Configure Nagios Core 4.5 SSL certificates and security hardening with authentication controls

Install required packages

Install the packages needed for SSL certificates and security hardening.

sudo apt update
sudo apt install -y certbot python3-certbot-apache apache2-utils openssl

sudo dnf update -y
sudo dnf install -y certbot python3-certbot-apache httpd-tools openssl

Configure Apache virtual host for SSL

Create a proper virtual host configuration to support SSL certificates.

    ServerName nagios.example.com
    DocumentRoot /usr/local/nagios/share
    Redirect permanent / https://nagios.example.com/



    ServerName nagios.example.com
    DocumentRoot /usr/local/nagios/share
    
    # SSL Configuration
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder off
    SSLSessionTickets off
    
    # Security Headers
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
    
    # Nagios Configuration
    ScriptAlias /nagios/cgi-bin "/usr/local/nagios/sbin"
    Alias /nagios "/usr/local/nagios/share"
    
    
        Options ExecCGI
        AllowOverride None
        Require valid-user
        AuthType Basic
        AuthName "Nagios Access"
        AuthUserFile /usr/local/nagios/etc/htpasswd.users
    
    
    
        Options None
        AllowOverride None
        Require valid-user
        AuthType Basic
        AuthName "Nagios Access"
        AuthUserFile /usr/local/nagios/etc/htpasswd.users
    

Obtain SSL certificate with Let's Encrypt

Use Certbot to automatically obtain and configure SSL certificates.

sudo a2ensite nagios-ssl.conf
sudo a2enmod ssl headers rewrite
sudo systemctl reload apache2

Obtain SSL certificate
sudo certbot --apache -d nagios.example.com --non-interactive --agree-tos --email admin@example.com

Verify certificate installation
sudo certbot certificates

Create secure user authentication

Set up user accounts with strong password requirements and role-based access.

# Create htpasswd file with strong encryption
sudo mkdir -p /usr/local/nagios/etc
sudo htpasswd -c -B /usr/local/nagios/etc/htpasswd.users nagiosadmin

Add additional users with different privilege levels
sudo htpasswd -B /usr/local/nagios/etc/htpasswd.users monitor-user
sudo htpasswd -B /usr/local/nagios/etc/htpasswd.users readonly-user

Configure user authorization and access controls

Define user permissions and access levels in Nagios configuration.

# Admin users (full access)
authorized_for_system_information=nagiosadmin
authorized_for_configuration_information=nagiosadmin
authorized_for_system_commands=nagiosadmin
authorized_for_all_services=nagiosadmin
authorized_for_all_hosts=nagiosadmin
authorized_for_all_service_commands=nagiosadmin
authorized_for_all_host_commands=nagiosadmin

Monitor users (read/write to services and hosts)
authorized_for_all_services=nagiosadmin,monitor-user
authorized_for_all_hosts=nagiosadmin,monitor-user
authorized_for_all_service_commands=nagiosadmin,monitor-user
authorized_for_all_host_commands=nagiosadmin,monitor-user

Read-only users (view only)
authorized_for_read_only=readonly-user

Security settings
use_authentication=1
use_ssl_authentication=0
default_user_name=
escape_html_tags=1
action_url_target=_blank
notes_url_target=_blank
lock_author_names=1

Disable potentially dangerous features for non-admin users
authorized_for_system_commands=nagiosadmin
authorized_for_configuration_information=nagiosadmin

Harden Nagios configuration files

Secure file permissions and disable unnecessary features.

# Set secure file permissions
sudo chown -R nagios:nagios /usr/local/nagios/etc/
sudo chmod 750 /usr/local/nagios/etc/
sudo chmod 640 /usr/local/nagios/etc/*.cfg
sudo chmod 600 /usr/local/nagios/etc/htpasswd.users

Secure log directories
sudo chown -R nagios:nagios /usr/local/nagios/var/
sudo chmod 755 /usr/local/nagios/var/
sudo chmod 644 /usr/local/nagios/var/*.log

Configure security logging and monitoring

Enable comprehensive logging for security events and access attempts.

