CheckMK Web Interface over WAN

General
1

Hello together :slight_smile:

I wanted to know if it is secure to Host a external CheckMK Server in the Cloud which is reachable from everywhere over the Internet?

The external Host should be the Master and collect all cmcdumps from many different Servers and doesnt have direct Access to the other Locations.

I dont have found any information about how Secure it is to Host an https CheckMK WEB UI wich is reachable from Outside. There is no information about if the acutal checkmk is made for this.

I also think about hosting grafana on the master and deploy some Dashboards on the Cloud side.

1 Like
2

Hallo,
my short answer:
The only system with an incoming interface from outside (internet) should be a firewall/ a VPN server.
Ralf

3

Iā€™d adjust that a bit. For me, a restricted key only ssh on a random port or opened via knock. Then you can do pretty much whatever you need. Itā€™s a whole lot more secure than vpn.

4

Hallo,
it is possible to harden VPN too.
OpenVPN is a simple way for me dial into some networks with an ipad for first steps after a support call.
Ralf

5

Itā€™s a lot of work ironing out all the firewall rules, pre-connection checks and such in attempt to make VPN secure. Maybe I should have said ā€œeasier to secureā€. Letā€™s just say I havenā€™t seen a secure VPN yet.

6

Thanks for the answers :slight_smile:

My follow up question now:
How is the use case concept for the Managed Service Edition?

My understanding is that i Manage all customers from my site. This means my master Hosts needs a VPN Connection to all customers i want to manage.
If my master checkmk or a customers checkmk is compromised this could be a big security issue.

How is the managed service Edition secure to use to see and manage all Customers?

7

Hallo,
perhaps the checkmk team can publish a blog to answer these questions?
Ralf

1 Like
8

I will note the idea of a blog post, but this is a terribly complex matter. You already see the different ideas in here and while all are valid, there is no obvious ā€˜rightā€™ way. That said, a blog post might create more problems, than it solves. But as said, I will note it and pass it on.

9

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.