CIS Nagios Core Benchmark

This recommendation verifies that Nagios runs as a dedicated non-root user on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Nagios runs as nagios user
ps -eo user,pid,comm | grep nagios
grep 'nagios_user\|nagios_group' /usr/local/nagios/etc/nagios.cfg

# Ensure Nagios runs as dedicated user
useradd -r -s /usr/sbin/nologin nagios
groupadd nagcmd
usermod -aG nagcmd nagios
# In nagios.cfg:
# nagios_user=nagios
# nagios_group=nagios

This setting ensures that configuration file permissions are restricted on the Nagios Core monitoring system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Nagios Core monitoring system is essential for defense in depth.

# Check configuration file permissions
stat -c '%a %U %G' /usr/local/nagios/etc/nagios.cfg
find /usr/local/nagios/etc -type f -exec stat -c '%a %n' {} \; | head -20

# Restrict configuration permissions
chmod 640 /usr/local/nagios/etc/nagios.cfg
chown root:nagios /usr/local/nagios/etc/nagios.cfg
chmod -R 640 /usr/local/nagios/etc/objects/
chmod 750 /usr/local/nagios/etc/

This recommendation verifies that HTTPS is configured for web interface on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify HTTPS is configured for web interface
grep -E 'SSLEngine|SSLCert' /etc/apache2/sites-enabled/nagios*.conf 2>/dev/null
grep -E 'SSLEngine|SSLCert' /etc/httpd/conf.d/nagios*.conf 2>/dev/null

# Configure HTTPS for Nagios web UI
# In Apache site config:
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/nagios.pem
    SSLCertificateKeyFile /etc/ssl/private/nagios-key.pem
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
</VirtualHost>

This recommendation verifies that strong web authentication is configured on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web authentication configuration
grep -E 'AuthType|AuthUserFile' /etc/apache2/sites-enabled/nagios*.conf 2>/dev/null
cat /usr/local/nagios/etc/htpasswd.users | wc -l

# Configure strong web authentication
# Ensure htpasswd uses strong hashing:
htpasswd -Bc /usr/local/nagios/etc/htpasswd.users nagiosadmin
# In Apache config, enforce auth:
# AuthType Basic
# AuthName "Nagios Access"
# AuthUserFile /usr/local/nagios/etc/htpasswd.users
# Require valid-user

This setting ensures that external command file permissions are restricted on the Nagios Core monitoring system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Nagios Core monitoring system is essential for defense in depth.

# Verify command file permissions
stat -c '%a %U %G' /usr/local/nagios/var/rw/nagios.cmd
grep 'command_file' /usr/local/nagios/etc/nagios.cfg

# Restrict external command file
chmod 660 /usr/local/nagios/var/rw/nagios.cmd
chown nagios:nagcmd /usr/local/nagios/var/rw/nagios.cmd
# Review check_external_commands in nagios.cfg

This recommendation verifies that NRPE uses SSL with host restrictions on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if NRPE uses SSL
grep -E 'ssl\|allowed_hosts' /usr/local/nagios/etc/nrpe.cfg 2>/dev/null

# Configure NRPE with SSL and host restrictions
# In nrpe.cfg:
# ssl=1
# ssl_cert_file=/etc/nagios/ssl/nrpe.pem
# ssl_privatekey_file=/etc/nagios/ssl/nrpe-key.pem
# ssl_cacert_file=/etc/nagios/ssl/ca.pem
# allowed_hosts=10.0.0.5

This recommendation verifies that notifications are enabled and contacts configured on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check notification settings
grep -E 'enable_notifications|notification_period' /usr/local/nagios/etc/nagios.cfg
grep 'contact_name\|email' /usr/local/nagios/etc/objects/contacts.cfg

# Enable and configure notifications
# In nagios.cfg:
# enable_notifications=1
# In contacts.cfg, define contacts with email:
# define contact{
#     contact_name  admin
#     email         admin@example.com
#     service_notification_period 24x7
#     host_notification_period    24x7
# }

This recommendation verifies that comprehensive event logging is enabled on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify event logging
grep -E 'log_file|log_rotation' /usr/local/nagios/etc/nagios.cfg
ls -la /usr/local/nagios/var/nagios.log

# Configure comprehensive logging
# In nagios.cfg:
# log_file=/usr/local/nagios/var/nagios.log
# log_rotation_method=d
# log_host_retries=1
# log_service_retries=1
# log_event_handlers=1
# log_external_commands=1
# log_passive_checks=1

This recommendation verifies that check result processing intervals are configured on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify check result processing intervals
grep -E 'check_result_reaper_frequency|max_check_result_reaper_time' /usr/local/nagios/etc/nagios.cfg

# Configure check result processing
# In nagios.cfg:
# check_result_reaper_frequency=10
# max_check_result_reaper_time=30
# max_concurrent_checks=0
# (0 = unlimited, set based on server capacity)

This recommendation verifies that flap detection is enabled on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if flap detection is enabled
grep 'enable_flap_detection' /usr/local/nagios/etc/nagios.cfg

# Enable flap detection
# In nagios.cfg:
# enable_flap_detection=1
# low_service_flap_threshold=5.0
# high_service_flap_threshold=20.0
# low_host_flap_threshold=5.0
# high_host_flap_threshold=20.0

This setting ensures that resource file permissions are restricted on the Nagios Core monitoring system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Nagios Core monitoring system is essential for defense in depth.

# Verify resource file permissions (contains macros/passwords)
stat -c '%a %U %G' /usr/local/nagios/etc/resource.cfg
grep 'resource_file' /usr/local/nagios/etc/nagios.cfg

# Protect resource file containing sensitive macros
chmod 600 /usr/local/nagios/etc/resource.cfg
chown nagios:nagios /usr/local/nagios/etc/resource.cfg

This recommendation verifies that CGI authorization is restrictive on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CGI authorization settings
grep -E 'authorized_for|use_authentication' /usr/local/nagios/etc/cgi.cfg

# Restrict CGI access
# In cgi.cfg:
# use_authentication=1
# authorized_for_system_information=nagiosadmin
# authorized_for_configuration_information=nagiosadmin
# authorized_for_system_commands=nagiosadmin
# authorized_for_all_services=nagiosadmin
# authorized_for_all_hosts=nagiosadmin

This recommendation verifies that Nagios Core is running the latest stable version on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Nagios version
/usr/local/nagios/bin/nagios --version | head -3

# Update Nagios Core to latest stable
# Download from: https://www.nagios.org/downloads/
cd /tmp
wget https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.x.x.tar.gz
tar xzf nagios-*.tar.gz
cd nagios-*
./configure && make all
make install

This recommendation verifies that configuration is verified before reload on the Nagios Core monitoring system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nagios Core monitoring system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify configuration before restart
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

# Always verify config before reload
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg
# Only reload if verification passes:
if [ $? -eq 0 ]; then
    systemctl reload nagios
fi