Insecure openFirewall #5
Description
With the current openFirewall configuration Port 6556 is opened for everyone. So you can call telnet <IP> 6556 from any other device to see all Monitoring information.
I used the following configuration (for nftables) instead:
{
config,
pkgs,
check_mk_agent,
...
}:
let
cfg = config.services.check_mk_agent;
monitoringServerIp = "123.123.123.123";
in
{
imports = [ check_mk_agent.nixosModules.check_mk_agent ];
config = {
services.check_mk_agent = {
enable = true;
bind = "0.0.0.0";
openFirewall = false;
package = pkgs.check_mk_agent.override { enablePluginSmart = true; };
};
networking.firewall.extraInputRules = ''
ip saddr ${monitoringServerIp} tcp dport ${toString cfg.port} accept
'';
};
}