# Enable detailed logging
log_file=/usr/local/nagios/var/nagios.log
log_rotation_method=d
log_archive_path=/usr/local/nagios/var/archives
use_syslog=1
log_notifications=1
log_service_retries=1
log_host_retries=1
log_event_handlers=1
log_initial_states=1
log_external_commands=1
log_passive_checks=1

Security-specific logging
enable_event_handlers=1
process_performance_data=1
retain_state_information=1
state_retention_file=/usr/local/nagios/var/retention.dat

Command logging for audit trail
command_check_interval=15s
command_file=/usr/local/nagios/var/rw/nagios.cmd

Set up log rotation and monitoring

Configure automatic log rotation and monitoring of security events.

/usr/local/nagios/var/nagios.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 644 nagios nagios
    postrotate
        /bin/kill -HUP cat /usr/local/nagios/var/nagios.lock 2>/dev/null 2>/dev/null || true
    endscript
}

/usr/local/nagios/var/archives/*.log {
    monthly
    missingok
    rotate 12
    compress
    delaycompress
    notifempty
    create 644 nagios nagios
}

Configure Apache security logging

Enable detailed Apache access and error logging for security monitoring.

# Add these lines inside the VirtualHost block
LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/nagios_error.log
CustomLog ${APACHE_LOG_DIR}/nagios_access.log combined

Additional security logging
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %{SSL_PROTOCOL}x %{SSL_CIPHER}x" ssl_combined
CustomLog ${APACHE_LOG_DIR}/nagios_ssl.log ssl_combined

Set up automated certificate renewal

Configure automatic SSL certificate renewal to maintain security.

# Test certificate renewal
sudo certbot renew --dry-run

Create renewal hook script
sudo tee /etc/letsencrypt/renewal-hooks/post/reload-apache.sh << 'EOF'
#!/bin/bash
systemctl reload apache2
EOF

sudo chmod +x /etc/letsencrypt/renewal-hooks/post/reload-apache.sh

Verify cron job for auto-renewal
sudo systemctl status certbot.timer
sudo systemctl enable certbot.timer

Configure firewall rules

Restrict access to Nagios and ensure only necessary ports are open.

# Using UFW
sudo ufw allow 22/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP redirect'
sudo ufw allow 443/tcp comment 'HTTPS Nagios'
sudo ufw allow 5666/tcp comment 'NRPE'
sudo ufw --force enable
sudo ufw status numbered

# Using firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-port=5666/tcp --comment="NRPE"
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Restart and verify services

Restart all services and verify the secure configuration is working.

# Validate Nagios configuration
sudo /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Restart services
sudo systemctl restart nagios
sudo systemctl restart apache2

Verify services are running
sudo systemctl status nagios
sudo systemctl status apache2

Check SSL configuration
sudo apache2ctl -S

Configure security event monitoring

Set up monitoring for authentication failures and security events.

# Security monitoring service definitions
define service {
    use                     generic-service
    host_name               localhost
    service_description     SSH Failed Logins
    check_command           check_ssh_failed_logins
    check_interval          5
    notification_interval   30
}

define service {
    use                     generic-service
    host_name               localhost
    service_description     Apache Security Events
    check_command           check_apache_security
    check_interval          5
    notification_interval   30
}

define service {
    use                     generic-service
    host_name               localhost
    service_description     SSL Certificate Expiry
    check_command           check_ssl_cert!nagios.example.com!443!30!7
    check_interval          60
    notification_interval   1440
}

Create custom security check commands

Define commands to monitor security-related events and certificate status.

# Add these commands to your existing commands.cfg file

Check for SSH failed login attempts
define command {
    command_name    check_ssh_failed_logins
    command_line    /usr/local/nagios/libexec/check_log -F /var/log/auth.log -O /tmp/ssh_failed.tmp -q "Failed password"
}

Check Apache security events
define command {
    command_name    check_apache_security
    command_line    /usr/local/nagios/libexec/check_log -F /var/log/apache2/nagios_error.log -O /tmp/apache_security.tmp -q "error"
}

Check SSL certificate expiration
define command {
    command_name    check_ssl_cert
    command_line    /usr/local/nagios/libexec/check_http -H $ARG1$ -p $ARG2$ -S --certificate=$ARG3$,$ARG4$
}