup script. You might use iptables to limit access until this is configurable. Remember that you need the agent receiver in pull mode (push mode is not yet available) to register agents for the new TLS mode. But this can also be done on the CMK server in “proxy mode”. In this case you can limit access to localhost.

3

Hi,

i would just add a specific firewall rule to block the traffic for port 8000 on your public IP. I would think/hope you already have a firewall configured on your server if it’s facing the Internet directly.

BR
Flo

4

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.