LFCS · Question #219
Which of the following are common techniques for securing Nagios? (Select THREE correct answers)
The correct answer is A. Require authentication for access to the CGI scripts. D. Do not run as the root user. E. Disable external commands. Common Nagios security techniques include requiring authentication for web interface access, running the daemon as a non-root user, and carefully managing external command execution.
Question
Options
- ARequire authentication for access to the CGI scripts.
- BRun Nagios in a chroot jail.
- CCompile Nagios with the enabletls option.
- DDo not run as the root user.
- EDisable external commands.
How the community answered
(21 responses)- A95% (20)
- B5% (1)
Why each option
Common Nagios security techniques include requiring authentication for web interface access, running the daemon as a non-root user, and carefully managing external command execution.
Requiring authentication for CGI script access (e.g., via web server configuration) ensures that only authorized users can view the Nagios monitoring interface or issue commands.
While chroot jails can enhance security for some applications, running Nagios in a chroot jail is not a commonly recommended or standard security technique for typical deployments, often adding unnecessary complexity.
Nagios itself does not have a `enabletls` compilation option; TLS/SSL encryption for the web interface is typically configured at the web server layer (e.g., Apache, Nginx) that serves the Nagios CGI scripts.
Running the Nagios daemon as a dedicated non-root user adheres to the principle of least privilege, minimizing the impact if the Nagios process were to be compromised.
Disabling external commands (if not strictly required for functionality) mitigates the risk of unauthorized users or malicious scripts injecting arbitrary commands into the Nagios system.
Concept tested: Nagios security best practices
Source: https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/security.html
Topics
Community Discussion
No community discussion yet for this question.