Linux Networking Cookbook

13.15. Setting Up Secure Remote Nagios Administration with OpenSSL

Problem

Remote Nagios logins over SSH are OK, but you would like it to be even easier. Just fire up a web browser, log in to Nagios, and be done with it. You know you can do this with OpenSSL. How do you set it up?

Solution

On Fedora, it's as easy as falling over. Simply install Apache's SSL module with this command:

	# yum -y install mod_ssl

To restrict all access to HTTPS only, make sure these lines exist in httpd.conf:

	#Listen 80
	Listen 443

On Debian, it's a few more steps. Run these commands:

	# apt-get install apache2.2-common
	# a2enmod ssl
	# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl
	# ln -s /etc/apache2/sites-available/ssl /etc/apache2/sites-enabled/ssl

Then, create a new self-signed SSL certificate with the apache2-ssl-certificate script, which is part of apache2-common:

	# /usr/sbin/apache2-ssl-certificate -days 365

Now, edit /etc/apache2/sites-enabled/ssl. Replace the first three lines with these lines, using your own server name or IP address:

	NameVirtualHost *:443
	<VirtualHost *:443>
	ServerName windbag.alrac.net
	SSLEngine On
	SSLCertificateFile /etc/apache2/ssl/apache.pem

Put these lines in /etc/apache2/ports.conf:

	#Listen 80
	Listen 443

Restart Apache with a force-reload:

	# /etc/init.d/apache2 force-reload
	* Forcing reload of apache 2.0 web server...    [ ok ]

Now, fire up a web browser and try http://localhost/nagios and https://localhost/nagios. Only the second one should work. The first ...