Checkmk Community Edition - Hardened Infra Monitoring

What is Checkmk Community Edition

Checkmk Community Edition is the free, GPL-2.0 edition of Checkmk, a monitoring system for servers, applications, networks, cloud services and containers. It is distributed as a self-contained stack: a single package brings its own Apache, Python runtime, Redis cache, RabbitMQ message broker, RRD time-series storage and monitoring core, so nothing has to be assembled from separate services. Monitoring is agent-based or agentless, and the service discovery is the point of the product: install the agent on a host, run a discovery, and Checkmk proposes the services it found rather than making you declare them. Several hundred official check plug-ins cover Linux, Windows, VMware, Kubernetes, databases, network hardware via SNMP, and the major cloud APIs. Configuration is done in the web UI with an explicit Activate-changes step, and a REST API covers the same operations for automation.

Why self-host monitoring

Monitoring data is an unusually complete map of your estate: hostnames, addresses, service inventory, response times and outage history. Self-hosting keeps all of it inside your own subscription, under your own retention and access rules, with no per-host or per-metric pricing to plan around. Checkmk stores its configuration as plain files and exposes a full REST API, so the setup can live in your own version control and be rebuilt from it.

What this VM image adds

Security hardening:

• The monitoring site is created on YOUR instance at first boot - not baked into the image, so its certificate authority, session-signing secret, automation secret and admin password are unique to your instance and exist nowhere else
• Admin password generated at first boot - written to a root-only credentials file
• All site listeners pinned to loopback - the site web server, the system web server and the message broker are reachable only from the instance itself, with nginx terminating TLS on 443 in front of them
• Message broker override - its shipped default listens on all interfaces; this build pins it to 127.0.0.1
• TLS ready - self-signed certificate out of the box, Certbot pre-installed so a CA-signed certificate is one command away
• Unused listening services masked - dependencies that a single-site installation never uses are switched off
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - SSH 22 and HTTPS 443 only; port 80 answers with a redirect to HTTPS and carries the certificate-issuance challenge, nothing else
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

Ready to use on first login:

• The agent is already installed - the Checkmk agent is installed on this server, so adding it as your first host takes three clicks and service discovery finds its services immediately

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
3. Read the generated password: sudo cat /root/checkmk-credentials.txt
4. Open https://<PUBLIC_IP>/, accept the self-signed certificate, then sign in as cmkadmin
5. Add your first host: Setup, Hosts, Add host; then run the service discovery and Activate changes

First launch takes 2-4 minutes while the monitoring site is created on your instance; until then the page shows a "Starting up" screen. Restrict NSG port 443 to your own address until you have signed in and changed the password.